Skip to main content

​
About Snowflake

Iru collects warehouse and account usage, database/schema metadata, roles and grants, and login/query history from Snowflake, primarily via SNOWFLAKE.ACCOUNT_USAGE views. Authentication uses key-pair authentication: short-lived JWTs signed with your RSA private key, verified against the public key registered on the Snowflake user Iru uses.

​
How It Works

JWTs are short-lived (about 60 seconds); Iru regenerates them using the configured key and account details. Official references: Key-pair authentication, Account identifiers, REST API, ACCOUNT_USAGE.

​
Prerequisites

  • SECURITYADMIN (or equivalent) to assign RSA_PUBLIC_KEY on a dedicated service user.
  • OpenSSL (or another tool) to generate a 2048-bit (or larger) RSA key pair.
  • Your account identifier (orgname-accountname preferred, or legacy locator with region/cloud if required).

​
Connect Snowflake to Iru

Complete this tab before you connect the source in Compliance.
1

Confirm Snowflake admin access

Sign in to Snowsight or the classic console with SECURITYADMIN (or equivalent) so you can run ALTER USER and GRANT statements for the integration user.
2

Prepare a secure workstation

Use a trusted machine with OpenSSL (or another RSA tool your security team approves). You will keep snowflake_private_key.pem only in your vault. Never commit it to git or send it to Snowflake support.
3

Generate an RSA key pair

Example with OpenSSL:
Protect snowflake_private_key.pem. Never commit it or share it with Snowflake.
4

Register the public key on a Snowflake user

As an administrator, strip the PEM headers and newlines from snowflake_public_key.pem so only the base64 body remains, then run:
Snowflake allows two keys per user (RSA_PUBLIC_KEY / RSA_PUBLIC_KEY_2) for rotation. Assign the new key to RSA_PUBLIC_KEY_2, update Iru, then drop the old key.
5

Produce a JWT for the wizard

Use Snowflake CLI or a library. For example:
Copy the JWT string for the initial Iru handshake; ongoing regeneration is handled in product.
6

Grant ACCOUNT_USAGE access

The integration user needs a role that can read SNOWFLAKE shared metadata, for example:
Continue on the Iru Compliance tab.

​
Troubleshooting

Check pop-up blocker settings for the Iru site and try again.
Wizard session expired. Toggle the source off and on, then retry.
Run DESCRIBE USER to confirm the fingerprint matches and the private key pairs with the registered public key.
Prefer org-account form; legacy locators may need region/cloud suffix.
IMPORTED PRIVILEGES on SNOWFLAKE for the Iru role.

​
Considerations

Iru does not run arbitrary queries against your…

Iru does not run arbitrary queries against your tables. It reads governance-oriented metadata and usage views.

Sources Management

Browse and manage every Compliance source.

Getting Started With Compliance

Frameworks, actions, and Artifacts.

Iru Overview

How Endpoint, Compliance, and Identity fit together.

Artifacts Management

Upload, review, and organize evidence from sources and actions.