> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake connection

> Learn how to configure a Snowflake connection for Infisical.

A Snowflake connection authenticates Infisical to your Snowflake account as a Snowflake user, with a [programmatic access token](https://docs.snowflake.com/en/user-guide/programmatic-access-tokens) that you generate for that user. Infisical can then sync secrets into a Snowflake schema and rotate the key pairs of Snowflake users.

> [!NOTE]
>
> This guide only authenticates Infisical with Snowflake. Once the app connection is ready, you can [use it to set up integrations](#step-3-configure-integrations).

## Prerequisites

* A [Snowflake account](https://app.snowflake.com/) where you can create users, roles, and network policies, such as with the `ACCOUNTADMIN` role

## Step 1: Create a Snowflake user and programmatic access token

Infisical needs a Snowflake user with a programmatic access token, a network policy, and a role with privileges for the integration you'll set up.

**Step 1**

In [Snowsight](https://app.snowflake.com/), open the sidebar and select **Users & roles** under **Governance & Security**.

![Users and roles](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-1.png)

**Step 2**

Select **Create user**, then enter a **Username** for the user Infisical will authenticate as.

![Create user](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-2.png)

![Configure user](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-3.png)

**Step 3**

If a user authenticates with a programmatic access token, Snowflake requires the user to have a network policy. Attach one to the user:

To run SQL in Snowflake, select **Projects**, then **Workspaces**, to open the query editor.

![Workspaces](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-4-workspace.png)

The following statements create a network policy and attach it to a user named `INFISICAL`. Replace `INFISICAL` with the username you entered.

```SQL theme={"dark"}
CREATE NETWORK POLICY INFISICAL_SYNC_POLICY
    ALLOWED_IP_LIST = ('0.0.0.0/0')
    COMMENT = 'Allow access from any IP';

ALTER USER INFISICAL SET NETWORK_POLICY = 'INFISICAL_SYNC_POLICY';
```

> [!WARNING]
>
> `0.0.0.0/0` lets the user authenticate from any IP address. In production, replace it with the IP addresses Infisical connects from.

**Step 4**

Create a role for the user, grant the role the privileges for the integration you'll set up, and make it the user's default role, using the same query editor.

> [!NOTE]
>
> Infisical doesn't choose a role when it signs in, so Snowflake runs every Infisical operation under the user's default role. If you skip the `ALTER USER` statement, the default role stays `PUBLIC`, and syncs and rotations fail even though the grants exist.

A connection signs in with one role. If you want one connection for both a [sync](https://infisical.com/docs/integrations/secret-syncs/snowflake.md) and a [rotation](https://infisical.com/docs/documentation/platform/secret-rotation/snowflake-user-key-pair.md), grant both sets of privileges to the same role and make that role the user's default.

> [tab] Secret syncs
>
> The role needs access to the database and schema the sync writes to, and ownership of every secret in that schema that the sync manages. The following statements grant those privileges on the `PUBLIC` schema of a database named `SECRET_SYNC_TEST`:
>
> ```SQL theme={"dark"}
> CREATE ROLE IF NOT EXISTS INFISICAL_ROLE;
> GRANT ROLE INFISICAL_ROLE TO USER INFISICAL;
>
> GRANT ALL PRIVILEGES ON DATABASE SECRET_SYNC_TEST TO ROLE INFISICAL_ROLE;
> GRANT ALL PRIVILEGES ON SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE;
> GRANT OWNERSHIP ON ALL SECRETS IN SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE REVOKE CURRENT GRANTS;
> GRANT OWNERSHIP ON FUTURE SECRETS IN SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE REVOKE CURRENT GRANTS;
>
> ALTER USER INFISICAL SET DEFAULT_ROLE = INFISICAL_ROLE;
> ```
>
> > [!NOTE]
> >
> > Snowflake only lets the role that owns a secret replace or drop it. If a secret already exists in the schema, it stays owned by the role that created it, so the sync fails on that secret until you transfer ownership with the `GRANT OWNERSHIP ON ALL SECRETS` statement. The `GRANT OWNERSHIP ON FUTURE SECRETS` statement covers secrets created later.

> [tab] Secret rotations
>
> For [Snowflake user key pair rotation](https://infisical.com/docs/documentation/platform/secret-rotation/snowflake-user-key-pair.md), the role needs to be able to change the key pair of the user you're rotating. The following statements grant that to a role, assign the role to the `INFISICAL` user, and make it the user's default role:
>
> ```SQL theme={"dark"}
> CREATE ROLE IF NOT EXISTS INFISICAL_ROTATION_ROLE;
>
> GRANT OWNERSHIP ON USER MY_TARGET_USER TO ROLE INFISICAL_ROTATION_ROLE;
>
> -- Only needed if Infisical should create the target user
> GRANT CREATE USER ON ACCOUNT TO ROLE INFISICAL_ROTATION_ROLE;
>
> GRANT ROLE INFISICAL_ROTATION_ROLE TO USER INFISICAL;
> ALTER USER INFISICAL SET DEFAULT_ROLE = INFISICAL_ROTATION_ROLE;
> ```
>
> If the target user already exists, `OWNERSHIP` on that user is enough. If you want Infisical to create the target user, the role also needs `CREATE USER` on the account. For more about roles and privileges, see Snowflake's [access control documentation](https://docs.snowflake.com/en/user-guide/security-access-control-overview).

**Step 5**

Go back to **Governance & Security** > **Users & roles** and select the user. Open the **Programmatic access tokens** tab and select **Generate new token**. Give the token a name, such as `infisical`, restrict it to the role you made the user's default, and set its expiration to match your security policy.

![Programmatic access tokens tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-5.png)

![Generate new token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-6.png)

**Step 6**

Copy the token. Snowflake shows the token only once, so save it for the Infisical form.

![Copy the token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-7.png)

**Step 7**

Copy your account identifier, which has the form `orgName-accountName`. You can read both parts from your Snowsight URL: `https://app.snowflake.com/orgName/accountName/`.

You can also select your username in the bottom-left corner, open **Account details**, and copy the **Account** value from the **Config File** tab.

![Account details menu](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/account-info-left-corner.png)

![Account details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/account-details.png)

![Account identifier](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/account-info.png)

## Step 2: Create the app connection

Next, create the app connection in Infisical.

**Organization-level**

**Step 1**

In the sidebar, select **Organization Settings**, then open the **App Connections** tab.

![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)

**Step 2**

Select **+ Add Connection** and choose **Snowflake Connection**.

![Select Snowflake Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/snowflake-app-connection-option.png)

**Step 3**

Fill out the form's fields:

* **Name**: A descriptive name for the connection
* **Description** (optional): A note for future reference
* **Account**: Your Snowflake [account identifier](#step-1-create-a-snowflake-user-and-programmatic-access-token), such as `orgName-accountName`
* **Username**: The Snowflake user you created for Infisical
* **Programmatic Access Token**: The token you generated for that user

Then, select **Connect to Snowflake**.

![Snowflake Connection Form](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/snowflake-app-connection-form.png)

**Project-level**

**Step 1**

In your Secrets Management project, select **Integrations** from the sidebar, then open the **App Connections** tab.

**Step 2**

Select **Add Connection** and choose **Snowflake Connection**.

**Step 3**

Fill out the form's fields:

* **Name**: A descriptive name for the connection
* **Description** (optional): A note for future reference
* **Account**: Your Snowflake [account identifier](#step-1-create-a-snowflake-user-and-programmatic-access-token), such as `orgName-accountName`
* **Username**: The Snowflake user you created for Infisical
* **Programmatic Access Token**: The token you generated for that user

Then, select **Connect to Snowflake**.

When you submit the form, Infisical signs in to Snowflake with the account identifier, username, and token, and shows Snowflake's error if the sign-in fails.

> [!TIP]
>
> Your Snowflake app connection is ready to use.

> [accordion] Create the connection with the API
>
> Send the account identifier, username, and programmatic access token to the create endpoint for Snowflake connections. The token goes in the `password` field.
>
> ```bash theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/app-connections/snowflake \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "name": "my-snowflake-connection",
>     "method": "username-and-token",
>     "credentials": {
>       "account": "<org-name>-<account-name>",
>       "username": "<snowflake-username>",
>       "password": "<programmatic-access-token>"
>     }
>   }'
> ```

## Step 3: Configure integrations

Now that your Snowflake app connection is configured, you can use it to set up the following integrations:

> [card] [Snowflake secret sync](https://infisical.com/docs/integrations/secret-syncs/snowflake.md)
>
> Sync secrets from Infisical to Snowflake secrets in a schema.

> [card] [Snowflake user key pair rotation](https://infisical.com/docs/documentation/platform/secret-rotation/snowflake-user-key-pair.md)
>
> Rotate the RSA key pair of a Snowflake user.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.