Connect Snowflake to Rig

Before you start

• A Snowflake role that can create users and roles, such as one with the CREATE USER privilege on the account.
• The account identifier for your Snowflake account, in the form ab12345.eu-west-1.
• A virtual warehouse that Rig can use to run queries, and the database it should read.
• A workspace owner, or a role with the Manage connections permission, in Rig.

Step 1: Create a Snowflake user for Rig

Run these statements in a Snowflake worksheet. Create the user as a service user, which is meant for software that signs in without a person.

1. Create a role for Rig and grant it the right to use your warehouse and read the databases, schemas and tables Rig should see. Keep it read-only.
2. Create the user with CREATE USER rig_reader TYPE = SERVICE DEFAULT_ROLE = <your role>, then grant the role to the user. Change the name to suit.
3. In a terminal, generate a private key with openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt. The Rig form has no passphrase field, so use the unencrypted form shown here.
4. Generate the public key with openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub.
5. Register the public key on the user with ALTER USER rig_reader SET RSA_PUBLIC_KEY = '<key without the BEGIN and END lines>'. You need a role that can alter the user, such as SECURITYADMIN, to do this.

Step 2: Create a separate write user if Rig should ingest

Skip this step if Rig only needs to read.

1. Repeat the user steps for a second user and role, and give that role the privileges to create and write tables in the database Rig will load into.
2. Use a different key pair for this user. Rig refuses a write credential that matches the read one.

Step 3: Connect it in Rig

Adding a source needs a workspace owner, or a role with the Manage connections permission, on a workspace where you manage your own connections. If the Connectors tab says “Data ingestion for this workspace is managed by Rig”, ask an owner or Rig support to add the source.

1. In Rig, open Connections. On a workspace with no warehouse yet, the page shows a Set up your warehouse card. Choose Bring your own warehouse.
2. If the workspace already has a warehouse, open the Warehouse stage, click Change warehouse, choose Bring your own and pick the type. Your connected sources and schedules are kept, and data already synced is not copied across, so re-sync afterwards.
3. Choose Snowflake as the Warehouse type.
4. Account identifier: your account locator, such as ab12345.eu-west-1, without the https:// and snowflakecomputing.com parts.
5. Database: the database Rig should read.
6. Warehouse: the virtual warehouse Rig runs queries on.
7. Role (optional): the role you created. Leave it blank to use the user's default role.
8. Username: the user you created, for example rig_reader.
9. Private key (PEM, optional): paste the contents of rsa_key.p8, including the BEGIN and END lines. Leave Password (or leave blank for key-pair auth) empty when you use a key. Rig needs one of the two.
10. The credential fields appear once for the read credential, labelled with a (read) suffix. Rig only reads your warehouse unless you add a write credential.
11. To let Rig also sync your connected tools into this warehouse, switch on Let Rig ingest data into this warehouse and fill the same credential fields again, now labelled (write / ingestion). The write credential must differ from the read one, and Rig blocks the form if they match.
12. Click Provision workspace. Rig stores the credentials in AWS Secrets Manager and does not echo them back.
13. To rotate a credential later, open the Warehouse stage and click Update credentials. Fill in only what you want to change and leave the rest blank.

What Rig reads

• Databases, schemas and tables: Rig reads the structure of the database you name and builds its context layer from it.
• Views and dbt models: Views and the tables dbt builds are read like any other table, and dbt lineage is kept alongside them.
• Query results: Questions run as Snowflake SQL on the warehouse you named, and results go to the person asking.
• Ingested sources: Only if you add a write credential, Rig also creates schemas in the database for the tools you sync.

Without a write credential Rig does not create or change anything in Snowflake.

Good to know

• Queries use the credits of the Warehouse you enter, so pick one sized for analysts rather than for heavy loads.
• The Role (optional) field falls back to the user's default role. Name a dedicated role if the user holds several. Rig then sees only what that role can read.
• Snowflake keeps the previous key valid for 24 hours after ROTATE KEY PAIR by default, which gives you time to paste the new key into Update credentials.
• Keys and passwords are stored in AWS Secrets Manager and are never logged.

What people use this for

• Let business teams query Snowflake without writing SQL
• Explore Snowflake data inside Claude, Cursor or ChatGPT
• Control Snowflake cost and access with row-level governance
• Trace a metric back to its dbt model and source

More ideas for using Snowflake

Snowflake documentation

• Snowflake key-pair authentication
• Snowflake CREATE USER