Snowflake PAT

​

After this article

​

Capabilities

​

Required plan and roles

• Snowflake role: you need an admin role (SECURITYADMIN and ACCOUNTADMIN in the setup steps) to create the integration user and role and to grant the account-usage views.
• Authentication: a Snowflake programmatic access token (PAT) issued to a dedicated integration user. Tokens expire, so plan to renew them.
• Network and authentication policies: if your account restricts ingress by IP, the network policy must allow Lumos outbound IPs. If your account enforces an authentication policy, it must permit PROGRAMMATIC_ACCESS_TOKEN.

​

Read-only access vs provisioning

​

Instructions

1. Log in to your Snowflake account at https://your-account-identifier.snowflakecomputing.com.
2. Go to Projects → Workspaces (Worksheets) and click + Add New to open a new SQL worksheet.
3. Run the following, step by step:

-- a) Create a new user
CREATE USER LUMOS_INTEGRATION_USER LOGIN_NAME=lumos_integration PASSWORD='123456789';

-- b) Create a new role
USE ROLE SECURITYADMIN;
CREATE ROLE LUMOS_INTEGRATION_ROLE;

-- c) Allow the role to read SNOWFLAKE.ACCOUNT_USAGE views
USE ROLE ACCOUNTADMIN;
GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER TO ROLE LUMOS_INTEGRATION_ROLE;
GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE LUMOS_INTEGRATION_ROLE;
GRANT USAGE ON WAREHOUSE <warehouse-name> TO ROLE LUMOS_INTEGRATION_ROLE;

-- d) Associate the permissions with the user and role
GRANT ROLE LUMOS_INTEGRATION_ROLE TO USER LUMOS_INTEGRATION_USER;
ALTER USER LUMOS_INTEGRATION_USER SET DEFAULT_ROLE='LUMOS_INTEGRATION_ROLE';
GRANT MODIFY PROGRAMMATIC AUTHENTICATION METHODS ON USER LUMOS_INTEGRATION_USER TO ROLE LUMOS_INTEGRATION_ROLE;

4. Optional, for accurate account status. Lumos reads each user’s email, first name, and last name from SNOWFLAKE.ACCOUNT_USAGE.USERS, which SECURITY_VIEWER already allows, so those fields sync without any extra grant. Snowflake only returns the disabled column when the active role holds OWNERSHIP on the user or MANAGE GRANTS on the account, so under the read-only role every account syncs as Active. To fix that, grant MANAGE GRANTS to the integration role. This is a privilege elevation and is not required for the connection to run:

USE ROLE SECURITYADMIN;
GRANT MANAGE GRANTS ON ACCOUNT TO ROLE LUMOS_INTEGRATION_ROLE;

1. If you restrict ingress by IP, go to Governance & Security → Network Policies and create a policy. Add a new rule in Ingress mode that includes the Lumos outbound IPs:
   • 44.228.74.159
   • 54.244.99.235 Warning: an overly restrictive network policy can lock you out of Snowflake. Include both the Lumos IPs and the IP ranges you use for admin access, validate the allowlist, and confirm you have a recovery method before enabling it.
2. Assign the policy to the integration user:

USE ROLE SECURITYADMIN;
ALTER USER LUMOS_INTEGRATION_USER SET NETWORK_POLICY = "YOUR_POLICY_NAME";

3. If your account enforces an authentication policy, allow token auth:

ALTER AUTHENTICATION POLICY my_auth_policy
  SET AUTHENTICATION_METHODS = ('OAUTH', 'PASSWORD', 'PROGRAMMATIC_ACCESS_TOKEN');

4. Tokens expire in 15 days by default. To change the default and maximum expiration:

ALTER AUTHENTICATION POLICY my_auth_policy
  SET PAT_POLICY = (
    DEFAULT_EXPIRY_IN_DAYS = 90
    MAX_EXPIRY_IN_DAYS = 365
  );

1. Complete all of the previous steps first. The integration will not work if you generate the token early.
2. Go to Governance & Security → Users, open the LUMOS_INTEGRATION_USER account, and scroll to Programmatic access tokens.
3. Click Generate New Token, name it, select the LUMOS_INTEGRATION_ROLE, and click Generate. Copy the token.
4. In Lumos, go to Settings → Integrations and open the Snowflake Read-Only (PAT) card.
5. Enter your Account Identifier and paste the token, then click Connect.

​

API Endpoints Used

​

Troubleshooting