Snowflake

Learn how to connect your Snowflake account to North as a Cost Loop.

Setup the Snowflake Cost Loop integration in North to see your wrehouse compute and storage spend.

North authenticates with Snowflake as a dedicated read-only service user, using an RSA key pair. North generates the key pair in your browser and builds a setup script that already carries your public key. You run that script once in Snowflake. North keeps the private key.

Before You Start

You need a Snowflake user that holds both ORGADMIN and ACCOUNTADMIN.

If you do not hold ORGADMIN, you can still complete the setup. Only the first three statements in the script need it, and they run once per account. Ask your organization administrator to run those three, delete them from your copy, then run the rest yourself as ACCOUNTADMIN.

You also need your Snowflake account identifier. Use the ORGID-ACCOUNTID form, for example MYORG-PROD01. The legacy locator.region.cloud form still works.

What the Script Creates

The script is idempotent. You can run it again safely, and re-running never removes the registered public key.

Object	Purpose
NORTH_RO_WH warehouse	An XSMALL warehouse used only by the service user. It auto-suspends after 60 seconds and resumes on demand.
NORTH_RO role	The read-only role North uses.
NORTH database and NORTH.PUBLIC schema	Holds the secure views North reads through.
NORTH_RO user	The service identity. It is created with TYPE = SERVICE, so password authentication is structurally impossible and human MFA policies do not apply to it.
Secure views in NORTH.PUBLIC	Column-pruned wrappers over Snowflake's own usage and billing views.
NORTH_RO_NETWORK_POLICY	Restricts the service user to North's egress IP addresses. It applies to NORTH_RO only. Your own users and administrators are unaffected.

What North Can and Cannot Read

North connects only as NORTH_RO, and that role has no direct access to SNOWFLAKE.*. It reads the secure wrapper views instead, and those views are built to exclude sensitive columns.

Excluded from every view: QUERY_TEXT, USER_NAME, and per-user Cortex identifiers. North sees query identifiers and resource metrics for attribution. North does not see the SQL you ran or who ran it.

Bounded to 365 days. Every time-based view is filtered to the last 365 days.

The views cover organization billing, rates, and balances; warehouse and serverless compute; storage; data transfer; query-level attribution; and Cortex AI usage. Some views depend on your Snowflake edition or region. The script skips any source that does not exist on your account rather than failing, and reports which views it created and which it skipped.

Connect Snowflake

1

Open the connect screen

Open Settings, then Integrations, then Add accounts. Under Cost Loops, select Snowflake.

North generates your RSA key pair at this point and fills your public key into the script shown on screen.

2

Run the setup script in Snowflake

Click Copy. Open a Snowflake worksheet and run the whole script as a user holding both ORGADMIN and ACCOUNTADMIN.

The script's final statements show the grants and the IP allowlist attached to NORTH_RO, so you can confirm the result before you leave Snowflake.

3

Enter your connection details

Fill in the two fields:

• Connection name. A label to recognize this account by. It becomes the card title on your homepage.
• Account identifier. Your Snowflake account identifier, in ORGID-ACCOUNTID form.

4

Confirm and connect

Select the checkbox confirming you have run the script, then click Connect.

Run the script before you connect. If you connect first, the next data pull fails until the setup SQL is in place.

After You Connect

Snowflake spend appears on your homepage as a card carrying your connection name. See Viewing Cost Loop Data for where else it shows up and at what detail.