> For the complete documentation index, see [llms.txt](https://docs.telm.ai/telmai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.telm.ai/telmai/connect-to-data/data-connections/snowflake.md).

# Snowflake

Connect Telmai to Snowflake.

Telmai reads tables and views from Snowflake and runs its scans outside your warehouse. It signs in with key-pair authentication only.

## Before you connect

Create a role and a user for Telmai, and give the user an unencrypted key pair. The role needs `USAGE` on the warehouse, database and schema, `MONITOR` for metadata retrieval, and `SELECT` on the tables and views Telmai reads. For details, see Snowflake's guides to [key-pair authentication](https://docs.snowflake.com/en/user-guide/key-pair-auth) and [access control privileges](https://docs.snowflake.com/en/user-guide/security-access-control-privileges).

1. Generate an unencrypted key pair. This creates the private key `rsa_key.p8` and the public key `rsa_key.pub`:

   ```bash
   openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
   openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
   ```
2. Turn each key into a single-line Base64 string without its header and footer lines:

   ```bash
   # macOS and Linux
   grep -v "PUBLIC KEY" rsa_key.pub | tr -d '\n' > rsa_public_key_base64.txt
   grep -v "PRIVATE KEY" rsa_key.p8 | tr -d '\n' > rsa_private_key_base64.txt
   ```

   ```powershell
   # Windows
   (Get-Content rsa_key.pub | Where-Object {$_ -notmatch 'PUBLIC KEY'}) -join '' |
       Set-Content -NoNewline rsa_public_key_base64.txt
   (Get-Content rsa_key.p8 | Where-Object {$_ -notmatch 'PRIVATE KEY'}) -join '' |
       Set-Content -NoNewline rsa_private_key_base64.txt
   ```
3. Set the variables at the top of this script, replace `MI...` with the contents of `rsa_public_key_base64.txt`, and run it in a Snowflake worksheet:

   ```sql
   -- Set these values. Object names must be uppercase.
   set role_name = 'TELMAI_ROLE';
   set user_name = 'TELMAI_USER';
   set warehouse_name = 'COMPUTE_WH';     -- your warehouse
   set database_name = 'YOUR_DATABASE';   -- your database
   set schema_name = 'YOUR_SCHEMA';       -- your schema
   set schema_fqn = $database_name || '.' || $schema_name;

   use role accountadmin;

   -- Role and user for Telmai. The user has no password: it signs in with its key pair.
   create role if not exists identifier($role_name);
   create user if not exists identifier($user_name)
     default_role = $role_name
     default_warehouse = $warehouse_name;

   -- Replace MI... with the contents of rsa_public_key_base64.txt
   alter user identifier($user_name) set rsa_public_key = 'MI...';

   grant role identifier($role_name) to user identifier($user_name);

   -- Access to the warehouse, database and schema
   grant usage on warehouse identifier($warehouse_name) to role identifier($role_name);
   grant usage on database identifier($database_name) to role identifier($role_name);
   grant usage on schema identifier($schema_fqn) to role identifier($role_name);

   -- Read every table in the schema
   grant select on all tables in schema identifier($schema_fqn) to role identifier($role_name);

   -- Or read only one table:
   -- set table_fqn = $schema_fqn || '.' || 'YOUR_TABLE';
   -- grant select on table identifier($table_fqn) to role identifier($role_name);
   ```

If your Snowflake account restricts access with [network policies](https://docs.snowflake.com/en/user-guide/network-policies), allow Telmai's addresses listed in [IP Allowlist](/telmai/api-reference/telmai-ip-list.md).

## Connection fields

On the **Connections** page, click **Add connection** and choose **Snowflake**. See [Add a connection](/telmai/connect-to-data.md#add-a-connection) for the full flow.

| Field                  | Description                                                                                           |
| ---------------------- | ----------------------------------------------------------------------------------------------------- |
| **Account identifier** | Your account identifier in the form `<org_name>-<account_name>`, for example `myorg-myaccount`.       |
| **Warehouse**          | The warehouse Telmai runs queries on, for example `COMPUTE_WH`.                                       |
| **Role**               | Optional. The role Telmai uses, for example `TELMAI_ROLE`. If empty, the user's default role is used. |
| **User**               | The Telmai user, for example `TELMAI_USER`.                                                           |
| **Private key**        | The contents of `rsa_private_key_base64.txt`: the private key as a single-line Base64 string.         |

**User** and **Private key** are under **Credentials**.

## Asset fields

Click **Add assets** on the connection. See [Add assets](/telmai/connect-to-data.md#list-of-connectors-enabled-by-default).

| Field        | Description                                                      |
| ------------ | ---------------------------------------------------------------- |
| **Database** | The database that holds the tables, for example `YOUR_DATABASE`. |
| **Schema**   | The schema that holds the tables, for example `YOUR_SCHEMA`.     |