Skip to main content

​
About Snowflake

Iru collects warehouse and account usage, database/schema metadata, roles and grants, and login/query history from Snowflake, primarily via SNOWFLAKE.ACCOUNT_USAGE views. Authentication uses key-pair authentication: short-lived JWTs signed with your RSA private key, verified against the public key registered on the Snowflake user Iru uses.

​
How It Works

Authorization: Bearer YOUR_SIGNED_JWT
X-Snowflake-Authorization-Token-Type: KEYPAIR_JWT
JWTs are short-lived (about 60 seconds); Iru regenerates them using the configured key and account details.
DetailValue
CategoryData platform
AuthenticationKey-pair JWT
Official references: Key-pair authentication, Account identifiers, REST API, ACCOUNT_USAGE.

​
Prerequisites

  • SECURITYADMIN (or equivalent) to assign RSA_PUBLIC_KEY on a dedicated service user.
  • OpenSSL (or another tool) to generate a 2048-bit (or larger) RSA key pair.
  • Your account identifier (orgname-accountname preferred, or legacy locator with region/cloud if required).

​
Connect Snowflake to Iru

Complete this tab before you connect the source in Compliance.
1

Confirm Snowflake admin access

Sign in to Snowsight or the classic console with SECURITYADMIN (or equivalent) so you can run ALTER USER and GRANT statements for the integration user.
2

Prepare a secure workstation

Use a trusted machine with OpenSSL (or another RSA tool your security team approves). You will keep snowflake_private_key.pem only in your vault. Never commit it to git or send it to Snowflake support.
3

Generate an RSA key pair

Example with OpenSSL:
openssl genrsa -out snowflake_private_key.pem 2048
openssl rsa -in snowflake_private_key.pem -pubout -out snowflake_public_key.pem
Protect snowflake_private_key.pem. Never commit it or share it with Snowflake.
4

Register the public key on a Snowflake user

As an administrator, strip the PEM headers and newlines from snowflake_public_key.pem so only the base64 body remains, then run:
ALTER USER YOUR_USERNAME SET RSA_PUBLIC_KEY='YOUR_PUBLIC_KEY';
Snowflake allows two keys per user (RSA_PUBLIC_KEY / RSA_PUBLIC_KEY_2) for rotation. Assign the new key to RSA_PUBLIC_KEY_2, update Iru, then drop the old key.
5

Produce a JWT for the wizard

Use Snowflake CLI or a library. For example:
snow connection generate-jwt \
  --account YOUR_ACCOUNT_IDENTIFIER \
  --user YOUR_USERNAME \
  --private-key-path snowflake_private_key.pem
Copy the JWT string for the initial Iru handshake; ongoing regeneration is handled in product.
6

Grant ACCOUNT_USAGE access

The integration user needs a role that can read SNOWFLAKE shared metadata, for example:
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE YOUR_ROLE;
GRANT ROLE YOUR_ROLE TO USER YOUR_USERNAME;
Continue on the Iru Compliance tab.

​
Troubleshooting

Check pop-up blocker settings for the Iru site and try again.
Wizard session expired. Toggle the source off and on, then retry.
Run DESCRIBE USER to confirm the fingerprint matches and the private key pairs with the registered public key.
Prefer org-account form; legacy locators may need region/cloud suffix.
IMPORTED PRIVILEGES on SNOWFLAKE for the Iru role.

​
Considerations

Iru does not run arbitrary queries against your…

Iru does not run arbitrary queries against your tables. It reads governance-oriented metadata and usage views.

Sources Management

Browse and manage every Compliance source.

Getting Started With Compliance

Frameworks, actions, and Artifacts.

Iru Overview

How Endpoint, Compliance, and Identity fit together.

Artifacts Management

Upload, review, and organize evidence from sources and actions.