> ## Documentation Index
> Fetch the complete documentation index at: https://help.statisfy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake Service User Setup

> Step-by-step Snowsight guide to creating the Snowflake service user, network policy, and auth credential (PAT or key-pair) that Statisfy connects with.

### Set Up a Snowflake Service User for Statisfy

This is the **Snowflake-side** setup you complete once, before connecting the integration in Statisfy. It creates a dedicated, read-only service user, restricts it to Statisfy's egress IPs with a network policy, and issues one of two password-free credentials: a **Programmatic Access Token (PAT)** or an **RSA key-pair**.

Most of this is clickable in **Snowsight** (Snowflake's web UI). The only part that still needs a SQL worksheet is the optional authentication policy in the last section.

<Note>
  Once this is done, head to the [Snowflake Integration](/integrations/snowflake_integration) page to enter the credentials in Statisfy.
</Note>

**Prerequisites:**

* A Snowflake role with privileges to create users, roles, warehouses, and network policies — typically `ACCOUNTADMIN` or `SECURITYADMIN` plus `SYSADMIN`.
* The Statisfy egress IPs (below) to allowlist in your network policy.

<Info>
  **Statisfy egress IPs** — allow these in your network policy:

  ```text theme={null}
  35.203.185.27
  35.197.52.231
  ```
</Info>

***

### Step 1: Create the role, warehouse, and service user

Run this in a Snowsight worksheet, as `ACCOUNTADMIN` (or a role with equivalent privileges). Adjust the database and schema names to match your environment.

```sql theme={null}
-- Dedicated read-only role
CREATE ROLE IF NOT EXISTS statisfy_reader;

-- Small warehouse for read-only sync queries
CREATE WAREHOUSE IF NOT EXISTS statisfy_wh
  WAREHOUSE_SIZE      = XSMALL
  AUTO_SUSPEND        = 60
  INITIALLY_SUSPENDED = TRUE;
GRANT USAGE ON WAREHOUSE statisfy_wh TO ROLE statisfy_reader;

-- Read access on the schemas Statisfy should see
GRANT USAGE ON DATABASE analytics TO ROLE statisfy_reader;
GRANT USAGE ON SCHEMA analytics.product TO ROLE statisfy_reader;
GRANT SELECT ON ALL TABLES    IN SCHEMA analytics.product TO ROLE statisfy_reader;
GRANT SELECT ON FUTURE TABLES IN SCHEMA analytics.product TO ROLE statisfy_reader;

-- The service user. TYPE = SERVICE marks it as programmatic (no password login / MFA).
CREATE USER IF NOT EXISTS statisfy_svc
  TYPE              = SERVICE
  DEFAULT_ROLE      = statisfy_reader
  DEFAULT_WAREHOUSE = statisfy_wh;
GRANT ROLE statisfy_reader TO USER statisfy_svc;
```

<Tip>
  `TYPE = SERVICE` is the right choice for an integration — it disallows interactive/MFA login and is meant for token and key-pair auth. Note the gotcha in Step 4a: a `SERVICE` user cannot generate a PAT until a network policy is attached, so do Steps 2–3 first.
</Tip>

***

### Step 2: Create the network policy

The network policy is what allowlists Statisfy's egress IPs. There are two ways to build it — a simple inline IP list, or a reusable network rule.

<Accordion title="Simple — IP allowlist directly on the policy">
  1. Sign in to **Snowsight**.
  2. In the left nav, go to **Admin → Security → Network Policies**. On newer accounts this lives under **Governance & security → Network Policies**.
  3. Click **+ Network Policy**.
  4. Give it a name (e.g., `statisfy_policy`), paste the [Statisfy egress IPs](#set-up-a-snowflake-service-user-for-statisfy) into the **Allowed IP list**, and save.
</Accordion>

<Accordion title="With a network rule (more flexible, recommended)">
  1. Go to **Admin → Security → Network Rules → + Network Rule**.
  2. Set **Type: IPv4**, **Mode: Ingress**, and add the Statisfy egress IPs under **Identifiers**. Click **Create**.
  3. Go to **Network Policies → + Network Policy** and attach the rule you just created.
</Accordion>

***

### Step 3: Attach the network policy to the service user

1. Go to **Admin → Users & Roles** (or **Governance & security → Users & roles**).
2. Click the **statisfy\_svc** user.
3. Open the **…** menu (or scroll to the user details panel) → find the **Network Policy** field, pick the policy from Step 2, and apply it.

<Note>
  You *can* activate a policy account-wide from the policy's detail page (**… → Activate on Account**), but attaching it per-user is cleaner for a service account and won't affect your other users.
</Note>

***

### Step 4: Choose an authentication method

Statisfy connects with one password-free credential. Pick **one**:

|                                    | **Programmatic Access Token (PAT)**                      | **RSA Key-Pair**                                                |
| ---------------------------------- | -------------------------------------------------------- | --------------------------------------------------------------- |
| **Who generates it**               | Snowflake generates and shows it once                    | You generate it yourself; Snowflake stores only the public half |
| **Where it's entered in Statisfy** | The **Password** field                                   | The **Private Key** field (+ passphrase if encrypted)           |
| **Expiry**                         | Expires (default 15 days, max 365)                       | No expiry — rotate manually                                     |
| **Scope**                          | Scoped to a specific role                                | Uses the user's default role                                    |
| **Network policy**                 | **Required** to generate *and* use (for `SERVICE` users) | Required to *use*, not to generate                              |
| **Best for**                       | Quick setup; easiest end-to-end                          | Long-running production; independent rotation                   |

<Tip>
  **Not sure which?** A PAT is the fastest path and everything is clickable in Snowsight. Choose key-pair if your security policy requires non-expiring credentials that rotate independently of the token lifecycle.
</Tip>

#### Step 4a: Generate a Programmatic Access Token (PAT)

This is fully clickable in Snowsight.

1. Go to **Governance & security → Users & roles** (or **Admin → Users & Roles**).
2. Click the **statisfy\_svc** user → scroll to the **Programmatic access tokens** section → **Generate new token**.
3. Fill in:
   * **Name** — letters, numbers, and underscores only; must start with a letter or underscore.
   * **Comment** — optional.
   * **Expires in** — defaults to 15 days, max 365. Set a rotation reminder before it lapses.
   * **Role** — pick **One specific role (recommended)** and choose `statisfy_reader`.
4. Click **Generate**, then **copy the token immediately** — this is the only time it's shown.

The same page is where you rotate, disable, or delete tokens later (via the **…** menu on the token row).

<Warning>
  **`TYPE = SERVICE` gotcha:** Snowflake refuses to generate a PAT until a network policy is already attached to the user — the **Generate new token** button will error. Complete Steps 2 and 3 first. (For `TYPE = PERSON` users you can generate first, but the token still won't authenticate until a policy is attached.)
</Warning>

You'll paste this token into the **Password** field when you connect in Statisfy — no special authenticator setting is needed. Continue to [Connect in Statisfy](#connect-in-statisfy).

#### Step 4b: Generate an RSA key-pair (alternative)

With key-pair auth you generate the keys yourself. Snowflake only ever stores the **public** half; the private key and its passphrase stay on the client and are never sent to Snowflake. This part is CLI + SQL.

**1. Generate the key pair (OpenSSL).** The recommended (encrypted) form prompts you to set an encryption password — that prompt is where the passphrase comes from; it isn't issued by Snowflake:

```bash theme={null}
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8
# "Enter Encryption Password:" — store this passphrase in your secrets manager
```

Derive the public key from the private key:

```bash theme={null}
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
```

For an unencrypted key (no passphrase — simpler, weaker), add `-nocrypt` to the first command:

```bash theme={null}
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
```

<Warning>
  Use a minimum **2048-bit RSA** key. Keep `rsa_key.p8` (private) secret — only `rsa_key.pub` (public) goes to Snowflake.
</Warning>

**2. Assign the public key to the user.** Copy the contents of `rsa_key.pub`, drop the `BEGIN`/`END` header lines and the newlines, and set it on the user:

```sql theme={null}
ALTER USER statisfy_svc
  SET RSA_PUBLIC_KEY = 'MIIBIjANBgkqhki...';
```

The role running this needs the `MODIFY PROGRAMMATIC AUTHENTICATION METHODS` privilege (or `OWNERSHIP`) on the user. Confirm the key landed:

```sql theme={null}
DESC USER statisfy_svc;
-- RSA_PUBLIC_KEY_FP should now show the key's SHA256 fingerprint
```

<Note>
  You can also paste the public key into the user's detail page in Snowsight instead of running the `ALTER USER`.
</Note>

When you connect in Statisfy, paste the **contents of `rsa_key.p8`** (the private key, PEM/PKCS8) into the **Private Key** field, and enter the passphrase if you set one. Continue to [Connect in Statisfy](#connect-in-statisfy).

***

### (Optional) Harden the user with an authentication policy

By default a user can authenticate with any method. If you want to lock `statisfy_svc` down to only the method you chose, attach an authentication policy. This is the one step that still needs a SQL worksheet.

```sql theme={null}
-- Allow only PAT:
CREATE AUTHENTICATION POLICY statisfy_pat_only
  AUTHENTICATION_METHODS = ('PROGRAMMATIC_ACCESS_TOKEN');

-- ...or allow both PAT and key-pair:
CREATE AUTHENTICATION POLICY statisfy_pat_only
  AUTHENTICATION_METHODS = ('PROGRAMMATIC_ACCESS_TOKEN', 'KEYPAIR');
```

Then attach it from the user's page in Snowsight via the **authentication policy** dropdown. To change the allowed methods later:

```sql theme={null}
ALTER AUTHENTICATION POLICY statisfy_pat_only
  SET AUTHENTICATION_METHODS = ('PROGRAMMATIC_ACCESS_TOKEN', 'KEYPAIR');
```

<Note>
  This hardening is optional — skip it if you're moving fast. If you skip it, all authentication methods are allowed by default and there's nothing to change here.
</Note>

***

### Connect in Statisfy

With the service user, network policy, and credential ready:

1. In Statisfy, go to **Integrations → Admin Apps → Snowflake → Connect**.
2. Enter your **account identifier**, the **username** (`statisfy_svc`), and your credential:
   * **PAT** → paste the token into the **Password** field.
   * **Key-pair** → paste the private key into the **Private Key** field (plus passphrase if encrypted).
3. Set the default **warehouse**, **database**, and **schema**.
4. Click **Test Connection**.

See the [Snowflake Integration](/integrations/snowflake_integration) page for the full connect flow, query configuration, and troubleshooting.

### Need Help?

For setup, query design, or troubleshooting, contact [support@statisfy.com](mailto:support@statisfy.com) or your Statisfy CSM.