> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake Key-Pair Read

*This is one of several Snowflake connectors, each its own integration card. This article covers **Snowflake Read-Only (Key-Pair Authentication)** (connector* `snowflake-keypair`*), a read-only sync of users and roles over JWT key-pair authentication. To also provision users and roles over key-pair auth, use [Snowflake Provisioning (Key-Pair Authentication)](/integrations/library/snowflake/snowflake-key-pair-write). For OAuth-based sync and provisioning, use [Snowflake](/integrations/library/snowflake/snowflake-multi-auth). For token-based read-only access, use [Snowflake Read-Only (PAT)](/integrations/library/snowflake/snowflake-pat).*

## After this article

You'll be able to connect Snowflake to Lumos in read-only mode. Lumos syncs users and their roles, and optionally object-level privileges, without any write access to your Snowflake account.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| :- | :- | :- | :- | :- |
| Users | Account | Yes | No | Snowflake user accounts and status |
| Roles | Permission | Yes | No | Role definitions and user role assignments |
| Privileges | Permission | Yes (opt-in) | No | Object-level privileges on databases, schemas, and tables. Privilege sync is off by default and enabled through a connector setting |

This connector is read-only. It performs no create, update, deactivate, delete, or role-assignment actions in Snowflake.

## Required plan and roles

* **Snowflake plan:** no minimum plan is required.
* **Integration user:** create a dedicated Snowflake user for Lumos. Because key-pair authentication is used, this user must be `TYPE = SERVICE`, or have its password set to `NULL` via `ALTER USER <user> SET PASSWORD = NULL`. Otherwise Snowflake enforces password expiry and blocks key-pair login with error 390106 even though no password is used. SSO enforcement on the account does not block key-pair service users.
* **Role and warehouse:** connect with a warehouse and a read-only role (for example `LUMOS_INTEGRATION_ROLE`) scoped to read users and roles, plus object grants if privilege sync is enabled. The connection identity is derived from warehouse plus account.
* **Key pair:** generate the RSA key pair for the connection before you submit the connection form using the form's **Get Key** control, then register the matching public key on the integration user in Snowflake.

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only mode this connector supports. It performs no create, update, deactivate, delete, or role-assignment actions in Snowflake, so every connection made through this card is read-only.

**What read-only requires.** A dedicated Snowflake integration user authenticated with an RSA key pair, connected through a role scoped to the `SNOWFLAKE.USAGE_VIEWER` and `SNOWFLAKE.SECURITY_VIEWER` database roles plus warehouse usage. Follow the steps below to create the user, role, and key pair.

**Watch out for.** A role limited to the two account-usage database roles above does not receive the disabled flag for the users it lists, so every account syncs into Lumos as Active, including users who are disabled in Snowflake. Read the troubleshooting note below before you rely on this connection for Access Reviews. To provision users and roles in Snowflake instead of just syncing them, you need a different connection, the Snowflake Provisioning (Key-Pair Authentication) card. Moving from this read-only connector to the provisioning one means setting up a new connection rather than upgrading this one in place, since the two are separate integration cards with separate required grants.

## Instructions

**Phase 1: Prepare the Snowflake integration user**

Log in to your Snowflake account at `https://your-account-identifier.snowflakecomputing.com`. Go to **Projects → Workspaces (Worksheets)** and click **+ Add New** to create a new SQL worksheet. Run the statements below step by step.

1. Create a dedicated integration user. Because key-pair auth is used, the user must be `TYPE = SERVICE`, or set its password to `NULL` (do not set a real password):
   ```sql theme={null}
   CREATE USER LUMOS_INTEGRATION_USER LOGIN_NAME = lumos_integration TYPE = SERVICE;
   -- or, for an existing user:
   ALTER USER LUMOS_INTEGRATION_USER SET PASSWORD = NULL;
   ```
2. Create the read-only role:
   ```sql theme={null}
   USE ROLE SECURITYADMIN;
   CREATE ROLE LUMOS_INTEGRATION_ROLE;
   ```
3. Grant the role read access to the Account Usage views and usage on the warehouse:
   ```sql theme={null}
   USE ROLE ACCOUNTADMIN;
   GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER TO ROLE LUMOS_INTEGRATION_ROLE;
   GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE LUMOS_INTEGRATION_ROLE;
   GRANT USAGE ON WAREHOUSE <warehouse-name> TO ROLE LUMOS_INTEGRATION_ROLE;
   ```
4. Associate the role with the user, set it as the default role, and grant the permission needed to register the RSA key:
   ```sql theme={null}
   GRANT ROLE LUMOS_INTEGRATION_ROLE TO USER LUMOS_INTEGRATION_USER;
   ALTER USER LUMOS_INTEGRATION_USER SET DEFAULT_ROLE = 'LUMOS_INTEGRATION_ROLE';
   GRANT MODIFY PROGRAMMATIC AUTHENTICATION METHODS ON USER LUMOS_INTEGRATION_USER TO ROLE LUMOS_INTEGRATION_ROLE;
   ```
5. Generate the key pair in the connection form. Enter a key identifier and select **"Generate new keys, even if keys exist already"**, then click **Get Key**. Copy the public key and register it on the integration user:
   ```sql theme={null}
   ALTER USER LUMOS_INTEGRATION_USER SET RSA_PUBLIC_KEY = '<your-public-key>';
   ```

**Phase 2: Connect in Lumos**

1. Find the **Snowflake Read-Only (Key-Pair Authentication)** card in your Lumos integrations (reconnect an existing card or add a new one).
2. Provide the account identifier, warehouse, role, and integration user.
3. Generate the key pair with **Get Key** before you submit, so the private key is created and stored with the connection, then click Connect.

## Troubleshooting

**Key-pair connection fails with error 390106 ("Specified password has expired").** Snowflake enforces password expiry on the integration user even for key-pair auth. Set the user to `TYPE = SERVICE`, or run `ALTER USER <user> SET PASSWORD = NULL`. SSO enforcement does not block key-pair service users.

**Error 390144 (JWT signature mismatch).** The stored public key no longer matches the private key held by the connection. Reconnect the integration in place with the matching key pair rather than generating a new one. Generating a new pair can orphan other integrations still using the previous private key.

**Connection form rejected the key-pair credential.** The form was submitted before the key pair was generated, so the staged credential lacked a private key and was classified as an unsupported auth method. Click **Get Key** to generate the pair before you submit.

**Every user syncs as Active.** Lumos lists accounts with a `SHOW USERS` query and marks an account Suspended only when Snowflake reports that account as disabled. Anything else becomes Active. The read-only role above holds the two account-usage database roles and warehouse usage only, and a role at that level does not receive the disabled flag for the users it lists, so the value arrives empty. Every account then lands in Lumos as Active, including users who are disabled in Snowflake. Access Reviews show disabled users as Active, so confirm a user's real status in Snowflake before acting on a review. If you need accurate status in Lumos, connect through a role that Snowflake allows to read full user detail, which is the level of access the provisioning setup in [Snowflake Provisioning (Key-Pair Authentication)](/integrations/library/snowflake/snowflake-key-pair-write) grants.

**Privileges are not syncing.** Object-level privilege sync is opt-in on this connector. Enable the privilege-sync connector setting if you need database, schema, or table privileges.