> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake

> Read-only SQL, query history, and event-table telemetry through key-pair auth.

Ordyn connects to Snowflake with key-pair authentication. Ordyn generates an RSA key pair per connection, you set the public key on a dedicated read-only service user, and Ordyn signs a short-lived token per request. There is no password or token to rotate.

**1. Connect**

Go to **Connections**, click **Connect** next to Snowflake, and choose a service user name. The default is `STRUCT_READER`.

**2. Run the setup SQL**

Copy the generated SQL into a Snowsight worksheet and run it as an admin. It creates the service user, sets the public key, and grants a read-only role.

**3. Enter your account identifier**

From your Snowsight URL `app.snowflake.com/<org>/<account>`, join the two segments with a dash, for example `mkzwlrt-qx41832`. Warehouse, default database, and event table are detected automatically.

## What Ordyn reads

* **Event tables.** Logs, traces, and metrics from stored procedures, UDFs, Snowpark, tasks, and dynamic tables.
* **Query history.** Failed loads, pipeline errors, and slow queries from the last 7 days.
* **Read-only SQL** against the tables you grant.

## Permissions

The service user's role needs SNOWFLAKE.EVENTS\_VIEWER, USAGE on one warehouse, and SELECT on the databases Ordyn should read. MONITOR on that warehouse lets Ordyn see queries other users ran on it; the setup SQL grants it too.

### Read-only queries and telemetry

Read event-table logs, traces and metrics, query history, and the tables you grant.

| Grant | Used for |
| - | - |
| `SNOWFLAKE.EVENTS_VIEWER` | Event tables from stored procedures, UDFs, Snowpark, tasks and dynamic tables |
| `USAGE ON WAREHOUSE` | Running queries on one warehouse |
| `SELECT` | Tables and views in the databases you grant, including ones created later |

### Other users' query history

Only needed to see queries that other users and roles ran on the warehouse. Without it, `INFORMATION_SCHEMA.QUERY_HISTORY` returns only the service user's own queries.

| Grant | Used for |
| - | - |
| `MONITOR ON WAREHOUSE` | Query history on that warehouse. It does not let Ordyn start, stop, resize or use the warehouse (that is OPERATE or USAGE) |

* The setup SQL Ordyn generates grants SELECT across your current standard databases. If you create a database later, re-run its `EXECUTE IMMEDIATE` block, or grant it on its own with the commands below.

### How to grant

> **Grant one database**
>
> ```sql theme={null}
> GRANT APPLICATION ROLE SNOWFLAKE.EVENTS_VIEWER TO ROLE STRUCT_READER_ROLE;
> GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE STRUCT_READER_ROLE;
> GRANT MONITOR ON WAREHOUSE COMPUTE_WH TO ROLE STRUCT_READER_ROLE;
> GRANT USAGE ON DATABASE <database> TO ROLE STRUCT_READER_ROLE;
> GRANT USAGE ON ALL SCHEMAS IN DATABASE <database> TO ROLE STRUCT_READER_ROLE;
> GRANT SELECT ON ALL TABLES IN DATABASE <database> TO ROLE STRUCT_READER_ROLE;
> GRANT SELECT ON ALL VIEWS IN DATABASE <database> TO ROLE STRUCT_READER_ROLE;
> GRANT USAGE ON FUTURE SCHEMAS IN DATABASE <database> TO ROLE STRUCT_READER_ROLE;
> GRANT SELECT ON FUTURE TABLES IN DATABASE <database> TO ROLE STRUCT_READER_ROLE;
> GRANT SELECT ON FUTURE VIEWS IN DATABASE <database> TO ROLE STRUCT_READER_ROLE;
> ```

Replace the values in angle brackets.

Permission catalog version `2026-10-16.1`. See [permission changes](/reference/permission-changes).

To revoke access:

```sql theme={null}
ALTER USER STRUCT_READER UNSET RSA_PUBLIC_KEY;
```

Optionally restrict where the service user can connect from with a network policy. Contact support for Ordyn's egress IP addresses.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.