Skip to content

Commit deb50c5

Browse files
waleedlatif1waleedlatif1
committed
feat(snowflake): credential-based auth, object pickers, and 9 new operations
Replace the per-block host + PAT fields with a Snowflake service-account credential, move the credential picker to the top of the block, back the object fields with metadata-only pickers, and add nine operations. - credential: snowflake-service-account token service account (account host + programmatic access token), verified against the SQL API with the same headers the tools use - selectors: database, schema, table, warehouse, execution role, file format and procedure pickers behind one /api/tools/snowflake/objects route - new operations: unload_data, list_databases, list_schemas, list_tables, alter_warehouse, resume_task, suspend_task, list_query_history, list_copy_history
1 parent 29cfb85 commit deb50c5

61 files changed

Lines changed: 3380 additions & 483 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎apps/docs/content/docs/en/integrations/meta.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,7 @@
224224
"smartlead",
225225
"smtp",
226226
"snowflake",
227+
"snowflake-service-account",
227228
"sportmonks",
228229
"sqs",
229230
"square",

‎apps/docs/content/docs/en/integrations/snowflake-service-account.mdx‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
title: Snowflake Programmatic Access Tokens
3+
description: Create a Snowflake programmatic access token and connect it to Sim so workflows can query your account
4+
---
5+
6+
import { Callout } from 'fumadocs-ui/components/callout'
7+
import { Step, Steps } from 'fumadocs-ui/components/steps'
8+
import { FAQ } from '@/components/ui/faq'
9+
10+
A Snowflake programmatic access token (PAT) lets a workflow authenticate to your account over the Snowflake SQL API without a password or a key pair. The token belongs to one Snowflake user. Left unrestricted it can act as any role that user holds; with `ROLE_RESTRICTION` set it is pinned to exactly one.
11+
12+
Sim stores the token alongside your account host as one credential. Once it is added, every Snowflake block picks it from a dropdown — and the block's database, schema, table, warehouse, role, file-format, and procedure fields become pickers that list what the token can actually see.
13+
14+
## Prerequisites
15+
16+
- A Snowflake user you can generate a token for. Generating a token for another user requires the ability to run `ALTER USER` on them.
17+
- Your account host — the `<account_identifier>.snowflakecomputing.com` hostname, for example `myorg-myaccount.snowflakecomputing.com`. Snowsight shows it under **Account details**.
18+
- A network policy covering the user, or an authentication policy that waives the requirement (see below).
19+
20+
<Callout type="warn">
21+
By default Snowflake requires a **human** user to be subject to a **network policy** before a programmatic access token can be generated or used. If your account has no network policy, either create one (allowing Sim's egress) or set `NETWORK_POLICY_EVALUATION = ENFORCED_NOT_REQUIRED` on an authentication policy applied to the user. Without one of these, token generation fails and a generated token is rejected at run time. Service users (`TYPE = SERVICE`) are exempt from the requirement.
22+
</Callout>
23+
24+
## Creating the Token
25+
26+
### Option 1 — Snowsight
27+
28+
<Steps>
29+
<Step>
30+
Open **Governance & security** → **Users & roles** and select the user the workflow should run as
31+
</Step>
32+
<Step>
33+
Under **Programmatic access tokens**, click **Generate new token**
34+
</Step>
35+
<Step>
36+
Give it a name, optionally restrict it to a single role, and set the expiry in days
37+
</Step>
38+
<Step>
39+
Copy the token secret. Snowflake shows it **once**, at creation
40+
</Step>
41+
</Steps>
42+
43+
### Option 2 — SQL
44+
45+
```sql
46+
ALTER USER my_service_user ADD PROGRAMMATIC ACCESS TOKEN sim_workflows
47+
ROLE_RESTRICTION = 'SIM_WORKFLOW_ROLE'
48+
DAYS_TO_EXPIRY = 90;
49+
```
50+
51+
`DAYS_TO_EXPIRY` defaults to 15 days and cannot exceed 365. **A token can never be non-expiring**, and the value cannot be changed after creation — to extend it, generate a new token and swap the credential in Sim. Plan the rotation when you create it.
52+
53+
Service users (`TYPE = SERVICE` or `SERVICE_AGENT`) **must** set `ROLE_RESTRICTION`. For person users it is optional but recommended: a restricted token can only ever act as that one role.
54+
55+
<Callout type="info">
56+
If an authentication policy applies to the user, `'PROGRAMMATIC_ACCESS_TOKEN'` must appear in its `AUTHENTICATION_METHODS` list, otherwise the token is refused.
57+
</Callout>
58+
59+
## Adding the Credential to Sim
60+
61+
<Steps>
62+
<Step>
63+
Add a **Snowflake** block to a workflow, open the credential dropdown, and choose to add a programmatic access token
64+
</Step>
65+
<Step>
66+
Enter the **account host** (`myorg-myaccount.snowflakecomputing.com`) and paste the **token**
67+
</Step>
68+
<Step>
69+
Save. Sim verifies the credential by running `SELECT CURRENT_USER(), CURRENT_ACCOUNT(), CURRENT_ROLE()` over the SQL API — a metadata-only statement that needs no warehouse and consumes no credits. A rejected token, an unreachable host, or a blocking network policy each produce a specific error rather than a generic failure.
70+
</Step>
71+
</Steps>
72+
73+
The host and the token are encrypted before being stored, and the token is never returned to the browser — the block sends a credential id and Sim resolves it server-side.
74+
75+
## Using the Credential in Workflows
76+
77+
Select the credential on any Snowflake block. You never enter the host again: every tool derives its endpoint from the host stored on the credential.
78+
79+
With a credential selected, these fields become pickers backed by metadata-only statements:
80+
81+
| Field | Lists | Needs |
82+
| --- | --- | --- |
83+
| Database | `SHOW DATABASES` | credential |
84+
| Schema | `SHOW SCHEMAS IN DATABASE` | database |
85+
| Table | `SHOW TABLES IN SCHEMA` | database, schema |
86+
| Warehouse | `SHOW WAREHOUSES` | credential |
87+
| Execution role | `CURRENT_AVAILABLE_ROLES()` | credential |
88+
| Named file format | `SHOW FILE FORMATS IN SCHEMA` | database, schema |
89+
| Procedure | `SHOW PROCEDURES IN SCHEMA` | database, schema |
90+
91+
Each picker runs as the token's user under its **default** role — not the execution role set on the block — so an empty list is usually a privilege gap rather than an empty account. Switch any field to advanced mode to type a name directly or reference an upstream block's output instead.
92+
93+
## Rotating and Revoking
94+
95+
A token's expiry is fixed at creation. To rotate, generate a new token on the same user and update the credential in Sim — the old one stays valid until you remove it. `ALTER USER ... REMOVE PROGRAMMATIC ACCESS TOKEN <name>` revokes immediately and cannot be undone.
96+
97+
<FAQ items={[
98+
{ question: "Why a programmatic access token instead of a password?", answer: "The token is scoped to one user, can be restricted to a single role, expires on a schedule you choose, and can be revoked on its own without changing anyone's password or breaking other integrations." },
99+
{ question: "Does the token expire?", answer: "Yes. DAYS_TO_EXPIRY defaults to 15 days and can be set up to 365 at creation. It cannot be changed afterwards, so pick the value you want up front and plan a rotation." },
100+
{ question: "I lost the token — can I see it again?", answer: "No. Snowflake shows the secret only at creation. Generate a new token and update the credential in Sim." },
101+
{ question: "Why does adding the credential fail with an authentication error?", answer: "The three common causes are a token that has expired or been revoked, a human user with no network policy (Snowflake requires one for token use unless an authentication policy waives it), and an authentication policy that omits PROGRAMMATIC_ACCESS_TOKEN from its AUTHENTICATION_METHODS. A wrong account host is reported separately — Snowflake resolves any *.snowflakecomputing.com name, so Sim identifies a mistyped host by the 404 it answers with." },
102+
{ question: "Why is a picker empty?", answer: "The pickers run SHOW statements as the token's user under its default role — the block's execution role is not applied to them. If the objects you expect are visible only to another role, grant the default role usage on them, restrict the token to the role that has access, or type the name in advanced mode." },
103+
{ question: "Does listing objects cost credits?", answer: "No. Every picker and the credential check run metadata-only statements, which Snowflake serves without a running warehouse." },
104+
{ question: "Can one credential reach two Snowflake accounts?", answer: "No. A token is bound to the user in one account, and the credential stores that account's host. Add one credential per account." },
105+
{ question: "How many tokens can a user have?", answer: "Snowflake allows up to 15 active programmatic access tokens per user." },
106+
]} />

0 commit comments

Comments
 (0)