Snowflake Service User Setup

Set Up a Snowflake Service User for Statisfy

This is the Snowflake-side setup you complete once, before connecting the integration in Statisfy. It creates a dedicated, read-only service user, restricts it to Statisfy’s egress IPs with a network policy, and issues one of two password-free credentials: a Programmatic Access Token (PAT) or an RSA key-pair. Most of this is clickable in Snowsight (Snowflake’s web UI). The only part that still needs a SQL worksheet is the optional authentication policy in the last section.

Once this is done, head to the Snowflake Integration page to enter the credentials in Statisfy.

Prerequisites:

A Snowflake role with privileges to create users, roles, warehouses, and network policies — typically ACCOUNTADMIN or SECURITYADMIN plus SYSADMIN.
The Statisfy egress IPs (below) to allowlist in your network policy.

Statisfy egress IPs — allow these in your network policy:

35.203.185.27
35.197.52.231

Step 1: Create the role, warehouse, and service user

Run this in a Snowsight worksheet, as ACCOUNTADMIN (or a role with equivalent privileges). Adjust the database and schema names to match your environment.

-- Dedicated read-only role
CREATE ROLE IF NOT EXISTS statisfy_reader;

-- Small warehouse for read-only sync queries
CREATE WAREHOUSE IF NOT EXISTS statisfy_wh
  WAREHOUSE_SIZE      = XSMALL
  AUTO_SUSPEND        = 60
  INITIALLY_SUSPENDED = TRUE;
GRANT USAGE ON WAREHOUSE statisfy_wh TO ROLE statisfy_reader;

-- Read access on the schemas Statisfy should see
GRANT USAGE ON DATABASE analytics TO ROLE statisfy_reader;
GRANT USAGE ON SCHEMA analytics.product TO ROLE statisfy_reader;
GRANT SELECT ON ALL TABLES    IN SCHEMA analytics.product TO ROLE statisfy_reader;
GRANT SELECT ON FUTURE TABLES IN SCHEMA analytics.product TO ROLE statisfy_reader;

-- The service user. TYPE = SERVICE marks it as programmatic (no password login / MFA).
CREATE USER IF NOT EXISTS statisfy_svc
  TYPE              = SERVICE
  DEFAULT_ROLE      = statisfy_reader
  DEFAULT_WAREHOUSE = statisfy_wh;
GRANT ROLE statisfy_reader TO USER statisfy_svc;

TYPE = SERVICE is the right choice for an integration — it disallows interactive/MFA login and is meant for token and key-pair auth. Note the gotcha in Step 4a: a SERVICE user cannot generate a PAT until a network policy is attached, so do Steps 2–3 first.

Step 2: Create the network policy

The network policy is what allowlists Statisfy’s egress IPs. There are two ways to build it — a simple inline IP list, or a reusable network rule.

Simple — IP allowlist directly on the policy

Sign in to Snowsight.
In the left nav, go to Admin → Security → Network Policies. On newer accounts this lives under Governance & security → Network Policies.
Click + Network Policy.
Give it a name (e.g., statisfy_policy), paste the Statisfy egress IPs into the Allowed IP list, and save.

With a network rule (more flexible, recommended)

Go to Admin → Security → Network Rules → + Network Rule.
Set Type: IPv4, Mode: Ingress, and add the Statisfy egress IPs under Identifiers. Click Create.
Go to Network Policies → + Network Policy and attach the rule you just created.

Step 3: Attach the network policy to the service user

Go to Admin → Users & Roles (or Governance & security → Users & roles).
Click the statisfy_svc user.
Open the … menu (or scroll to the user details panel) → find the Network Policy field, pick the policy from Step 2, and apply it.

You can activate a policy account-wide from the policy’s detail page (… → Activate on Account), but attaching it per-user is cleaner for a service account and won’t affect your other users.

Step 4: Choose an authentication method

Statisfy connects with one password-free credential. Pick one:

	Programmatic Access Token (PAT)	RSA Key-Pair
Who generates it	Snowflake generates and shows it once	You generate it yourself; Snowflake stores only the public half
Where it’s entered in Statisfy	The Password field	The Private Key field (+ passphrase if encrypted)
Expiry	Expires (default 15 days, max 365)	No expiry — rotate manually
Scope	Scoped to a specific role	Uses the user’s default role
Network policy	Required to generate and use (for `SERVICE` users)	Required to use, not to generate
Best for	Quick setup; easiest end-to-end	Long-running production; independent rotation

Not sure which? A PAT is the fastest path and everything is clickable in Snowsight. Choose key-pair if your security policy requires non-expiring credentials that rotate independently of the token lifecycle.

Step 4a: Generate a Programmatic Access Token (PAT)

This is fully clickable in Snowsight.

Go to Governance & security → Users & roles (or Admin → Users & Roles).
Click the statisfy_svc user → scroll to the Programmatic access tokens section → Generate new token.
Fill in:
- Name — letters, numbers, and underscores only; must start with a letter or underscore.
- Comment — optional.
- Expires in — defaults to 15 days, max 365. Set a rotation reminder before it lapses.
- Role — pick One specific role (recommended) and choose statisfy_reader.
Click Generate, then copy the token immediately — this is the only time it’s shown.

The same page is where you rotate, disable, or delete tokens later (via the … menu on the token row).

TYPE = SERVICE gotcha: Snowflake refuses to generate a PAT until a network policy is already attached to the user — the Generate new token button will error. Complete Steps 2 and 3 first. (For TYPE = PERSON users you can generate first, but the token still won’t authenticate until a policy is attached.)

You’ll paste this token into the Password field when you connect in Statisfy — no special authenticator setting is needed. Continue to Connect in Statisfy.

Step 4b: Generate an RSA key-pair (alternative)

With key-pair auth you generate the keys yourself. Snowflake only ever stores the public half; the private key and its passphrase stay on the client and are never sent to Snowflake. This part is CLI + SQL. 1. Generate the key pair (OpenSSL). The recommended (encrypted) form prompts you to set an encryption password — that prompt is where the passphrase comes from; it isn’t issued by Snowflake:

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8
# "Enter Encryption Password:" — store this passphrase in your secrets manager

Derive the public key from the private key:

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

For an unencrypted key (no passphrase — simpler, weaker), add -nocrypt to the first command:

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

Use a minimum 2048-bit RSA key. Keep rsa_key.p8 (private) secret — only rsa_key.pub (public) goes to Snowflake.

2. Assign the public key to the user. Copy the contents of rsa_key.pub, drop the BEGIN/END header lines and the newlines, and set it on the user:

ALTER USER statisfy_svc
  SET RSA_PUBLIC_KEY = 'MIIBIjANBgkqhki...';

The role running this needs the MODIFY PROGRAMMATIC AUTHENTICATION METHODS privilege (or OWNERSHIP) on the user. Confirm the key landed:

DESC USER statisfy_svc;
-- RSA_PUBLIC_KEY_FP should now show the key's SHA256 fingerprint

You can also paste the public key into the user’s detail page in Snowsight instead of running the ALTER USER.

When you connect in Statisfy, paste the contents of rsa_key.p8 (the private key, PEM/PKCS8) into the Private Key field, and enter the passphrase if you set one. Continue to Connect in Statisfy.

(Optional) Harden the user with an authentication policy

By default a user can authenticate with any method. If you want to lock statisfy_svc down to only the method you chose, attach an authentication policy. This is the one step that still needs a SQL worksheet.

-- Allow only PAT:
CREATE AUTHENTICATION POLICY statisfy_pat_only
  AUTHENTICATION_METHODS = ('PROGRAMMATIC_ACCESS_TOKEN');

-- ...or allow both PAT and key-pair:
CREATE AUTHENTICATION POLICY statisfy_pat_only
  AUTHENTICATION_METHODS = ('PROGRAMMATIC_ACCESS_TOKEN', 'KEYPAIR');

Then attach it from the user’s page in Snowsight via the authentication policy dropdown. To change the allowed methods later:

ALTER AUTHENTICATION POLICY statisfy_pat_only
  SET AUTHENTICATION_METHODS = ('PROGRAMMATIC_ACCESS_TOKEN', 'KEYPAIR');

This hardening is optional — skip it if you’re moving fast. If you skip it, all authentication methods are allowed by default and there’s nothing to change here.

Connect in Statisfy

With the service user, network policy, and credential ready:

In Statisfy, go to Integrations → Admin Apps → Snowflake → Connect.
Enter your account identifier, the username (statisfy_svc), and your credential:
- PAT → paste the token into the Password field.
- Key-pair → paste the private key into the Private Key field (plus passphrase if encrypted).
Set the default warehouse, database, and schema.
Click Test Connection.

See the Snowflake Integration page for the full connect flow, query configuration, and troubleshooting.

Need Help?

For setup, query design, or troubleshooting, contact support@statisfy.com or your Statisfy CSM.

CRM

Analytics

Communication

Support

Project Management

Conversation Intelligence

Authentication

Data Import

AI & Agents

Snowflake Service User Setup

Set Up a Snowflake Service User for Statisfy

Step 1: Create the role, warehouse, and service user

Step 2: Create the network policy

Step 3: Attach the network policy to the service user

Step 4: Choose an authentication method

Step 4a: Generate a Programmatic Access Token (PAT)

Step 4b: Generate an RSA key-pair (alternative)

(Optional) Harden the user with an authentication policy

Connect in Statisfy

Need Help?

​Set Up a Snowflake Service User for Statisfy

​Step 1: Create the role, warehouse, and service user

​Step 2: Create the network policy

​Step 3: Attach the network policy to the service user

​Step 4: Choose an authentication method

​Step 4a: Generate a Programmatic Access Token (PAT)

​Step 4b: Generate an RSA key-pair (alternative)

​(Optional) Harden the user with an authentication policy

​Connect in Statisfy

​Need Help?

Set Up a Snowflake Service User for Statisfy

Step 1: Create the role, warehouse, and service user

Step 2: Create the network policy

Step 3: Attach the network policy to the service user

Step 4: Choose an authentication method

Step 4a: Generate a Programmatic Access Token (PAT)

Step 4b: Generate an RSA key-pair (alternative)

(Optional) Harden the user with an authentication policy

Connect in Statisfy

Need Help?