> For the complete documentation index, see [llms.txt](https://docs.north.cloud/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.north.cloud/docs/features/cost-loops/snowflake.md). # Snowflake Learn how to connect your Snowflake account to North as a Cost Loop. Setup the Snowflake Cost Loop integration in North to see your wrehouse compute and storage spend. North authenticates with Snowflake as a dedicated read-only service user, using an RSA key pair. North generates the key pair in your browser and builds a setup script that already carries your public key. You run that script once in Snowflake. North keeps the private key. ## Before You Start You need a Snowflake user that holds both **ORGADMIN** and **ACCOUNTADMIN**. If you do not hold ORGADMIN, you can still complete the setup. Only the first three statements in the script need it, and they run once per account. Ask your organization administrator to run those three, delete them from your copy, then run the rest yourself as ACCOUNTADMIN. You also need your Snowflake account identifier. Use the `ORGID-ACCOUNTID` form, for example `MYORG-PROD01`. The legacy `locator.region.cloud` form still works. ## What the Script Creates The script is idempotent. You can run it again safely, and re-running never removes the registered public key. | Object | Purpose | | ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `NORTH_RO_WH` warehouse | An XSMALL warehouse used only by the service user. It auto-suspends after 60 seconds and resumes on demand. | | `NORTH_RO` role | The read-only role North uses. | | `NORTH` database and `NORTH.PUBLIC` schema | Holds the secure views North reads through. | | `NORTH_RO` user | The service identity. It is created with `TYPE = SERVICE`, so password authentication is structurally impossible and human MFA policies do not apply to it. | | Secure views in `NORTH.PUBLIC` | Column-pruned wrappers over Snowflake's own usage and billing views. | | `NORTH_RO_NETWORK_POLICY` | Restricts the service user to North's egress IP addresses. It applies to `NORTH_RO` only. Your own users and administrators are unaffected. | ## What North Can and Cannot Read North connects only as `NORTH_RO`, and that role has no direct access to `SNOWFLAKE.*`. It reads the secure wrapper views instead, and those views are built to exclude sensitive columns. **Excluded from every view:** `QUERY_TEXT`, `USER_NAME`, and per-user Cortex identifiers. North sees query identifiers and resource metrics for attribution. North does not see the SQL you ran or who ran it. **Bounded to 365 days.** Every time-based view is filtered to the last 365 days. The views cover organization billing, rates, and balances; warehouse and serverless compute; storage; data transfer; query-level attribution; and Cortex AI usage. Some views depend on your Snowflake edition or region. The script skips any source that does not exist on your account rather than failing, and reports which views it created and which it skipped. ## Connect Snowflake {% stepper %} {% step %} ### Open the connect screen Open **Settings**, then **Integrations**, then **Add accounts**. Under **Cost Loops**, select **Snowflake**. North generates your RSA key pair at this point and fills your public key into the script shown on screen. {% endstep %} {% step %} ### Run the setup script in Snowflake Click **Copy**. Open a Snowflake worksheet and run the whole script as a user holding both ORGADMIN and ACCOUNTADMIN. The script's final statements show the grants and the IP allowlist attached to `NORTH_RO`, so you can confirm the result before you leave Snowflake. {% endstep %} {% step %} ### Enter your connection details Fill in the two fields: * **Connection name.** A label to recognize this account by. It becomes the card title on your homepage. * **Account identifier.** Your Snowflake account identifier, in `ORGID-ACCOUNTID` form. {% endstep %} {% step %} ### Confirm and connect Select the checkbox confirming you have run the script, then click **Connect**. {% hint style="warning" %} Run the script before you connect. If you connect first, the next data pull fails until the setup SQL is in place. {% endhint %} {% endstep %} {% endstepper %} ## After You Connect Snowflake spend appears on your homepage as a card carrying your connection name. See [Viewing Cost Loop Data](/docs/features/cost-loops/viewing-cost-loop-data.md) for where else it shows up and at what detail. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.north.cloud/docs/features/cost-loops/snowflake.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.