Snowflake

Overview

About this integration

Connect a Snowflake cloud data warehouse to query data, list metadata, and feed analytics into Flows360 workflows. This connector allows you to:

• Read data directly: Run SELECT queries to pull data from your warehouse into your workflows, enabling enrichment, analytics, and data-driven process automation.
• Browse warehouse metadata: List databases, schemas, tables, views, and columns to dynamically construct queries and understand your data landscape without leaving Flows360.
• Centralize operations: Incorporate your data warehouse into a unified operational view, triggering workflows based on data insights or syncing warehouse data with other business-critical applications.

The connector uses Snowflake's secure key-pair authentication, ensuring that access is managed through a dedicated, permissions-controlled service user role.

Capability summary

Authentication

Authentication method: Snowflake Key Pair Authentication

Required scopes

Supported objects

Supported actions

Setup

Prerequisites

• Administrative access to your Snowflake account.
• A command-line terminal with openssl installed.

1. Create a Service Role and User in Snowflake

Execute the following SQL commands in a Snowflake worksheet. Replace "your_warehouse_name" with the name of the warehouse Flows360 will use.

```sql -- Use a role with sufficient privileges to create users and roles USE ROLE ACCOUNTADMIN;

-- 1. Create a dedicated role for Flows360 CREATE ROLE FLOWS360_ROLE;

-- 2. Grant privileges to the role -- Grant usage on the target warehouse GRANT USAGE ON WAREHOUSE "your_warehouse_name" TO ROLE FLOWS360_ROLE;

-- NOTE: You must grant access to specific databases and schemas. -- For each database and schema the integration needs to access, run: -- GRANT USAGE ON DATABASE "some_database" TO ROLE FLOWS360_ROLE; -- GRANT USAGE ON SCHEMA "some_database"."some_schema" TO ROLE FLOWS360_ROLE; -- GRANT SELECT ON ALL TABLES IN SCHEMA "some_database"."some_schema" TO ROLE FLOWS360_ROLE; -- GRANT SELECT ON ALL VIEWS IN SCHEMA "some_database"."some_schema" TO ROLE FLOWS360_ROLE;

-- 3. Create a dedicated user for Flows360 CREATE USER FLOWS360_USER DEFAULT_ROLE = FLOWS360_ROLE DEFAULT_WAREHOUSE = "your_warehouse_name" COMMENT = 'Service user for Flows360 integration.';

-- 4. Assign the role to the user GRANT ROLE FLOWS360_ROLE TO USER FLOWS360_USER; ```

2. Generate an RSA Key Pair

This authentication method uses a private key to sign a JWT and a corresponding public key stored in Snowflake to verify the signature.

1. Open your command-line terminal.
2. Generate a 2048-bit unencrypted private key.

```bash openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt ```

1. Extract the public key from the private key.

```bash openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub ``` Keep both rsa_key.p8 (private key) and rsa_key.pub (public key) files.

3. Assign the Public Key to the Snowflake User

1. Open rsa_key.pub in a text editor and copy the entire content, excluding the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers/footers.
2. Execute the following SQL in Snowflake, pasting the copied public key content as the value for RSA_PUBLIC_KEY.

```sql -- Use a role with sufficient privileges USE ROLE ACCOUNTADMIN;

-- Assign the public key to the user ALTER USER FLOWS360_USER SET RSA_PUBLIC_KEY='your_public_key_string_here'; ```

4. Configure the Flows360 Connection

1. Navigate to the connections page in Flows360 and add a new Snowflake connection.
2. Fill in the required fields:

• Account Identifier: Your full Snowflake account identifier (e.g., xy12345.us-east-1).
• Username: FLOWS360_USER
• Role: FLOWS360_ROLE
• Warehouse: The name of the warehouse you granted access to (e.g., "your_warehouse_name").
• Private Key: The full content of the rsa_key.p8 file, including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines.

1. Save and test the connection.

Limitations

• Read-Only Metadata: The connector can read warehouse metadata (schemas, tables, etc.) but cannot create or modify them.
• Query-Based Writes: Writing data is not a direct action. To insert or update data, you must execute a SQL statement with the appropriate privileges using the "Run SELECT query" action (which can execute DML).
• Permissions: All operations are constrained by the permissions granted to the service role in Snowflake. Insufficient privileges will result in connection or query failures.
• Query Timeouts: The "Run SELECT query" action has a default timeout of 90 seconds. Long-running queries may be terminated.
• Private Key Format: The RSA private key must be in PKCS#8 PEM format and must not be password-protected.

Use cases and industries

Use cases

Industries