Skip to main content
This article covers the multi-auth Snowflake connector (“Snowflake Provisioning (Multi-Auth)”). It offers two selectable credentials, an RSA key pair or a programmatic access token (PAT), and replaces the deprecated OAuth security-integration model. You pick one credential when you connect. For the older OAuth connector and the single-method key-pair and PAT variants, see Snowflake, Snowflake Read-Only (Key-Pair Authentication), and Snowflake Read-Only (PAT).

​
After this article

You will be able to connect Snowflake to Lumos to sync users, roles, privileges, and usage data, and to create, update, deactivate, and delete Snowflake users and manage their role assignments.

​
Capabilities

The connector also exposes a custom Set Default Role action.

​
Required plan and roles

  • Snowflake plan: no minimum plan is required.
  • Integration role: the connection runs as the role named in Role (default LUMOS_INTEGRATION_ROLE) against the Warehouse and Account ID you supply. Grant that role the database roles SNOWFLAKE.USAGE_VIEWER and SNOWFLAKE.SECURITY_VIEWER, which sync and Access Reviews require.
  • Provisioning privileges: to create and manage users, the role also needs the account privileges CREATE USER and MANAGE GRANTS, plus ACCOUNTADMIN. Without them the connection still validates and syncs, but write actions fail.
  • Credential (choose one):
    • Key pair: an RSA key pair that Lumos generates for you in the connection form (Get Key). You register the public key on the Snowflake integration user; the private key is created and stored with the connection.
    • PAT: a Snowflake programmatic access token.

​
Read-only access vs provisioning

Is read-only possible? Yes. Granting the integration role only the SNOWFLAKE.USAGE_VIEWER and SNOWFLAKE.SECURITY_VIEWER database roles lets the connection validate and sync users, roles, privileges, and usage data with no write access. Without the additional provisioning grants the connection still validates and syncs, and write actions fail. What read-only requires. The integration role (default LUMOS_INTEGRATION_ROLE) granted the SNOWFLAKE.USAGE_VIEWER and SNOWFLAKE.SECURITY_VIEWER database roles only, plus either an RSA key pair generated with Get Key or a Snowflake programmatic access token. Follow the steps below and stop after the sync-only grants. What full provisioning requires. The same role additionally granted the CREATE USER and MANAGE GRANTS account privileges and ACCOUNTADMIN. With those grants the connector can create, update, deactivate, and delete users and manage role assignments, using the same key pair or PAT credential you already configured. Watch out for. On a read-only connection, a role limited to the two account-usage database roles does not receive the disabled flag for the users it lists, so every account syncs into Lumos as Active, including users who are disabled in Snowflake. Read the troubleshooting note below before you rely on a read-only connection for Access Reviews. Changing the warehouse on an existing connection registers as a new integration rather than updating the current one, because the integration identity is derived from warehouse plus account. Automated deprovisioning skips Snowflake accounts with a NULL email, so populate the email attribute on any user you want Lumos to deprovision automatically. A PAT that is expired or disabled is rejected at connect time.

​
Instructions

Phase 1: Prepare Snowflake
  1. Create or choose the integration role (default LUMOS_INTEGRATION_ROLE) and grant it the database roles SNOWFLAKE.USAGE_VIEWER and SNOWFLAKE.SECURITY_VIEWER.
  2. For provisioning, grant the role the CREATE USER and MANAGE GRANTS account privileges and ACCOUNTADMIN.
  3. Create the credential you plan to use:
    • Key pair: in the Lumos connection form, enter a key identifier, select Generate new keys, even if keys exist already, and click Get Key. Copy the public key and register it on the integration user: ALTER USER LUMOS_INTEGRATION_USER SET RSA_PUBLIC_KEY = '<your-public-key>';
    • PAT: generate a programmatic access token for the Snowflake user. Confirm it is active, not expired or disabled.
  4. Note your Account ID and the Warehouse the integration should use.
Phase 2: Connect in Lumos
  1. Go to Settings → Integrations → Snowflake Provisioning (Multi-Auth) and click Connect (reconnect an existing card or add a new one).
  2. Enter the Account ID, Warehouse, and Role.
  3. Choose the credential path. For a key pair, generate it with Get Key before you submit. For a PAT, paste the token.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

PAT credential is rejected. Lumos decodes the token and fails on an EXPIRED or DISABLED state. Generate a fresh, active programmatic access token and reconnect. Key-pair connect fails with “Invalid private key: could not decode base64 data”, or Snowflake rejects the public key with “Invalid Public key”. Connections attempted before 18 September 2026 generated an OpenSSH-format key pair that Snowflake does not accept. Reconnect the card and generate a fresh pair with Get Key; the pair is now produced in the PKCS#8 PEM format Snowflake expects. Connected, but write actions fail. The integration role is missing provisioning grants. Grant it CREATE USER, MANAGE GRANTS, and ACCOUNTADMIN, then retry. Sync works with only the USAGE_VIEWER and SECURITY_VIEWER database roles. Automated removals never dispatch. The Lumos matched-account safety check rejects Snowflake accounts it cannot validate against a user. Accounts with a NULL email (common for service or ghost users) are skipped. Populate the email attribute on Snowflake users you want Lumos to deprovision automatically. Changing the warehouse when reconnecting has unexpected behaviour. Reconnection should only be used to update credentials, avoid specifying a different warehouse or environment when reconnecting the snowflake integration. On a read-only connection, every user syncs as Active. Lumos lists accounts with a SHOW USERS query and marks an account Suspended only when Snowflake reports that account as disabled. Anything else becomes Active. A role holding only the SNOWFLAKE.USAGE_VIEWER and SNOWFLAKE.SECURITY_VIEWER database roles does not receive the disabled flag for the users it lists, so the value arrives empty and every account lands in Lumos as Active, including users who are disabled in Snowflake. Access Reviews show disabled users as Active, so confirm a user’s real status in Snowflake before acting on a review. Granting the role the provisioning privileges described above restores accurate status alongside write access.