Snowflake
Snowflake
Scan Snowflake tables and views with flexible authentication.
- Category
- Warehouse & Lakehouse
- Source type
- SNOWFLAKE
- Produces
- table
Snowflake is where a lot of organisations concentrate everything — the customer records, the event stream, the third-party data, the exports nobody remembers requesting. Scanning it usually produces the largest single picture of where sensitive data actually lives.
What you need to connect
An account identifier (for example xy12345.us-east-2.aws) and one of four
authentication methods:
| Method | What you supply | Use it when |
|---|---|---|
| Password | Username and password | Simplest; fine for a dedicated service user |
| Key pair | Username and a private key PEM | Recommended — no password to rotate, and what Snowflake pushes for service accounts |
| OAuth token | An OAuth access token | Your identity provider issues short-lived tokens |
| External browser | Username only, browser-based SSO | Interactive use against an SSO-protected account |
Point the source at a warehouse and a role. Give that role USAGE on
the warehouse and databases plus SELECT on the objects you want scanned —
nothing more. Scanning consumes warehouse credits, and the sampling strategy is
what keeps that bill small.
What Classifyre reads
Tables and views, in one database or every database the role can see, scoped by schema allow- and denylists or by an explicit object list.
Shared behaviour · SQL databases
One asset per table or view, never one per row. The asset carries the table's structure — database, schema, table name, object type, its columns and their types, and a row-count estimate — and its content is a sample of real rows, formatted so a detector reads actual values rather than a schema dump.
How many rows, and which ones, is entirely up to the sampling strategy. Large tables are paged through by key rather than by OFFSET, so a scan that stops halfway can resume from where it left off instead of re-reading from the top.
Read-only throughout. The connector issues catalog queries and bounded SELECTs. Nothing is written back, and a read-only account is the right account to give it.
Relationships come out of the engine's own catalog: foreign keys are recorded as REFERENCE links — useful, but they move no data, so they never become a lineage hop, and a view and the tables it reads from are recorded as FLOW — real lineage, with column-level detail parsed out of the view's SQL where the SQL makes that possible. See Lineage.
Metadata on every asset
Asset kind · table
| Field | Type | Always present | What it is |
|---|---|---|---|
| database | string | Yes | Database or catalog name |
| table_name | string | Yes | Table name |
| table_type | string | Yes | Object type (TABLE/VIEW) |
| schema | string | No | Schema name |
| columns | object[] | No | Columns as {name, type} objects |
| row_count | integer | No | Estimated number of rows |
| account_id | string | No | Snowflake account identifier |
| object_type | string | No | Source object type |
| lineage | object | No | Lineage extraction settings and time window |
Lineage
Lineage
Snowflake’s dependency metadata is read where the role has access to it, giving both view lineage (a view and the objects it reads) and table lineage. You can set a start time to bound how far back the lineage history is read.
Snowflake folds unquoted identifiers to upper case; Classifyre names objects the
same way, which is what lets a Tableau workbook pointing at
PROD.PUBLIC.ORDERS line up with the table a Snowflake scan produced. See
Lineage & Relationships.
Worth knowing
- Lineage needs privileges. Dependency and access history live in
SNOWFLAKE.ACCOUNT_USAGE; a role without access to those views produces assets but no lineage, and the scan continues rather than failing. - Warehouse cost is under your control. Sampling caps how many rows each scan reads; a small warehouse with auto-suspend is the usual setup.
- China regions need the alternate domain suffix, which is a setting.
Configuration
Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the detectors to run, the scan schedule, and the compute limits for its scan jobs.
Required
Without these, the source will not save.
This section depends on which authentication method you pick — one of the following applies.
Snowflake Default Authenticator
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| authentication_type | "DEFAULT_AUTHENTICATOR" | Yes | — | — |
| account_id | string | Yes | Snowflake account identifier (for example, xy12345.us-east-2.aws or LMAUONV-ONE_DATA_DEV) | — |
Snowflake External Browser
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| authentication_type | "EXTERNAL_BROWSER_AUTHENTICATOR" | Yes | — | — |
| account_id | string | Yes | Snowflake account identifier (for example, xy12345.us-east-2.aws or LMAUONV-ONE_DATA_DEV) | — |
Snowflake Key-Pair Authentication
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| authentication_type | "KEY_PAIR_AUTHENTICATOR" | Yes | — | — |
| account_id | string | Yes | Snowflake account identifier (for example, xy12345.us-east-2.aws or LMAUONV-ONE_DATA_DEV) | — |
Snowflake OAuth Token
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| authentication_type | "OAUTH_AUTHENTICATOR_TOKEN" | Yes | — | — |
| account_id | string | Yes | Snowflake account identifier (for example, xy12345.us-east-2.aws or LMAUONV-ONE_DATA_DEV) | — |
Secrets
Stored encrypted and never shown again after you save them. See Configuration & Fields.
This section depends on which authentication method you pick — one of the following applies.
Snowflake Default Authenticator
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| username | string | Yes | Snowflake login username | — |
| password | string | Yes | Snowflake login password | — |
Snowflake External Browser
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| username | string | Yes | Snowflake login username | — |
Snowflake Key-Pair Authentication
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| username | string | Yes | Snowflake login username | — |
| private_key | string | Yes | Snowflake private key PEM content. You can pass escaped newlines (\n). | — |
| private_key_password | string | No | Password for encrypted private key PEM (optional when key is not encrypted). | — |
Snowflake OAuth Token
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| username | string | Yes | Snowflake login username | — |
| token | string | Yes | OAuth bearer token for Snowflake authentication | — |
Optional
Everything you can tune. Sensible defaults apply when you leave them alone.
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| optional | object | No | —no extra properties | — |
| connection | object | No | Snowflake connection and session tuning options.no extra properties | — |
| connection.connect_args | object | No | Additional snowflake.connector.connect keyword arguments (advanced usage). | {} |
| connection.connect_timeout_seconds | integer | No | Connection timeout in secondsmin 1, max 300 | 15 |
| connection.role | string | No | Snowflake role to use for metadata and sampling queries | — |
| connection.snowflake_domain | string | No | Snowflake domain suffix (use snowflakecomputing.cn for China regions). | snowflakecomputing.com |
| connection.warehouse | string | No | Snowflake warehouse to use for metadata and sampling queries | — |
| extraction | object | No | Lineage extraction controls for Snowflake metadata ingestion.no extra properties | — |
| extraction.include_table_lineage | boolean | No | Include table-level lineage links when dependency metadata is accessible. | true |
| extraction.include_view_lineage | boolean | No | Include view-to-table/view lineage links when dependency metadata is accessible. | true |
| extraction.start_time | string | No | Optional lineage lower bound timestamp (ISO 8601).format date-time | — |
| scope | object | No | Database, schema, and object selection scope.no extra properties | — |
| scope.database | string | No | Single database to scan (optional when include_all_databases is true) | — |
| scope.exclude_databases | array | No | Database denylist (exact database names) | ["SNOWFLAKE","SNOWFLAKE_SAMPLE_DATA"] |
| scope.exclude_databases[] | string | No | — | — |
| scope.exclude_schemas | array | No | Schema denylist (exact schema names) | ["INFORMATION_SCHEMA"] |
| scope.exclude_schemas[] | string | No | — | — |
| scope.include_all_databases | boolean | No | Scan all visible databases except excluded system databases | false |
| scope.include_objects | array | No | Optional object allowlist. Accepted forms: schema.object or database.schema.object | — |
| scope.include_objects[] | string | No | — | — |
| scope.include_schemas | array | No | Optional schema allowlist (exact schema names) | — |
| scope.include_schemas[] | string | No | — | — |
| scope.include_tables | boolean | No | Include table assets in extraction | true |
| scope.include_views | boolean | No | Include view assets in extraction | true |
| scope.table_limit | integer | No | Optional cap on number of table/view assets extractedmin 1 | — |