Snowflake

Connect Snowflake to inventory every Cortex AI function caller, Snowpark UDF / stored procedure touching LLMs, Snowflake Native App, and Streamlit-in-Snowflake agent operating in your account. Snowflake connects with key-pair authentication — you create a read-only service user once, assign it an RSA public key, then paste the account, user, and private key into the dashboard. (Password / PAT auth is supported as a fallback.)

What gets observed

• Cortex AI function usage — per-user counts via SNOWFLAKE.ACCOUNT_USAGE.CORTEX_FUNCTIONS_USAGE_HISTORY.
• Cortex Search + Cortex Analyst service inventory.
• Snowpark UDFs + stored procedures invoking external functions or LLMs.
• Streamlit-in-Snowflake apps + installed third-party native apps.
• External access integrations + network rules.
• Login + role-grant audit history from SNOWFLAKE.ACCOUNT_USAGE.

Cortex prompt + completion content is not exposed via ACCOUNT_USAGE — the connector reads invocation envelopes (model, function, caller, byte counts). For prompt-level fidelity, instrument the calling application with the Python SDK.

Setup

# 1. As an ACCOUNTADMIN, create a dedicated read-only role + service user
#    (account-level config, run once):
#
#    CREATE ROLE TREFUR_READONLY;
#    GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE TREFUR_READONLY;
#    GRANT USAGE ON WAREHOUSE <warehouse> TO ROLE TREFUR_READONLY;
#    -- Grants to ACCOUNT_USAGE views happen automatically via the import.
#
#    CREATE USER TREFUR_SERVICE
#      DEFAULT_ROLE = TREFUR_READONLY
#      DEFAULT_WAREHOUSE = <warehouse>;
#    GRANT ROLE TREFUR_READONLY TO USER TREFUR_SERVICE;
#
# 2. Generate an RSA key pair for key-pair authentication (recommended):
#    openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out trefur_key.p8 -nocrypt
#    openssl rsa -in trefur_key.p8 -pubout -out trefur_key.pub
#
# 3. Assign the PUBLIC key to the service user (paste the key body only,
#    without the -----BEGIN/END----- lines and without newlines):
#    ALTER USER TREFUR_SERVICE SET RSA_PUBLIC_KEY='MIIB...';
#
# 4. In the dashboard open Settings → Integrations → Snowflake and fill
#    the form:
#      - Snowflake account   (e.g. xy12345.us-east-1)
#      - Username            (TREFUR_SERVICE)
#      - Private key (PEM)    contents of trefur_key.p8   ← recommended
#        or Password / PAT    (fallback if you skip key-pair auth)
#      - Role (optional)      (TREFUR_READONLY)
#      - Warehouse (optional) (COMPUTE_WH)

Privileges requested

Troubleshooting

Back to all integrations.