Snowflake Key-Pair Read

This is one of several Snowflake connectors, each its own integration card. This article covers Snowflake Read-Only (Key-Pair Authentication) (connector snowflake-keypair), a read-only sync of users and roles over JWT key-pair authentication. To also provision users and roles over key-pair auth, use Snowflake Provisioning (Key-Pair Authentication). For OAuth-based sync and provisioning, use Snowflake. For token-based read-only access, use Snowflake Read-Only (PAT).

​

After this article

You’ll be able to connect Snowflake to Lumos in read-only mode. Lumos syncs users and their roles, and optionally object-level privileges, without any write access to your Snowflake account.

​

Capabilities

This connector is read-only. It performs no create, update, deactivate, delete, or role-assignment actions in Snowflake.

​

Required plan and roles

• Snowflake plan: no minimum plan is required.
• Integration user: create a dedicated Snowflake user for Lumos. Because key-pair authentication is used, this user must be TYPE = SERVICE, or have its password set to NULL via ALTER USER <user> SET PASSWORD = NULL. Otherwise Snowflake enforces password expiry and blocks key-pair login with error 390106 even though no password is used. SSO enforcement on the account does not block key-pair service users.
• Role and warehouse: connect with a warehouse and a read-only role (for example LUMOS_INTEGRATION_ROLE) scoped to read users and roles, plus object grants if privilege sync is enabled. The connection identity is derived from warehouse plus account.
• Key pair: generate the RSA key pair for the connection before you submit the connection form using the form’s Get Key control, then register the matching public key on the integration user in Snowflake.

​

Read-only access vs provisioning

Is read-only possible? Yes, and it’s the only mode this connector supports. It performs no create, update, deactivate, delete, or role-assignment actions in Snowflake, so every connection made through this card is read-only. What read-only requires. A dedicated Snowflake integration user authenticated with an RSA key pair, connected through a role scoped to the SNOWFLAKE.USAGE_VIEWER and SNOWFLAKE.SECURITY_VIEWER database roles plus warehouse usage. Follow the steps below to create the user, role, and key pair. Watch out for. A role limited to the two account-usage database roles above does not receive the disabled flag for the users it lists, so every account syncs into Lumos as Active, including users who are disabled in Snowflake. Read the troubleshooting note below before you rely on this connection for Access Reviews. To provision users and roles in Snowflake instead of just syncing them, you need a different connection, the Snowflake Provisioning (Key-Pair Authentication) card. Moving from this read-only connector to the provisioning one means setting up a new connection rather than upgrading this one in place, since the two are separate integration cards with separate required grants.

​

Instructions

Phase 1: Prepare the Snowflake integration user Log in to your Snowflake account at https://your-account-identifier.snowflakecomputing.com. Go to Projects → Workspaces (Worksheets) and click + Add New to create a new SQL worksheet. Run the statements below step by step.

1. Create a dedicated integration user. Because key-pair auth is used, the user must be TYPE = SERVICE, or set its password to NULL (do not set a real password):
   CREATE USER LUMOS_INTEGRATION_USER LOGIN_NAME = lumos_integration TYPE = SERVICE;
   -- or, for an existing user:
   ALTER USER LUMOS_INTEGRATION_USER SET PASSWORD = NULL;
   
2. Create the read-only role:
   USE ROLE SECURITYADMIN;
   CREATE ROLE LUMOS_INTEGRATION_ROLE;
   
3. Grant the role read access to the Account Usage views and usage on the warehouse:
   USE ROLE ACCOUNTADMIN;
   GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER TO ROLE LUMOS_INTEGRATION_ROLE;
   GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE LUMOS_INTEGRATION_ROLE;
   GRANT USAGE ON WAREHOUSE <warehouse-name> TO ROLE LUMOS_INTEGRATION_ROLE;
   
4. Associate the role with the user, set it as the default role, and grant the permission needed to register the RSA key:
   GRANT ROLE LUMOS_INTEGRATION_ROLE TO USER LUMOS_INTEGRATION_USER;
   ALTER USER LUMOS_INTEGRATION_USER SET DEFAULT_ROLE = 'LUMOS_INTEGRATION_ROLE';
   GRANT MODIFY PROGRAMMATIC AUTHENTICATION METHODS ON USER LUMOS_INTEGRATION_USER TO ROLE LUMOS_INTEGRATION_ROLE;
   
5. Generate the key pair in the connection form. Enter a key identifier and select “Generate new keys, even if keys exist already”, then click Get Key. Copy the public key and register it on the integration user:
   ALTER USER LUMOS_INTEGRATION_USER SET RSA_PUBLIC_KEY = '<your-public-key>';
   

Phase 2: Connect in Lumos

1. Find the Snowflake Read-Only (Key-Pair Authentication) card in your Lumos integrations (reconnect an existing card or add a new one).
2. Provide the account identifier, warehouse, role, and integration user.
3. Generate the key pair with Get Key before you submit, so the private key is created and stored with the connection, then click Connect.

​

Troubleshooting

Key-pair connection fails with error 390106 (“Specified password has expired”). Snowflake enforces password expiry on the integration user even for key-pair auth. Set the user to TYPE = SERVICE, or run ALTER USER <user> SET PASSWORD = NULL. SSO enforcement does not block key-pair service users. Error 390144 (JWT signature mismatch). The stored public key no longer matches the private key held by the connection. Reconnect the integration in place with the matching key pair rather than generating a new one. Generating a new pair can orphan other integrations still using the previous private key. Connection form rejected the key-pair credential. The form was submitted before the key pair was generated, so the staged credential lacked a private key and was classified as an unsupported auth method. Click Get Key to generate the pair before you submit. Every user syncs as Active. Lumos lists accounts with a SHOW USERS query and marks an account Suspended only when Snowflake reports that account as disabled. Anything else becomes Active. The read-only role above holds the two account-usage database roles and warehouse usage only, and a role at that level does not receive the disabled flag for the users it lists, so the value arrives empty. Every account then lands in Lumos as Active, including users who are disabled in Snowflake. Access Reviews show disabled users as Active, so confirm a user’s real status in Snowflake before acting on a review. If you need accurate status in Lumos, connect through a role that Snowflake allows to read full user detail, which is the level of access the provisioning setup in Snowflake Provisioning (Key-Pair Authentication) grants. Privileges are not syncing. Object-level privilege sync is opt-in on this connector. Enable the privilege-sync connector setting if you need database, schema, or table privileges.