Snowflake

Keel connects with Snowflake.Data using a key pair (preferred) or a password, and tags its statements anchor-keel.

Read-only role script

-- Run as SECURITYADMIN (or a role that can create roles and users), then use KEEL_SVC in Keel.
CREATE ROLE IF NOT EXISTS KEEL_READER;
GRANT USAGE ON WAREHOUSE KEEL_WH TO ROLE KEEL_READER;
GRANT USAGE ON DATABASE ANALYTICS TO ROLE KEEL_READER;
GRANT USAGE ON ALL SCHEMAS IN DATABASE ANALYTICS TO ROLE KEEL_READER;
GRANT SELECT ON ALL TABLES IN DATABASE ANALYTICS TO ROLE KEEL_READER;
GRANT SELECT ON ALL VIEWS IN DATABASE ANALYTICS TO ROLE KEEL_READER;
GRANT SELECT ON FUTURE TABLES IN DATABASE ANALYTICS TO ROLE KEEL_READER;
GRANT SELECT ON FUTURE VIEWS IN DATABASE ANALYTICS TO ROLE KEEL_READER;
-- Key-pair service user: generate the key with
--   openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out keel_key.p8 -nocrypt
--   openssl rsa -in keel_key.p8 -pubout -out keel_key.pub
CREATE USER IF NOT EXISTS KEEL_SVC TYPE = SERVICE DEFAULT_ROLE = KEEL_READER DEFAULT_WAREHOUSE = KEEL_WH
  RSA_PUBLIC_KEY = '<contents of keel_key.pub without the header and footer lines>';
GRANT ROLE KEEL_READER TO USER KEEL_SVC;
-- Optional, for usage-based inference: query history (SNOWFLAKE.ACCOUNT_USAGE).
GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE KEEL_READER;

Before you run it:

• Run it as SECURITYADMIN (or a role that can create roles and users). Replace KEEL_WH and ANALYTICS with your warehouse and database.
• Generate the key pair with the openssl commands in the script and paste the private key into Keel; the public key goes on the user.
• The GOVERNANCE_VIEWER database role is optional (query history in SNOWFLAKE.ACCOUNT_USAGE, for usage-based inference).

In Keel

Sources › Connect source › Snowflake: Account host (*.snowflakecomputing.com), database, warehouse, optional role, user, and private key or password. Then Test: Keel checks the network, authentication, metadata access, least privilege and query-log access, and warns if the principal can write.

How this script is verified

Syntax-checked only. There is no Snowflake engine or emulator in CI, so this script is not run; every docs build lints it (only role, user and read grants may appear) and a unit test keeps it identical to the product's. Check it on your account before relying on it. See Connect sources.