Skip to main content
Connect your Snowflake account to let Tony (Database Engineer) read warehouse credit burn, rank slow and failing queries, and measure table storage overhead. CloudThinker reaches Snowflake over the SQL REST API with a programmatic access token, and a new connection reads only until you turn the write tool on.

​
Prerequisites

  • ACCOUNTADMIN (or equivalent) to create the role, the service user, and the token.
  • A network policy you can attach to that user. Snowflake refuses token authentication until one exists.
  • A warehouse the role can use. Metadata queries need no compute, so the connection test can pass while real analysis still fails without one.

​
Setup

1

Create a read-only role

Run as ACCOUNTADMIN. USAGE_VIEWER covers metering and storage, OBJECT_VIEWER covers object inventory, and GOVERNANCE_VIEWER is what makes QUERY_HISTORY readable:
2

Create a service user

A SERVICE user has no password, no MFA, and no SSO, so it authenticates only with the token:
3

Attach a network policy

Narrow ALLOWED_IP_LIST to your egress ranges for anything beyond a test account:
Skipping this step is the most common setup failure, and the resulting error (390403) does not name the policy.
4

Mint a programmatic access token

Snowflake shows the token once, on creation. DAYS_TO_EXPIRY is a hard expiry: on that day the connection starts failing with 390318 and you mint a new token.
5

Add the connection in CloudThinker

Go to Connections → Snowflake and enter:
  • Account identifier: MYORG-MYACCOUNT, found under Snowsight → Account details. Not the full URL.
  • Programmatic access token: the token from the previous step. Not an account password.
  • Role: optional; leave blank to use the user’s default role.
  • Warehouse: optional; leave blank to use the user’s default warehouse.
Click Connect. The status shows Connected once CloudThinker resolves the account, region, role, and warehouse.

​
Connection details

The REST host lowercases the account identifier and renders the separator as a hyphen, so an identifier written with an underscore still resolves.

​
Required permissions

​
Read-only (default)

GOVERNANCE_VIEWER is easy to miss. Without it, spend and storage answers keep working while every slow-query and error answer fails on QUERY_HISTORY.

​
Write access (only if you enable it)

Grant OPERATE on the warehouses the agent may act on, never on a shared production warehouse. A dedicated agent warehouse with a resource monitor gives its compute a ceiling no prompt can raise.

​
Agent capabilities

Once connected, Tony can:

​
Verify the connection

​
Example prompts

Snowflake exposes credits, not currency, and the price per credit is not readable through this connection. Agents report credits as credits.

​
Write access

The connection ships read-only, and write is a per-connection decision because access follows the credential. One workspace can hold a read-only token and a write-capable token at the same time. Turn it on under Connections → Snowflake → Tool permissions. Two things to weigh first:
  • Write means exactly two actions, not arbitrary SQL. Raising a resource monitor, lowering DATA_RETENTION_TIME_IN_DAYS, or resizing a warehouse is still reported to you as a statement to run in Snowsight.
  • The grant is the stronger control. The tool permission decides whether CloudThinker asks for a write; the token’s ROLE_RESTRICTION and the role’s grants decide whether Snowflake allows one.
A suspend cannot be conditional in Snowflake. The busy check and the ALTER are two statements, so a query can start between them and lose its compute. Agents report the state change and this limit, never that the suspend was safe.
Every write still needs your approval on the tool call.

​
Troubleshooting

The user has no network policy. Snowflake refuses token authentication until one is attached: ALTER USER SVC_CLOUDTHINKER SET NETWORK_POLICY = CT_POLICY;
The token expired or was revoked. DAYS_TO_EXPIRY is a hard expiry. Mint a new token and update the connection.
A missing database role, not a typo in the view name. Ask the agent to run discovery: it lists every ACCOUNT_USAGE view the role can read and prints the exact GRANT line for the ones it cannot.
A resource monitor is over quota, or the warehouse is suspended and cannot resume. This is account capacity, not permission, so no GRANT fixes it. An account admin raises or resets the resource monitor.The connection stays Connected because the credential is valid and the test probe needs no compute.
The service user has no DEFAULT_WAREHOUSE and none was configured. Set Warehouse on the connection, or give the user a default.
The role sits outside the token’s ROLE_RESTRICTION. Use a role the token may assume, or clear Role to take the user’s default.
Not an error. ACCOUNT_USAGE lags by up to a few hours and keeps one year of history, so a narrow window over a quiet account returns no rows.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Dedicated service user — a TYPE = SERVICE user has no password, no MFA, and no SSO, so the token is the only way in and the audit trail stays readable.
  • Restrict and expire the token — ROLE_RESTRICTION bounds everything the connection can reach, and DAYS_TO_EXPIRY forces a rotation you would otherwise forget.

Tony Agent

Database-focused optimization agent

ClickHouse Connection

Similar setup for ClickHouse clusters