> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake PAT

*Lumos offers several Snowflake connectors, each its own integration card. This article covers the read-only connector that authenticates with a **personal access token (PAT)**. For the OAuth connector with provisioning, see Snowflake. For key-pair setups, see Snowflake Read-Only (Key-Pair Authentication) and Snowflake Provisioning (Key-Pair Authentication).*

## After this article

You will be able to connect Snowflake to Lumos with a personal access token to sync users, roles, privileges, and usage data. This connector is read-only and does not provision.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| :- | :- | :- | :- | :- |
| Users | Account | Yes | No | Snowflake user accounts |
| Roles | Permission | Yes | No | Role definitions and assignments |
| Privileges | Permission | Yes | No | Object-level privileges on databases, schemas, and tables |
| Usage Data | Usage | Yes | No | User login and activity from the Account Usage schema |

This connector is read-only, so it does not create, update, deactivate, or delete users. For provisioning, use the Snowflake OAuth connector or the key-pair provisioning connector.

## Required plan and roles

* **Snowflake role:** you need an admin role (SECURITYADMIN and ACCOUNTADMIN in the setup steps) to create the integration user and role and to grant the account-usage views.
* **Authentication:** a Snowflake programmatic access token (PAT) issued to a dedicated integration user. Tokens expire, so plan to renew them.
* **Network and authentication policies:** if your account restricts ingress by IP, the network policy must allow Lumos outbound IPs. If your account enforces an authentication policy, it must permit `PROGRAMMATIC_ACCESS_TOKEN`.

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only mode. This connector authenticates with a personal access token and performs no create, update, deactivate, or delete actions in Snowflake.

**What read-only requires.** A dedicated Snowflake integration user authenticated with a Snowflake programmatic access token (PAT), connected through a role granted the `SNOWFLAKE.USAGE_VIEWER` and `SNOWFLAKE.SECURITY_VIEWER` database roles. Follow the steps below to create the user, role, and token.

**Watch out for.** A role limited to the two account-usage database roles above does not receive the disabled flag for the users it lists, so every account syncs into Lumos as Active, including users who are disabled in Snowflake. An optional MANAGE GRANTS grant in the instructions fixes this. Read the troubleshooting note below before you rely on this connection for Access Reviews. PATs expire in 15 days by default, so plan to renew them or raise the expiry with a `PAT_POLICY`, or the connection will stop syncing. If your account restricts ingress by IP, the network policy must allow the Lumos outbound IPs, and if it enforces an authentication policy, that policy must permit`PROGRAMMATIC_ACCESS_TOKEN`. To provision users and roles instead of just syncing them, use the Snowflake OAuth connector or the key-pair provisioning connector, both separate integration cards.

## Instructions

**Phase 1: Create the integration user and role in Snowflake**

1. Log in to your Snowflake account at `https://your-account-identifier.snowflakecomputing.com`.
2. Go to **Projects → Workspaces (Worksheets)** and click **+ Add New** to open a new SQL worksheet.
3. Run the following, step by step:

```sql theme={null}
-- a) Create a new user
CREATE USER LUMOS_INTEGRATION_USER LOGIN_NAME=lumos_integration PASSWORD='123456789';

-- b) Create a new role
USE ROLE SECURITYADMIN;
CREATE ROLE LUMOS_INTEGRATION_ROLE;

-- c) Allow the role to read SNOWFLAKE.ACCOUNT_USAGE views
USE ROLE ACCOUNTADMIN;
GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER TO ROLE LUMOS_INTEGRATION_ROLE;
GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE LUMOS_INTEGRATION_ROLE;
GRANT USAGE ON WAREHOUSE <warehouse-name> TO ROLE LUMOS_INTEGRATION_ROLE;

-- d) Associate the permissions with the user and role
GRANT ROLE LUMOS_INTEGRATION_ROLE TO USER LUMOS_INTEGRATION_USER;
ALTER USER LUMOS_INTEGRATION_USER SET DEFAULT_ROLE='LUMOS_INTEGRATION_ROLE';
GRANT MODIFY PROGRAMMATIC AUTHENTICATION METHODS ON USER LUMOS_INTEGRATION_USER TO ROLE LUMOS_INTEGRATION_ROLE;
```

4. Optional, for accurate account status. Lumos reads each user's email, first name, and last name from `SNOWFLAKE.ACCOUNT_USAGE.USERS`, which `SECURITY_VIEWER` already allows, so those fields sync without any extra grant. Snowflake only returns the `disabled` column when the active role holds OWNERSHIP on the user or MANAGE GRANTS on the account, so under the read-only role every account syncs as Active. To fix that, grant MANAGE GRANTS to the integration role. This is a privilege elevation and is not required for the connection to run:

```sql theme={null}
USE ROLE SECURITYADMIN;
GRANT MANAGE GRANTS ON ACCOUNT TO ROLE LUMOS_INTEGRATION_ROLE;
```

**Phase 2: Configure network and authentication policies (if applicable)**

1. If you restrict ingress by IP, go to **Governance & Security → Network Policies** and create a policy. Add a new rule in **Ingress** mode that includes the Lumos outbound IPs:
   * `44.228.74.159`
   * `54.244.99.235`
     Warning: an overly restrictive network policy can lock you out of Snowflake. Include both the Lumos IPs and the IP ranges you use for admin access, validate the allowlist, and confirm you have a recovery method before enabling it.
2. Assign the policy to the integration user:

```sql theme={null}
USE ROLE SECURITYADMIN;
ALTER USER LUMOS_INTEGRATION_USER SET NETWORK_POLICY = "YOUR_POLICY_NAME";
```

3. If your account enforces an authentication policy, allow token auth:

```sql theme={null}
ALTER AUTHENTICATION POLICY my_auth_policy
  SET AUTHENTICATION_METHODS = ('OAUTH', 'PASSWORD', 'PROGRAMMATIC_ACCESS_TOKEN');
```

4. Tokens expire in 15 days by default. To change the default and maximum expiration:

```sql theme={null}
ALTER AUTHENTICATION POLICY my_auth_policy
  SET PAT_POLICY = (
    DEFAULT_EXPIRY_IN_DAYS = 90
    MAX_EXPIRY_IN_DAYS = 365
  );
```

`DEFAULT_EXPIRY_IN_DAYS` must be between 1 and `MAX_EXPIRY_IN_DAYS`. Once a token expires, generate a new one and reconnect.

**Phase 3: Generate the token and connect**

1. Complete all of the previous steps first. The integration will not work if you generate the token early.
2. Go to **Governance & Security → Users**, open the `LUMOS_INTEGRATION_USER` account, and scroll to **Programmatic access tokens**.
3. Click **Generate New Token**, name it, select the `LUMOS_INTEGRATION_ROLE`, and click **Generate**. Copy the token.
4. In Lumos, go to **Settings → Integrations** and open the Snowflake Read-Only (PAT) card.
5. Enter your **Account Identifier** and paste the token, then click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection stopped working after a couple of weeks.** Programmatic access tokens expire in 15 days by default. Generate a new token and reconnect, and consider raising the expiry with a `PAT_POLICY`.

**Token generation or use is blocked.** If your account enforces an authentication policy, it must include `PROGRAMMATIC_ACCESS_TOKEN` in `AUTHENTICATION_METHODS`.

**Lumos cannot reach your account.** If you restrict ingress by IP, confirm the network policy includes both Lumos outbound IPs (`44.228.74.159` and `54.244.99.235`). A misconfigured network policy can also lock out admin access, so verify the full allowlist.

**Every user syncs as Active.** Lumos lists accounts with a `SHOW USERS` query and marks an account Suspended only when Snowflake reports that account as disabled. Anything else becomes Active. The read-only role above holds the two account-usage database roles and warehouse usage only, and a role at that level does not receive the disabled flag for the users it lists, so the value arrives empty. Every account then lands in Lumos as Active, including users who are disabled in Snowflake. Access Reviews show disabled users as Active, so confirm a user's real status in Snowflake before acting on a review. If you need accurate status in Lumos, run the optional `GRANT MANAGE GRANTS ON ACCOUNT` step from Phase 1 of the instructions. It elevates the role's privileges but keeps the connection read-only.