> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake sync

> Learn how to configure a Snowflake sync for Infisical.

A Snowflake Secret Sync pushes secrets from Infisical into a Snowflake schema, where your functions and procedures can reference them as [Snowflake secrets](https://docs.snowflake.com/en/sql-reference/sql/create-secret). Each Infisical secret becomes a `GENERIC_STRING` secret in the schema, with the same name unless you customize key names to add a prefix or suffix.

> [!NOTE]
>
> The Snowflake Secret Sync requires a [Snowflake app connection](https://infisical.com/docs/integrations/app-connections/snowflake.md). This guide walks you through creating a project-scoped app connection.

## Prerequisites

* A [project with secrets configured](https://infisical.com/docs/documentation/platform/secrets-mgmt/quick-starts/deliver-first-secret.md)
* A [Snowflake account](https://app.snowflake.com/) where you can create users, roles, and network policies, such as with the `ACCOUNTADMIN` role
* A Snowflake [database](https://docs.snowflake.com/en/sql-reference/sql/create-database) and [schema](https://docs.snowflake.com/en/sql-reference/sql/create-schema) for the synced secrets

## Step 1: Create a Snowflake user and programmatic access token

Infisical needs a Snowflake user with a programmatic access token, a network policy, and a role that can create and own secrets in the schema. When you grant privileges, use the statements in the **Secret syncs** tab.

**Step 1**

In [Snowsight](https://app.snowflake.com/), open the sidebar and select **Users & roles** under **Governance & Security**.

![Users and roles](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-1.png)

**Step 2**

Select **Create user**, then enter a **Username** for the user Infisical will authenticate as.

![Create user](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-2.png)

![Configure user](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-3.png)

**Step 3**

If a user authenticates with a programmatic access token, Snowflake requires the user to have a network policy. Attach one to the user:

To run SQL in Snowflake, select **Projects**, then **Workspaces**, to open the query editor.

![Workspaces](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-4-workspace.png)

The following statements create a network policy and attach it to a user named `INFISICAL`. Replace `INFISICAL` with the username you entered.

```SQL theme={"dark"}
CREATE NETWORK POLICY INFISICAL_SYNC_POLICY
    ALLOWED_IP_LIST = ('0.0.0.0/0')
    COMMENT = 'Allow access from any IP';

ALTER USER INFISICAL SET NETWORK_POLICY = 'INFISICAL_SYNC_POLICY';
```

> [!WARNING]
>
> `0.0.0.0/0` lets the user authenticate from any IP address. In production, replace it with the IP addresses Infisical connects from.

**Step 4**

Create a role for the user, grant the role the privileges for the integration you'll set up, and make it the user's default role, using the same query editor.

> [!NOTE]
>
> Infisical doesn't choose a role when it signs in, so Snowflake runs every Infisical operation under the user's default role. If you skip the `ALTER USER` statement, the default role stays `PUBLIC`, and syncs and rotations fail even though the grants exist.

A connection signs in with one role. If you want one connection for both a [sync](https://infisical.com/docs/integrations/secret-syncs/snowflake.md) and a [rotation](https://infisical.com/docs/documentation/platform/secret-rotation/snowflake-user-key-pair.md), grant both sets of privileges to the same role and make that role the user's default.

> [tab] Secret syncs
>
> The role needs access to the database and schema the sync writes to, and ownership of every secret in that schema that the sync manages. The following statements grant those privileges on the `PUBLIC` schema of a database named `SECRET_SYNC_TEST`:
>
> ```SQL theme={"dark"}
> CREATE ROLE IF NOT EXISTS INFISICAL_ROLE;
> GRANT ROLE INFISICAL_ROLE TO USER INFISICAL;
>
> GRANT ALL PRIVILEGES ON DATABASE SECRET_SYNC_TEST TO ROLE INFISICAL_ROLE;
> GRANT ALL PRIVILEGES ON SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE;
> GRANT OWNERSHIP ON ALL SECRETS IN SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE REVOKE CURRENT GRANTS;
> GRANT OWNERSHIP ON FUTURE SECRETS IN SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE REVOKE CURRENT GRANTS;
>
> ALTER USER INFISICAL SET DEFAULT_ROLE = INFISICAL_ROLE;
> ```
>
> > [!NOTE]
> >
> > Snowflake only lets the role that owns a secret replace or drop it. If a secret already exists in the schema, it stays owned by the role that created it, so the sync fails on that secret until you transfer ownership with the `GRANT OWNERSHIP ON ALL SECRETS` statement. The `GRANT OWNERSHIP ON FUTURE SECRETS` statement covers secrets created later.

> [tab] Secret rotations
>
> For [Snowflake user key pair rotation](https://infisical.com/docs/documentation/platform/secret-rotation/snowflake-user-key-pair.md), the role needs to be able to change the key pair of the user you're rotating. The following statements grant that to a role, assign the role to the `INFISICAL` user, and make it the user's default role:
>
> ```SQL theme={"dark"}
> CREATE ROLE IF NOT EXISTS INFISICAL_ROTATION_ROLE;
>
> GRANT OWNERSHIP ON USER MY_TARGET_USER TO ROLE INFISICAL_ROTATION_ROLE;
>
> -- Only needed if Infisical should create the target user
> GRANT CREATE USER ON ACCOUNT TO ROLE INFISICAL_ROTATION_ROLE;
>
> GRANT ROLE INFISICAL_ROTATION_ROLE TO USER INFISICAL;
> ALTER USER INFISICAL SET DEFAULT_ROLE = INFISICAL_ROTATION_ROLE;
> ```
>
> If the target user already exists, `OWNERSHIP` on that user is enough. If you want Infisical to create the target user, the role also needs `CREATE USER` on the account. For more about roles and privileges, see Snowflake's [access control documentation](https://docs.snowflake.com/en/user-guide/security-access-control-overview).

**Step 5**

Go back to **Governance & Security** > **Users & roles** and select the user. Open the **Programmatic access tokens** tab and select **Generate new token**. Give the token a name, such as `infisical`, restrict it to the role you made the user's default, and set its expiration to match your security policy.

![Programmatic access tokens tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-5.png)

![Generate new token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-6.png)

**Step 6**

Copy the token. Snowflake shows the token only once, so save it for the Infisical form.

![Copy the token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/step-7.png)

**Step 7**

Copy your account identifier, which has the form `orgName-accountName`. You can read both parts from your Snowsight URL: `https://app.snowflake.com/orgName/accountName/`.

You can also select your username in the bottom-left corner, open **Account details**, and copy the **Account** value from the **Config File** tab.

![Account details menu](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/account-info-left-corner.png)

![Account details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/account-details.png)

![Account identifier](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/snowflake/account-info.png)

## Step 2: Set up the sync in Infisical

> [!TIP]
>
> To create the sync using the API, use the [Create Snowflake Sync](https://infisical.com/docs/api-reference/endpoints/secret-syncs/snowflake/create.md) endpoint.

**Step 1**

In your project, go to **Integrations** and open the **Secret Syncs** tab. Select **+ Add Sync**.

![Secret Syncs Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/general/secret-sync-tab.png)

Then, select the **Snowflake** sync.

![Select Snowflake](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/snowflake/select-option.png)

**Step 2**

Under **Source**, choose which secrets to sync from Infisical:

* **Environment**: The project environment to retrieve secrets from
* **Secret Path**: The folder path to retrieve secrets from
* **Include secrets from all subfolders**: When enabled, also syncs secrets from every folder under the secret path (secret names must be unique across those folders)

> [!TIP]
>
> If you need to sync secrets from multiple folder locations, use [secret imports](https://infisical.com/docs/documentation/platform/secret-reference.md#secret-imports).

![Configure Source](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/snowflake/sync-source.png)

Then select **Continue**.

**Step 3**

Under **Destination**, create or select the Snowflake app connection the sync will use, then choose where secrets go in Snowflake.

> [tab] Create a new app connection
>
> Under **Snowflake Connection**, select **Create Connection** in the dropdown, then fill in:
>
> * **Name**: A descriptive name for the connection
> * **Description** (optional): A note for future reference
> * **Account**: Your Snowflake [account identifier](#step-1-create-a-snowflake-user-and-programmatic-access-token), such as `orgName-accountName`
> * **Username**: The Snowflake user you created for Infisical
> * **Programmatic Access Token**: The token you generated for that user
>
> Select **Connect to Snowflake**. Infisical returns you to the sync form with the new connection selected.
>
> > [!NOTE]
> >
> > This creates a connection scoped to the current project. To share the connection across other projects, [create it at the organization level](https://infisical.com/docs/integrations/app-connections/snowflake.md#step-2-create-the-app-connection) first, then select it here.

> [tab] Use an existing connection
>
> Under **Snowflake Connection**, select the app connection you'd like to use.

* **Database**: The Snowflake database that contains the schema
* **Schema**: The schema the sync writes secrets to

Before the sync writes any secrets, Infisical checks that the database and schema exist and that the connection's role can access them. If either check fails, the sync fails without writing anything.

![Configure Destination](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/snowflake/sync-destination.png)

Then select **Continue**.

**Step 4**

Under **Initial Sync Behavior**, select **Overwrite Snowflake**, then select **Continue**.

> [!NOTE]
>
> Snowflake doesn't return a secret's value after the secret is created, so this sync can't import existing Snowflake secrets into Infisical. **Overwrite Snowflake** is the only option.

**Step 5**

Under **Sync Options**, choose how secrets are synced:

* **Prevent secret deletion**: When enabled, Infisical adds and updates secrets in Snowflake but never deletes them; enable this if you manage some Snowflake secrets outside of Infisical
* **Auto-sync on changes**: When enabled, secrets sync to Snowflake automatically as the source changes; turn it off to sync manually only
* **Customize key names**: Adds a prefix or suffix to every synced name, using `{{secretKey}}` for the original name and `{{environment}}` for the environment slug

> [!WARNING]
>
> A Snowflake schema can hold secrets that other tools created, so a sync can change secrets that were created outside Infisical. If you don't customize key names, the sync treats every secret in the schema that its role owns as one it manages:
>
> * If a Snowflake secret has the same name as an Infisical secret, the sync overwrites the Snowflake secret's value
> * If **Prevent secret deletion** is off, every Snowflake secret that isn't in Infisical is deleted
>
> With customized key names, the sync writes only names with your prefix or suffix, and deletes only Snowflake secrets whose names match it.
>
> Before the first sync, customize key names or keep **Prevent secret deletion** on. **Prevent secret deletion** is on by default when you create the sync in the UI, but off unless you set `disableSecretDeletion` when you create it through the API.

![Configure Sync Options](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/snowflake/sync-options.png)

Then select **Continue**.

**Step 6**

Give the sync a **Name** and an optional **Description**. The name must be slug-friendly.

![Sync Details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/snowflake/sync-details.png)

Then select **Continue**.

**Step 7**

Review your Snowflake Sync configuration, then select **Create Sync**.

![Review and Create](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/snowflake/sync-created.png)

> [!TIP]
>
> The sync is created. If **Auto-sync on changes** is enabled, it begins syncing secrets to the schema right away.

## Next steps

> [card] [Secret syncs overview](https://infisical.com/docs/integrations/secret-syncs/overview)
>
> Learn how syncs run, how key schemas work, and how to sync subfolders.

> [card] [Snowflake user key pair rotation](https://infisical.com/docs/documentation/platform/secret-rotation/snowflake-user-key-pair.md)
>
> Rotate the RSA key pair of a Snowflake user with the same app connection.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.