Databases

Snowflake

Connect a Snowflake schema to TraceX with a read-only role and key-pair authentication. Includes the SQL to create the role and user.

Connect a Snowflake schema, read by a user with a read-only role and key-pair authentication (no password).

Why connect Snowflake

Your warehouse holds the history of your business: orders, events, billing over time. With Snowflake connected, TraceX can measure the impact of an issue (how many customers, since when) and answer questions about trends with real numbers.

Before you start

Create a role and user. Adjust the names:

CREATE ROLE TRACEX_READONLY;
GRANT USAGE ON WAREHOUSE ANALYTICS_WH TO ROLE TRACEX_READONLY;
GRANT USAGE ON DATABASE PROD TO ROLE TRACEX_READONLY;
GRANT USAGE ON SCHEMA PROD.PUBLIC TO ROLE TRACEX_READONLY;
GRANT SELECT ON ALL TABLES IN SCHEMA PROD.PUBLIC TO ROLE TRACEX_READONLY;
GRANT SELECT ON FUTURE TABLES IN SCHEMA PROD.PUBLIC TO ROLE TRACEX_READONLY;

CREATE USER TRACEX_READER DEFAULT_ROLE = TRACEX_READONLY DEFAULT_WAREHOUSE = ANALYTICS_WH;
GRANT ROLE TRACEX_READONLY TO USER TRACEX_READER;

Then generate a key pair and set the public key on the user, following Snowflake key-pair authentication:

ALTER USER TRACEX_READER SET RSA_PUBLIC_KEY = '<public key>';

Connect

In the dashboard, open Integrations → Snowflake and fill in:

Field	Value
Account identifier	`acme-prod`
Username	`TRACEX_READER`
Private key (PEM)	the user’s private key
Warehouse	`ANALYTICS_WH`
Database	`PROD`
Schema	optional, e.g. `PUBLIC`
Role	optional, e.g. `TRACEX_READONLY`

TraceX tests the connection, reads the schema, and is ready for investigations. The private key is stored encrypted and never shown again.

How TraceX queries it

Every query TraceX writes is checked before it runs:

it must be a single read-only statement: no writes, no schema changes, no locks, no file or remote functions;
it runs in a read-only transaction with row and time limits, so a query can’t slow your database down;
results are summarized for the investigation, and secrets in them are masked before an AI model sees them.

TraceX also reads the schema (tables or collections, columns or fields) when you connect, so it writes queries against names that really exist. Add notes about what a table is for in the company profile: they help it pick the right table first time.

Troubleshooting

Problem	What to check
JWT or key error	The public key on the user must match the private key you pasted. Paste the whole PEM, including the BEGIN and END lines.
Warehouse is suspended or not allowed	The role needs `USAGE` on the warehouse; auto-resume should be on.
Tables are missing	Grant `SELECT` on the schema’s tables, and on future tables, to the role.

Remove access

Disconnect Snowflake in Integrations, then DROP USER TRACEX_READER; in Snowflake.