Snowflake Key-Pair Write

​

After this article

​

Capabilities

​

Required plan and roles

• Snowflake plan: no minimum plan is required.
• Integration user: create a dedicated Snowflake user for Lumos with a login name, for example CREATE USER LUMOS_INTEGRATION_USER LOGIN_NAME=lumos_integration. Because this connector authenticates with a key pair, set the user to TYPE = SERVICE or PASSWORD = NULL so Snowflake doesn’t enforce password expiry and block key-pair login with error 390106.
• Role and warehouse: connect with a warehouse and a role that can manage users and roles. The role needs GRANT CREATE USER ON ACCOUNT and GRANT MANAGE GRANTS ON ACCOUNT, plus GRANT USAGE ON WAREHOUSE. To register the RSA public key on the integration user, the role also needs GRANT MODIFY PROGRAMMATIC AUTHENTICATION METHODS ON USER. For privilege sync, grant the SNOWFLAKE.USAGE_VIEWER and SNOWFLAKE.SECURITY_VIEWER database roles so the role can read object grants. The connection identity is derived from warehouse + account.
• Key pair: generate the RSA key pair for the connection before submitting the connection form (use Get Key), then register the matching public key on the integration user with ALTER USER <user> SET RSA_PUBLIC_KEY = '<your-public-key>'.

​

Read-only access vs provisioning

​

Instructions

1. Log in to your Snowflake account at https://your-account-identifier.snowflakecomputing.com.
2. Go to Projects -> Workspaces (Worksheets) and click + Add New to create a new SQL worksheet.
3. Insert the following statements into the worksheet and run them step by step. They create the integration user and role, grant the account-usage and provisioning privileges, and allow key-pair registration:

// 1) Create a new user
CREATE USER LUMOS_INTEGRATION_USER LOGIN_NAME=lumos_integration PASSWORD='123456789';

// 2) Create a new role
USE ROLE SECURITYADMIN;
CREATE ROLE LUMOS_INTEGRATION_ROLE;

// 3) Allow the role to read SNOWFLAKE.ACCOUNT_USAGE views.
USE ROLE ACCOUNTADMIN;
GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER TO ROLE LUMOS_INTEGRATION_ROLE;
GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE LUMOS_INTEGRATION_ROLE;
GRANT USAGE ON WAREHOUSE <warehouse-name> TO ROLE LUMOS_INTEGRATION_ROLE;

// 4) Grant provisioning permissions to the role.
USE ROLE ACCOUNTADMIN;
GRANT CREATE USER ON ACCOUNT TO ROLE LUMOS_INTEGRATION_ROLE;
GRANT MANAGE GRANTS ON ACCOUNT TO ROLE LUMOS_INTEGRATION_ROLE;

// 5) Associate the necessary permissions to the user and role.
GRANT ROLE LUMOS_INTEGRATION_ROLE TO USER LUMOS_INTEGRATION_USER;
ALTER USER LUMOS_INTEGRATION_USER SET DEFAULT_ROLE='LUMOS_INTEGRATION_ROLE';
GRANT MODIFY PROGRAMMATIC AUTHENTICATION METHODS ON USER LUMOS_INTEGRATION_USER TO ROLE LUMOS_INTEGRATION_ROLE;

4. Generate a key pair. In the connection form’s key field, enter a key identifier of your choice, select Generate new keys, even if keys exist already, and click Get Key.
5. Copy the public key and assign it to the integration user:

ALTER USER LUMOS_INTEGRATION_USER SET RSA_PUBLIC_KEY='<your-public-key>';

1. Find the Snowflake Provisioning (Key-Pair Authentication) card in your Lumos integrations (Reconnect or add new).
2. Provide the account identifier, warehouse, role, and integration user.
3. Generate the key pair with Get Key before submitting, then click Connect.

​

Troubleshooting