> For the complete documentation index, see [llms.txt](https://docs.lightbeam.ai/lxqobxw6ak7CTnsQjikH/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lightbeam.ai/lxqobxw6ak7CTnsQjikH/core-features/spectra-ai/data-sources/databases-and-datalakes/snowflake.md). # Snowflake Connecting Snowflake to LightBeam *** ## Overview LightBeam Spectra users can connect various data sources to the LightBeam application and these data sources will be continuously monitored for PII, PHI data. Examples: Snowflake, SMB, MySQL, PostgreSQL, etc. *** ### Onboarding Snowflake Data Source 1. Login to your LightBeam Instance.
2. Click on **DATASOURCES** on the Top Navigation Bar.
3. Click on "**Add a data source**".

4. Search for "**Snowflake**".

\ 3\. Fill in the details as shown below and click **Next**: #### Basic Information 1. **Instance Name:** This is the unique name given to the data source. 2. **Description:** This is an optional field needed to describe the use of this data source. 3. **Primary owner:** Email address of the person responsible for this data source which will get alerts by default. 4. **Source of Truth:** LightBeam Spectra would have monitored data sources that contain data acting as a single point of truth and that can be used for looking up entities/attributes that help to identify if the other attributes/entities found in any other data source are accurate or not. A Source of Truth data set would create entities based on the attributes found in the data.

Figure 3. Snowflake Data Source - Basic Information & Connection Details

Figure 4. Snowflake Data Source - Basic Information & Connection Details

#### **Connection Details** LightBeam supports two authentication methods for Snowflake. Select the **Authentication Type** in the connection form: * **Password** (default): Standard username and password authentication. * **Key Pair**: RSA key-based authentication — more secure, no password required. See [Setting up Key Pair Authentication](#setting-up-key-pair-authentication) in the Appendix for how to generate a key pair and assign it to a Snowflake user. **Password authentication** — provide the following fields: * **Username**: The Snowflake account username (e.g., `admin`). * **Password**: The password associated with the username. * **Account Name**: Enter the account name in the format `..`. For example: `rs31112.europe-west4.gcp`. * For AWS `us-west-2`, use only the ``. * Alternatively, `-` can also be used. * **Role** *(optional)*: The role assigned to the user for accessing the Snowflake instance (e.g., `lightbeam_users`). * **Warehouse**: Specify the warehouse (e.g., `compute_wh`). **Key Pair authentication** — provide the following fields: * **Username**: The Snowflake account username whose RSA public key has been registered. * **Account Name**: Same format as above. * **Warehouse**: Specify the warehouse. * **Role** *(optional)*: The role assigned to the user. * **Private Key**: Upload the RSA private key PEM file (`private_key.pem`). * **Passphrase** *(optional)*: The passphrase used to encrypt the private key. Leave blank if the key was generated without a passphrase. {% hint style="info" %} The account name should be in this format *account\_locator.cloud\_region\_id.cloud.* For example: *rs31112.europe-west4.gcp.* These parameters can be obtained from **`Admin -> Accounts`** page. For **AWS us-west-2** region, use only account locator without any\ region-id or cloud.\ Alternatively **\-\** can also be used. {% endhint %}

Figure 6. Obtaining Account locator, cloud region, cloud

5\. Click **Test Connection** to validate the credentials. If successful, a **Test Connection Success** message will appear.

Click **Next** to continue.
6. Set the frequency for scanning resources: * Options include daily, weekly, or monthly scans.

Figure 7. Snowflake Configuration - Select frequency of scanning

\ 7\. In this step, you can choose either of two scan setting options – i) Show all current and future databases ii) Select specific database(s) that you have permission for\ \ To show all databases, select the first scan setting. This will show a list of all the Snowflake databases.

Figure 7.1 Snowflake Configuration - Select scope of scanning

Figure 7.2 Snowflake Configuration - Add to inclusion list

\ To select specific databases you have permission for, select the second scan setting.

Figure 7.3 Snowflake Configuration - Select database

8\. After completing **step 7**, check the tickboxes next to the databases you would like to add. Click on **Add to Inclusion / Scan List.**

Figure 7.4 Snowflake Configuration - Select database

\ Now we are ready to connect to the test database and proceed. Click on **Save**

Figure 7.5 Snowflake Configuration - Select database

You can browse the updated datasource. *** ### Tables & Columns This section provides a comprehensive guide to viewing and understanding the data discovered from your Snowflake tables and columns. **Overview and Scan Method** The Tables & Columns pages are the primary way to view the foundational data within your Snowflake instance. * **Tables Page:** Lists all discovered tables from the connected databases. * **Columns Page:** Provides a master list of all columns across every discovered table. A key feature of this section is its scan method: all tables and columns within the databases you selected during setup are scanned automatically and continuously by default. No manual action is needed to initiate scanning. **How-To Guide: Viewing Table and Column Data**
1. Navigate to the Tables Page: * Go to the DATASOURCES section from the top navigation bar. * Select your configured Snowflake data source. * Click on the Tables & Columns tab. By default, it will display the "Tables" view.
2. Browse and Filter Tables: * On the Tables page, you will see a list of all discovered tables. * Use the filter options at the top to narrow the list by Database, Schema, or Table Name. 3. Inspect a Specific Table's Details: * Click on any table name in the list to open its detailed view. * In this view, you will find: * Complete Schema: A list of all columns within that table. * Sample Data: A preview of the data for each column. * Scan Summary: A count of the total columns and the number of columns that require review based on data classification. * Classification Details: Clicking on the scan summary reveals the specific sensitive data classification (e.g., PII, PHI) applied to each column. 4. View All Columns: * From the Tables & Columns tab, use the dropdown menu to switch from "Tables" to the "Columns" view. * This page lists every single column from all tables, which can be filtered and searched to find specific data points across your data source. *** ### Views This section provides a comprehensive guide to the discovery, scanning, and analysis of SQL Views in Snowflake. **Overview and Scan Method** In addition to standard tables, LightBeam supports the scanning of SQL Views, allowing users to gain visibility into virtualized data sources that often aggregate or represent sensitive information. What Are SQL Views? SQL Views in Snowflake are virtual tables defined by SQL queries. They do not store data themselves but provide a way to encapsulate business logic, access data across multiple tables, and present it in a customized format. These views often contain sensitive data including Personally Identifiable Information (PII) or Protected Health Information (PHI), and hence require stringent security monitoring and data classification. Unlike tables, views are not scanned by default. Scanning a view is a manual, on-demand action that gives you control over when these potentially complex queries are run. **How-To Guide: Scanning and Analyzing Views** 1. Navigate to the Views Page: * Go to the DATASOURCES section and select your configured Snowflake data source. * Click on the Tables & Columns tab. * Use the dropdown menu to switch from the "Tables" view to the "Views" view. This will list all discoverable views. 2. Manually Trigger a Scan: * Select the checkbox next to one or more views you wish to scan. * Click the Scan button to initiate the process. 3. Review Scan Results: * After the scan completes, click on a view name to inspect its details. * The results will show: * Highlighted Classifications: Any columns containing sensitive data will be highlighted. You can review or edit these classifications as needed. * Sample Data: A preview of the data for each column in the view. * Rescan Capability: Views can be rescanned at any time to reflect changes in the underlying data or permissions. *** #### Creating Entities from Views **Using Table Cluster to Generate Entities from Views** After scanning, users can generate entities from a View by creating a table cluster. 1. Navigate to the Table Structure section of your data source. 2. Click Create Cluster and select the Views tab. 3. Choose a pre-scanned view. 4. Define a primary key or unique identifier to track entities across data sources. 5. Save the cluster. LightBeam will identify and count instances of each attribute, assisting in building a unified data identity. *** ### **Viewing Details of Skipped Databases** During the scanning process, some databases may be skipped if required permissions or configurations are missing. LightBeam provides a clear way to identify and address these skipped databases. In the **Datasources** section, skipped databases are highlighted in the **Overview** panel: * A **yellow notification banner** indicates the number of skipped databases (e.g., "12 Skipped") and states the reason, for example: "**necessary permissions haven't been configured**."

Figure 8. Snowflake Configuration - Skipped databases

#### Resolving Scan Issues for Skipped Databases 1. Click **View Details** on the yellow banner. 2. A modal window will appear, listing the names of the skipped databases (e.g., `sandbox`, `automation_stuff`, `test2`). 3. The modal provides a description explaining that these databases were skipped due to missing permissions or errors. 4. Once permissions are configured, LightBeam will automatically include these databases in the next scan cycle.

Figure 8.1 Snowflake Configuration - Skipped databases

*** ## APPENDIX ### Troubleshooting If you don't see any data being scanned without error, it might be a permission issue. Consider running a **SELECT \*** query on a table and see if you are able to see the data. If you see a message of permission denied, consider granting permission to the user. **Whitelisting IP address** By default, Snowflake allows users to connect to the service from any computer or device. If there is an active policy that allows access only from certain networks, add the public IP of all the nodes where the LightBeam cluster is running.\ \ 1\. Goto *admin -> security* from snowflake UI. Create a new network rule containing the Public IP address of all LightBeam nodes.\

2\. Attach this network rule to the active network policy as **Allowed**.

Figure 10. Attaching network rule to Active network policy.

#### Connecting through Private Links A private link is a feature for securing connectivity between your clients and the Snowflake without traversing the public Internet. Following these links if you want to setup that:- * **AWS:-** [**https://docs.snowflake.com/en/user-guide/admin-security-privatelink**](https://docs.snowflake.com/en/user-guide/admin-security-privatelink) * **Azure:-** [**https://docs.snowflake.com/en/user-guide/privatelink-azure**](https://docs.snowflake.com/en/user-guide/privatelink-azure) * **GCP:-** [**https://docs.snowflake.com/en/user-guide/private-service-connect-google**](https://docs.snowflake.com/en/user-guide/private-service-connect-google) #### Setting up a new user in Snowflake We need to create a new user containing all permissions required by LightBeam to scan the datasource. **User:** A user in Snowflake is an account in the system, generally associated with an individual person. Users can log into Snowflake, issue SQL commands, manage data, and perform other operations. A user is associated with specific properties, such as login name, password, and default role. **Role:** A role in Snowflake, on the other hand, is a named set of access privileges that can be granted to users or other roles. These privileges determine what actions a user can perform and on which database objects. A user can be assigned multiple roles and can switch between them during a session to access different sets of privileges as needed. In essence, a user is who logs into the system, and a role determines what that user can do once they are logged in. This distinction allows Snowflake to provide flexible and granular control over access to its resources. The following SQL snippet can be used for creating a role, a user, and assigning permissions to a single database. ```sql -- Create a new role containing all permissions. Replace ROLE placeholder with a role name of your choice CREATE ROLE -- Grant access to a warehouse. Replace WAREHOUSE placeholder with an existing warehouse in your instance. GRANT usage on warehouse to role ; GRANT operate on warehouse to role ; -- Grant access to connect to the specific database and schema. Replace DATABASE placeholder with the name of database you want to scan. GRANT USAGE on DATABASE to ROLE ; -- Replace SCHEMA placeholder with the name of schema you want to scan. If you have multiple schemas in the database repeat the below SQL statement for every schema. GRANT USAGE on SCHEMA to ROLE ; -- Grant access to scan existing and future tables in a database. -- Repeat this for all databases that you want to scan. GRANT SELECT ON ALL TABLES IN DATABASE to ROLE ; GRANT SELECT ON FUTURE TABLES IN DATABASE to ROLE ; -- Create a user with a strong password and default warehouse. Replace USERNAME placeholder with the username of your choice. -- Replace the value of DEFAULT_WAREHOUSE with an existing warehouse in your instance. CREATE USER PASSWORD='' DEFAULT_WAREHOUSE=; -- Assign the role created above to the new user. GRANT ROLE TO USER ; ``` If you want to scan more than one database it is recommended to create a user and assign read permissions to all databases. **Step 1: First, create a user and assign permissions to use a warehouse.** ```sql -- Create a new role. Replace ROLE placeholder with a role name of your choice CREATE ROLE -- Grant access to a warehouse. Replace WAREHOUSE placeholder with an existing warehouse in your instance. GRANT usage on warehouse to role ; GRANT operate on warehouse to role ; -- Create a user with a strong password and default warehouse. Replace USERNAME placeholder with the username of your choice. -- Replace the value of DEFAULT_WAREHOUSE with an existing warehouse in your instance. CREATE USER PASSWORD='' DEFAULT_WAREHOUSE=; -- Assign the role created above to the new user. GRANT ROLE TO USER ; ``` **Step 2: Now assign permissions to the role to access all databases in the account.** In the SQL snippet below replace the `ROLE` placeholder with the name of the role created in **step 1**. Run the SQL snippet, it will print a bunch of SQL statements for granting permissions. Copy the output and run those statements again. ```sql SELECT 'grant usage on database ' || DATABASE_NAME || ' to role ;' FROM information_schema.databases WHERE database_name NOT in('SNOWFLAKE', 'SNOWFLAKE_SAMPLE_DATA') UNION ALL SELECT 'grant usage on all schemas in database ' || DATABASE_NAME || ' to role ;' FROM information_schema.databases WHERE database_name NOT in('SNOWFLAKE', 'SNOWFLAKE_SAMPLE_DATA') UNION ALL SELECT 'grant select on all tables in database ' || DATABASE_NAME || ' to role ;' FROM information_schema.databases WHERE database_name NOT in('SNOWFLAKE', 'SNOWFLAKE_SAMPLE_DATA') UNION ALL SELECT 'grant select on future tables in database ' || DATABASE_NAME || ' to role ;' FROM information_schema.databases WHERE database_name NOT in('SNOWFLAKE', 'SNOWFLAKE_SAMPLE_DATA') ``` Note: If you want to exclude some databases modify the SQL snippet in **step 2** to include the name of the database alongside `SNOWFLAKE_SAMPLE_DATA`. Provide the created`Username`, `Password`, `Role Name`, `Warehouse Name` and `Account Name` to register the Snowflake datasource. ### Setting up Key Pair Authentication Key pair authentication uses RSA public/private key cryptography instead of a username and password. It is more secure than password-based auth and is recommended for service accounts used by automated scanners. **Step 1: Generate an RSA Key Pair** Run the following commands on your local machine to generate a 2048-bit RSA key pair: ```bash # Generate a private key (no passphrase) openssl genrsa -out private_key.pem 2048 # Extract the public key openssl rsa -in private_key.pem -pubout -out public_key.pem ``` To generate a key **with a passphrase** (optional, adds an extra layer of security): ```bash # Generate an encrypted private key openssl genrsa -aes256 -passout pass: -out private_key.pem 2048 # Extract the public key openssl rsa -in private_key.pem -passin pass: -pubout -out public_key.pem ``` Keep `private_key.pem` secret — you will upload it to LightBeam. `public_key.pem` is registered with Snowflake. **Step 2: Register the Public Key with Snowflake** Run the following SQL in Snowflake as an **ACCOUNTADMIN** or **SECURITYADMIN**. Replace `` with the Snowflake user that LightBeam will authenticate as. First, extract the raw base64 content from `public_key.pem` (the content between the `-----BEGIN PUBLIC KEY-----` and `-----END PUBLIC KEY-----` lines, with newlines removed), then run: ```sql ALTER USER SET RSA_PUBLIC_KEY = ''; ``` To verify the key was set: ```sql DESCRIBE USER ; ``` Look for the `RSA_PUBLIC_KEY_FP` field — if it shows a fingerprint, the key is registered. {% hint style="info" %} If you need to rotate the key in the future, use `RSA_PUBLIC_KEY_2` to register the new key before removing the old one, ensuring zero-downtime rotation. {% endhint %} **Step 3: Create a User for Key Pair Auth (if not already done)** If you are creating a new service account specifically for key pair authentication, use the following SQL (no password is set): ```sql -- Create role CREATE ROLE IF NOT EXISTS ; -- Grant warehouse and database permissions (same as password-based setup) GRANT USAGE ON WAREHOUSE TO ROLE ; GRANT USAGE ON DATABASE TO ROLE ; GRANT USAGE ON ALL SCHEMAS IN DATABASE TO ROLE ; GRANT SELECT ON ALL TABLES IN DATABASE TO ROLE ; GRANT SELECT ON FUTURE TABLES IN DATABASE TO ROLE ; -- Create user without password CREATE USER IF NOT EXISTS DEFAULT_ROLE = DEFAULT_WAREHOUSE = COMMENT = 'LightBeam scanner service account (key-pair auth)'; -- Assign role and public key GRANT ROLE TO USER ; ALTER USER SET RSA_PUBLIC_KEY = ''; ``` **Step 4: Configure Key Pair Auth in LightBeam** When adding or editing the Snowflake data source in LightBeam: 1. In the **Connection** step, set **Authentication Type** to **Key Pair**. 2. Enter **Username**, **Account Name**, and **Warehouse**. 3. Optionally enter **Role** if you want to restrict to a specific role. 4. Upload the `private_key.pem` file in the **Private Key** field. 5. If the private key was generated with a passphrase, enter it in the **Passphrase** field. Leave it blank for unencrypted keys. 6. Click **Test Connection** to validate. ### Using Programmatic Access Token for Authentication We can use programmatic Access Token with username for snowflake in case we don't want to use username/password pair for authentication. Follow these steps to setup authentication with programmatic access token. Prerequisite *-* To use programmatic Access Token for authentication Network policy is required. 1. Click on User profile on bottom-left and go to settings

2. Goto Authentication tab 3. On programmatic access Token section, click on Generate new token.

4. Provide token name, expire duration (maximum 1 year, we need to update token after expire duration) and select the role we want to allow authentication.

5. Click on Generate and access token will be generated, copy and use the token as password in lightbeam UI. ### Setting up Resource Monitor A *resource monitor* in snowflake can help control costs and avoid unexpected credit usage caused by running warehouses. Resource monitor can suspend a warehouse if credit limit for warehouse exceeds than specified limit. Note: resource monitor can be created from user with ACCOUNTADMIN role only. It is a Snowflake side configuration which Lightbeam doesn't manage or access. Resource monitor isn't absolutely necessary to onboard Snowflake datasource but is highly recommended. You can create Resource Monitor by executing these queries from snowflake ```sql CREATE OR REPLACE RESOURCE MONITOR WITH CREDIT_QUOTA = FREQUENCY = START_TIMESTAMP = IMMEDIATELY NOTIFY_USERS = () TRIGGERS ON 50 PERCENT DO NOTIFY ON 60 PERCENT DO SUSPEND ON 100 PERCENT DO SUSPEND_IMMEDIATE; ``` To assign the created resource monitor to a warehouse use this query ```sql ALTER WAREHOUSE SET RESOURCE_MONITOR = ; ``` #### Creating Resource Monitor from UI Follow these steps to create resource monitor from snowflake UI 1. Click on Admin in snowflake UI

2. Click on resource monitors tab

3. Create a resource limiter from Resource monitor button in top right corner. If you want to use exisitng resource monitor skip to step

4. After clicking add resource monitor button, you should see a pop up this, Fill name, credit quota, monitor type , select warehouse. By default schedule is monthly, you can customize it according to your needs, follow step 5 for schedule

Figure 17: Fill resource monitor information

5. Click on customize and select frequency type and start date from UI . You can provide custom range of time for resource monitor as well.

Figure 15: cutomize frequcny cyle of resource monitor

6. Click on apply and click on create resource monitor button to save the entered resource monitor information. Resource monitor is created successfully, you can see information of resource monitor like this when you click on a resource limiter from list.

### Validate permissions to the database Next, the user needs to validate these permissions to the database. This ensures authorized access to the database by the credentials provided by the user. After validating the permissions to the database, the user can configure LightBeam Spectra on the system. #### Prerequisite Install `snowsql` on the machine. **Steps** 1. First, clone the repository 2. Go into `sql_user_check_snowflake/` directory #### Run the script {% code overflow="wrap" fullWidth="false" %} ``` WAREHOUSE_NAME= ACCOUNT_NAME= ROLE_NAME= SF_USERNAME= SF_DATABASE= bash run.sh ``` {% endcode %} #### User Credentials \* `WAREHOUSE_NAME:` Name of the warehouse in your Snowflake instance. \* `ACCOUNT_NAME:` Name of your Snowflake account. \* `ROLE_NAME:` Name of the role assigned to the user in Snowflake. \* `SF_USERNAME:` Username for the Snowflake instance. \* `SF_DATABASE:` Name of the database in Snowflake to which you wish to establish a connection and validate the permissions. To validate whether the commands were successful, check the output of the file generated from the commands. *** ## About LightBeam LightBeam automates Privacy, Security, and AI Governance, so businesses can accelerate their growth in new markets. Leveraging generative AI, LightBeam has rapidly gained customers' trust by pioneering a unique *privacy-centric* and *automation-first* approach to security. Unlike siloed solutions, LightBeam ties together sensitive data cataloging, control, and compliance across structured and unstructured data applications providing 360-visibility, redaction, self-service DSRs, and automated ROPA reporting ensuring ultimate protection against ransomware and accidental exposures while meeting data privacy obligations efficiently.\ \ LightBeam is on a mission to create a secure privacy-first world helping customers automate compliance against a patchwork of existing and emerging regulations. For any questions or suggestions, please get in touch with us at: . --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.lightbeam.ai/lxqobxw6ak7CTnsQjikH/core-features/spectra-ai/data-sources/databases-and-datalakes/snowflake.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.