Managed Snowflake Setup

Snowflake setup is Vendo-led. Create a dedicated role and service identity, then coordinate the final authentication and network settings with Vendo.

Before you start

• Select the virtual warehouse and set appropriate auto-suspend and resource controls.
• Identify the database, schemas, tables, and views Vendo needs.
• Create a dedicated role and service user.
• Choose key-pair or another organization-approved authentication method.

Example read-only grants

Adapt object names and future-grant policy to your governance requirements:

CREATE ROLE IF NOT EXISTS VENDO_READER;
GRANT USAGE ON WAREHOUSE MY_WAREHOUSE TO ROLE VENDO_READER;
GRANT USAGE ON DATABASE MY_DATABASE TO ROLE VENDO_READER;
GRANT USAGE ON SCHEMA MY_DATABASE.ANALYTICS TO ROLE VENDO_READER;
GRANT SELECT ON ALL TABLES IN SCHEMA MY_DATABASE.ANALYTICS TO ROLE VENDO_READER;
GRANT SELECT ON ALL VIEWS IN SCHEMA MY_DATABASE.ANALYTICS TO ROLE VENDO_READER;

Review future grants separately; automatically granting new objects can expand access beyond the approved scope.

Connect with Vendo

1. Share the non-secret account identifier, warehouse, database, schema, and role.
2. Agree on authentication and any network-policy allowlist.
3. Apply the reviewed grants.
4. Transfer the private credential through the approved secret channel.
5. Ask Vendo to test object discovery and one bounded query.

Verify

1. Use SHOW GRANTS TO ROLE VENDO_READER to inspect effective access.
2. Confirm only approved objects appear in Vendo.
3. Run the same small query in Snowflake and Vendo.
4. Compare values and inspect Snowflake query history.
5. Record the key-rotation and access-review owners.

Troubleshooting

Related

• Snowflake overview
• Custom Integrations