> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake

> Connect Snowflake to Iru Compliance with key-pair JWT authentication and ACCOUNT_USAGE access to collect role grants, users, and data-governance evidence.

### About Snowflake

Iru collects **warehouse and account usage**, **database/schema metadata**, **roles and grants**, and **login/query history** from Snowflake, primarily via **`SNOWFLAKE.ACCOUNT_USAGE`** views. Authentication uses **key-pair authentication**: short-lived **JWTs** signed with your **RSA private key**, verified against the **public key** registered on the Snowflake **user** Iru uses.

### How It Works

```http lines theme={null}
Authorization: Bearer YOUR_SIGNED_JWT
X-Snowflake-Authorization-Token-Type: KEYPAIR_JWT
```

JWTs are **short-lived** (about **60 seconds**); Iru regenerates them using the configured key and account details.

| Detail             | Value         |
| ------------------ | ------------- |
| **Category**       | Data platform |
| **Authentication** | Key-pair JWT  |

Official references: [Key-pair authentication](https://docs.snowflake.com/en/user-guide/key-pair-auth), [Account identifiers](https://docs.snowflake.com/en/user-guide/admin-account-identifier), [REST API](https://docs.snowflake.com/en/developer-guide/snowflake-rest-api/snowflake-rest-api), [ACCOUNT\_USAGE](https://docs.snowflake.com/en/sql-reference/account-usage).

### Prerequisites

* **`SECURITYADMIN`** (or equivalent) to assign **`RSA_PUBLIC_KEY`** on a dedicated service user.
* **OpenSSL** (or another tool) to generate a **2048-bit** (or larger) RSA key pair.
* Your **account identifier** (`orgname-accountname` preferred, or legacy locator with region/cloud if required).

### Connect Snowflake to Iru

<Tabs>
  <Tab title="Snowflake">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Confirm Snowflake admin access">
        Sign in to Snowsight or the classic console with **`SECURITYADMIN`** (or equivalent) so you can run **`ALTER USER`** and **`GRANT`** statements for the integration user.
      </Step>

      <Step title="Prepare a secure workstation">
        Use a trusted machine with **OpenSSL** (or another RSA tool your security team approves). You will keep **`snowflake_private_key.pem`** only in your vault. Never commit it to git or send it to Snowflake support.
      </Step>

      <Step title="Generate an RSA key pair">
        Example with OpenSSL:

        ```bash lines theme={null}
        openssl genrsa -out snowflake_private_key.pem 2048
        openssl rsa -in snowflake_private_key.pem -pubout -out snowflake_public_key.pem
        ```

        Protect **`snowflake_private_key.pem`**. Never commit it or share it with Snowflake.
      </Step>

      <Step title="Register the public key on a Snowflake user">
        As an administrator, strip the PEM headers and newlines from **`snowflake_public_key.pem`** so only the base64 body remains, then run:

        ```sql theme={null}
        ALTER USER YOUR_USERNAME SET RSA_PUBLIC_KEY='YOUR_PUBLIC_KEY';
        ```

        Snowflake allows **two** keys per user (`RSA_PUBLIC_KEY` / `RSA_PUBLIC_KEY_2`) for rotation. Assign the new key to **`RSA_PUBLIC_KEY_2`**, update Iru, then drop the old key.
      </Step>

      <Step title="Produce a JWT for the wizard">
        Use **Snowflake CLI** or a library. For example:

        ```bash lines theme={null}
        snow connection generate-jwt \
          --account YOUR_ACCOUNT_IDENTIFIER \
          --user YOUR_USERNAME \
          --private-key-path snowflake_private_key.pem
        ```

        Copy the JWT string for the initial Iru handshake; ongoing regeneration is handled in product.
      </Step>

      <Step title="Grant ACCOUNT_USAGE access">
        The integration user needs a role that can read **`SNOWFLAKE`** shared metadata, for example:

        ```sql lines theme={null}
        GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE YOUR_ROLE;
        GRANT ROLE YOUR_ROLE TO USER YOUR_USERNAME;
        ```
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**Snowflake**](#snowflake) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/7HsGH7lnQ8GpVmI0/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=7HsGH7lnQ8GpVmI0&q=85&s=595982441fd777b333b3ecfea24adc24" alt="Left navigation: Compliance expanded, Sources selected" width="424" height="1056" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on Snowflake">
        Find **Snowflake** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Enter account and host in the wizard">
        Choose the host pattern that matches your account:

        * Standard: `https://YOUR_ACCOUNT_IDENTIFIER.snowflakecomputing.com`
        * **PrivateLink**: `https://YOUR_ACCOUNT_IDENTIFIER.privatelink.snowflakecomputing.com`

        Enter **`account_identifier`** and confirm server variables before continuing.
      </Step>

      <Step title="Paste the JWT">
        When prompted, paste the **JWT**.
      </Step>

      <Step title="Finish the connection">
        Click **Submit Bearer Token**. When the connection succeeds, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Snowflake** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="Server variables failed">
    Wizard session expired. Toggle the source off and on, then retry.
  </Accordion>

  <Accordion title="JWT validation / 401">
    Run **`DESCRIBE USER`** to confirm the fingerprint matches and the private key pairs with the registered public key.
  </Accordion>

  <Accordion title="Wrong account string">
    Prefer **`org-account`** form; legacy locators may need **region/cloud** suffix.
  </Accordion>

  <Accordion title="PrivateLink">
    Ensure Iru egress can reach your endpoint; allowlist if required.
  </Accordion>

  <Accordion title="Missing ACCOUNT_USAGE">
    **`IMPORTED PRIVILEGES`** on **`SNOWFLAKE`** for the Iru role.
  </Accordion>
</AccordionGroup>

### Considerations

<CardGroup cols={2}>
  <Card title="Iru does not run arbitrary queries against your…" icon="circle-info">
    Iru does **not** run arbitrary queries against your tables. It reads governance-oriented metadata and usage views.
  </Card>
</CardGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>