Snowflake

Connect Snowflake to collect data export evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Snowflake:

   1. Snowflake has no API-token screen; Safeguard signs in as a Snowflake user with key-pair authentication. Create (or choose) a dedicated user and a dedicated role for Safeguard.
   2. In a terminal, generate a private key. Encrypted (recommended, AES-256-CBC): openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 aes-256-cbc -inform PEM -out rsa_key.p8. Unencrypted: openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt.
   3. Generate the public key: openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub.
   4. In Snowflake, assign the public key to the user (without the PEM delimiters): ALTER USER <user> SET RSA_PUBLIC_KEY = 'MIIBIjANBgkqh...';.
   5. Paste the contents of rsa_key.p8 into Private key (PEM) and, if you encrypted it, its passphrase into Private key passphrase (optional).
   6. As ACCOUNTADMIN, grant the Safeguard role access to the account usage views: USE ROLE ACCOUNTADMIN; GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE <role>; (Snowflake suggests SNOWFLAKE database roles as a narrower alternative).

   Where to find the other values:

   • Account: In Snowsight, open the account selector and select View account details; the Account Details dialog shows the account identifier (and the Account/Server URL).
   • User: The Snowflake user name you assigned the public key to.
   • Role: The role you granted IMPORTED PRIVILEGES on the SNOWFLAKE database to.

   Snowflake's public documentation does not cover every step.

   Key-pair auth is set with SQL, not a UI screen. Assigning the public key needs the MODIFY PROGRAMMATIC AUTHENTICATION METHODS or OWNERSHIP privilege on the user. Snowflake warns that IMPORTED PRIVILEGES on SNOWFLAKE can expose organization-level data and suggests SNOWFLAKE database roles (OBJECT_VIEWER, USAGE_VIEWER, GOVERNANCE_VIEWER, SECURITY_VIEWER) for ACCOUNT_USAGE views. Triple DES-encrypted keys are not recommended. Warehouse access (GRANT USAGE ON WAREHOUSE) and the Warehouse field were removed because no fetched page states them. The OAuth token field is optional and its setup was not documented here.

   Source: docs.snowflake.com, docs.snowflake.com, docs.snowflake.com, checked 2026-10-07.

   The permissions Safeguard needs: IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE, USAGE on the warehouse.

2. On Compliance › Connectors, open Snowflake, click Connect, choose API token and fill in:

   Field	What to enter
   Account	Required. For example: acme-ab12345
   User	Optional.
   Private key (PEM)	Optional. Paste the whole key, including the BEGIN and END lines. Stored encrypted and never shown again.
   Private key passphrase (optional)	Stored encrypted and never shown again.
   Role	Required.
   Warehouse	Required.

   Or, instead: OAuth token (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Snowflake and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Data Export connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks