Snowflake setup guide

Elglide loads into your own Snowflake account as a service user that signs in with a key pair. Generate the key, run one script in a Snowsight worksheet, then fill in the Snowflake connection in Elglide. It takes about ten minutes.

What Elglide needs, and what it doesn't

Elglide asks for the least it can work with. Its role gets two grants on one database and one on one warehouse — nothing account-wide.

Not needed: ACCOUNTADMIN, CREATE DATABASE, CREATE INTEGRATION, a named stage or file format, or any grant on your other databases. Elglide never creates the database itself — you create it (the script below does) so it keeps your retention, tags and ownership.

Your admins stay in control. The script grants the Elglide role to SYSADMIN, so your admins can manage or drop everything Elglide creates. Never grant SYSADMIN, or any admin role, to the Elglide role.

Loading into a schema that already exists

By default Elglide creates its own schema, and nothing more is needed. To load into a schema you already have, pick one option and run it as the schema's owner.

Option A — Transfer ownership (recommended). Everything works, including new and changed columns. COPY CURRENT GRANTS keeps your other roles' access.

GRANT OWNERSHIP ON SCHEMA MY_DB.MY_SCHEMA
  TO ROLE ELGLIDE_ROLE COPY CURRENT GRANTS;
GRANT OWNERSHIP ON ALL TABLES IN SCHEMA MY_DB.MY_SCHEMA
  TO ROLE ELGLIDE_ROLE COPY CURRENT GRANTS;

Option B — Grant privileges. For when your policy doesn't allow a vendor role to own objects.

GRANT USAGE, CREATE TABLE ON SCHEMA MY_DB.MY_SCHEMA TO ROLE ELGLIDE_ROLE;
GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE
  ON ALL TABLES IN SCHEMA MY_DB.MY_SCHEMA TO ROLE ELGLIDE_ROLE;
GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE
  ON FUTURE TABLES IN SCHEMA MY_DB.MY_SCHEMA TO ROLE ELGLIDE_ROLE;

In a managed access schema, run these as the schema owner or a role with MANAGE GRANTS.

Step 1 — Generate a key pair

Snowflake is retiring passwords for service users, so Elglide signs in with a key pair. You keep the private key; only the public key goes into Snowflake. Pick one option and run its commands in a terminal, in the folder where you want the files.

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 aes256 -inform PEM -out rsa_key.p8

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

Snowflake's own guide covers the same steps in more depth: Key-pair authentication and key-pair rotation.

Step 2 — Run the setup script

Open a new SQL worksheet in Snowsight and paste the script. Change the four names at the top if you like (keep them in UPPERCASE); point warehouse_name or database_name at ones you already have to reuse them. Then open rsa_key.pub in a text editor, copy the text between the BEGIN and END lines, paste it into the last statement as a single line, and run all.

-- Elglide setup for Snowflake. Change the names if you like; keep them UPPERCASE.
SET role_name      = 'ELGLIDE_ROLE';
SET user_name      = 'ELGLIDE_USER';
SET warehouse_name = 'ELGLIDE_WH';    -- or the name of an existing warehouse
SET database_name  = 'ELGLIDE_DB';    -- or the name of an existing database

-- 1. The role, and a service user that signs in with a key pair only
USE ROLE SECURITYADMIN;
CREATE ROLE IF NOT EXISTS IDENTIFIER($role_name);
GRANT ROLE IDENTIFIER($role_name) TO ROLE SYSADMIN;
CREATE USER IF NOT EXISTS IDENTIFIER($user_name)
    TYPE              = SERVICE
    DEFAULT_ROLE      = $role_name
    DEFAULT_WAREHOUSE = $warehouse_name
    COMMENT           = 'Elglide loads data as this user';
GRANT ROLE IDENTIFIER($role_name) TO USER IDENTIFIER($user_name);

-- 2. A small warehouse that suspends itself, and the database to load into
USE ROLE SYSADMIN;
CREATE WAREHOUSE IF NOT EXISTS IDENTIFIER($warehouse_name)
    WAREHOUSE_SIZE = XSMALL  AUTO_SUSPEND = 60  AUTO_RESUME = TRUE  INITIALLY_SUSPENDED = TRUE;
CREATE DATABASE IF NOT EXISTS IDENTIFIER($database_name);

-- 3. The only grants Elglide needs
GRANT USAGE ON WAREHOUSE IDENTIFIER($warehouse_name) TO ROLE IDENTIFIER($role_name);
GRANT USAGE, CREATE SCHEMA ON DATABASE IDENTIFIER($database_name) TO ROLE IDENTIFIER($role_name);

-- 4. The public key from rsa_key.pub (the text between BEGIN and END, on one line)
USE ROLE SECURITYADMIN;
ALTER USER IDENTIFIER($user_name) SET RSA_PUBLIC_KEY = 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...';

Check it: run DESC USER ELGLIDE_USER; — the RSA_PUBLIC_KEY_FP row should show a fingerprint. To load into more databases later, run the GRANT USAGE, CREATE SCHEMA line again for each one.

Step 3 — Create the Snowflake connection in Elglide

In Elglide, open Connections, switch to the Destinations tab and press Add.

Press Test Connection. Elglide signs in and runs a one-row query on the warehouse, so a key, role or warehouse problem — or a suspended account — shows here rather than on the first sync. Then tick the database to load into (ELGLIDE_DB) and press Create Connection.

Warehouses: a default, then tune per task

The default

Start with one dedicated XSMALL warehouse with AUTO_SUSPEND = 60, as the script creates. A warehouse of its own means Elglide's credits show up on their own line in your Snowflake bill, and loads never queue behind your dashboards. Sharing an existing warehouse works too, and costs less when that warehouse is running anyway — at the price of contending with your other queries.

Per task

Any task can use a different warehouse: open the task and set Task Options → Snowflake warehouse. Leave it empty to use the connection's default. The list shows only the warehouses the Elglide role has USAGE on, so grant USAGE on a second warehouse to make it appear.

Tips

• Size up for the big jobs, then back down. A first Full load of a large table, or a wide MERGE, finishes sooner on a larger warehouse. Point that one task at it, and clear the override once it settles into small incremental runs.
• Size changes Snowflake's share only. Reading the source and uploading the files take the same time on any warehouse; size affects COPY, MERGE and audits.
• Keep small, frequent tasks together. Snowflake bills at least a minute each time a warehouse resumes. Many small tasks on one warehouse wake it once; spread over several, they wake each.
• Cap the spend. A Snowflake resource monitor on ELGLIDE_WH can notify you, or suspend the warehouse, at a credit limit you choose.
• See what it costs. SNOWFLAKE.ACCOUNT_USAGE.WAREHOUSE_METERING_HISTORY, filtered on ELGLIDE_WH, shows its credits by hour.
• A removed warehouse doesn't stop a task. If a task's warehouse is dropped or its grant revoked, the task runs on the connection's default and its log warns you, so the data keeps flowing while you fix it.

Adaptive warehouses

Snowflake's adaptive warehouses size their compute to each query, so there is no size to choose. Elglide works with them like any other warehouse: grant USAGE and pick it as the default or for a task. The feature is new and not yet generally available in every Snowflake region — check Snowflake's documentation for yours.

Snowflake network policies

If your account restricts sign-in with a network policy, the policy must allow Elglide's addresses. Check Elglide's IPs at Help → IP allowlist in the app (sign-in required; the public explainer is Direct connection — IP allowlist).

Once the list is published, allow it for the Elglide user only, so the rest of your account keeps its own policy:

CREATE NETWORK POLICY ELGLIDE_POLICY
    ALLOWED_IP_LIST = ('<the addresses from Help → IP allowlist>');
ALTER USER ELGLIDE_USER SET NETWORK_POLICY = ELGLIDE_POLICY;

With a hybrid agent

With the hybrid agent, rows are read and the files uploaded from inside your network straight to your Snowflake stage — never through Elglide's cloud. The COPY and MERGE statements that load those files still come from Elglide's cloud, so the network-policy note above applies to hybrid tenants too. Both connect as the same Elglide user.

The agent's host needs outbound HTTPS (port 443) to your Snowflake account and its stage storage. SELECT SYSTEM$ALLOWLIST(); lists the host names your firewall must allow.

What Elglide leaves in your account

• Schemas and tables it creates in the database, owned by ELGLIDE_ROLE. Grant your analysts' roles SELECT on them as you would any table.
• Files in the Elglide user's stage, under @~/elglide/. Each run's files are removed once they are loaded. A RowHash task keeps one snapshot file, its baseline for finding changes. Sign in as the Elglide user and run LIST @~/elglide/; to see them.

Rotating the key: set the new public key with ALTER USER ELGLIDE_USER SET RSA_PUBLIC_KEY_2 = '…';, paste the new private key into the Elglide connection and Test it, then ALTER USER ELGLIDE_USER UNSET RSA_PUBLIC_KEY;.

Troubleshooting

Next

Back to Getting started → Build the pipeline: wire a source to this Snowflake connection.