Skip to content

Connect Snowflake to Infograph

What it brings in: Every table and view the user can read.

Connect Snowflake 4 steps to set up

What you need

  • A role that can create users and roles and grant access, such as SECURITYADMIN, or ACCOUNTADMIN.
  • A warehouse for Infograph's sync queries, and the database and schema you want to sync. Each connection reads one schema.
  • OpenSSL, to make a key pair. Snowflake is blocking password sign-ins for service users through 2026, so use a key.
  • Infograph's sync servers connect from 51.222.152.247.

Steps

  1. Make a key pair

    Run this on your own machine. It writes a private key, rsa_key.p8, and its public key, rsa_key.pub. To protect the private key with a passphrase, replace -nocrypt with -v2 aes-256-cbc and enter one when asked.

    openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

  2. Create a read-only role and user

    Infograph only reads. Give it its own role and service user so you can see and revoke its access in one place. Run this in a worksheet with your own warehouse, database and schema names. For the public key, paste the contents of rsa_key.pub without the BEGIN PUBLIC KEY and END PUBLIC KEY lines. The FUTURE grants cover tables and views created later.

    USE ROLE SECURITYADMIN;
CREATE ROLE infograph_reader;
GRANT USAGE ON WAREHOUSE [warehouse] TO ROLE infograph_reader;
GRANT USAGE ON DATABASE [database] TO ROLE infograph_reader;
GRANT USAGE ON SCHEMA [database].[schema] TO ROLE infograph_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA [database].[schema] TO ROLE infograph_reader;
GRANT SELECT ON ALL VIEWS IN SCHEMA [database].[schema] TO ROLE infograph_reader;
GRANT SELECT ON FUTURE TABLES IN SCHEMA [database].[schema] TO ROLE infograph_reader;
GRANT SELECT ON FUTURE VIEWS IN SCHEMA [database].[schema] TO ROLE infograph_reader;
CREATE USER infograph
  TYPE = SERVICE
  RSA_PUBLIC_KEY = '[public-key]'
  DEFAULT_ROLE = infograph_reader
  DEFAULT_WAREHOUSE = [warehouse];
GRANT ROLE infograph_reader TO USER infograph;

  3. Find your account identifier

    In Snowsight, select your user name to open the user menu, then select Connect a tool to Snowflake. The account details show your account identifier, in the form orgname-accountname. Pasting your full Snowflake URL also works. In a worksheet, this returns the same:

    SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME();

  4. Enter the details in Infograph and choose your tables

    Open Snowflake in Infograph. Enter the account identifier, INFOGRAPH as the username, and paste the whole of rsa_key.p8, including its BEGIN and END lines, into Private Key. Fill in Private Key Passphrase only if you set one. Enter the database, schema and warehouse, and infograph_reader as the role or leave Role blank to use the default role. Press Connect, pick the tables you want, and Infograph starts loading them.

    Connect

Troubleshooting

Each entry is the message Infograph shows when a connection fails. Open it for the fix.

Those credentials were not accepted.

Check the account identifier first: it is orgname-accountname, or your account locator with its region, such as xy12345.us-east-2.aws. Then check the private key is the one whose public key you set on this user, pasted whole with its BEGIN and END lines, and that the passphrase matches if the key is encrypted. In a worksheet, DESC USER infograph shows the key's fingerprint in RSA_PUBLIC_KEY_FP. A password only works for a user Snowflake still allows to sign in with one, and service users cannot. Also check the user is not disabled, and that it has been granted the role in Role, or a default role if Role is blank.

Common problems

These happen in Snowflake itself, where Infograph cannot see them.

A table or view is missing

Infograph lists the tables and views in the one schema you entered, as the role can see them. Check the schema name, and that the role has SELECT on the table: a table created before the FUTURE grants needs GRANT SELECT ON ALL TABLES run again. Then open the connection and press Re-discover streams.

Syncs fail on the warehouse

Infograph lists your tables without a warehouse, so connecting can work while syncs fail. The role needs USAGE on the warehouse you entered, and the warehouse must be running or have auto-resume on, which a new warehouse does by default. Check with SHOW WAREHOUSES.

A network policy blocks Infograph

If your account or user has a network policy, Snowflake refuses sign-ins from addresses it does not allow. Add 51.222.152.247 to the network rule or allowed IP list the policy uses, or give the infograph user its own policy that allows them.

Warehouse credits from syncs

Each sync runs queries on your warehouse, which uses credits while it runs. Listing your tables does not. Use a small warehouse with a short auto-suspend, pick only the tables you need, and use a less frequent schedule for large ones.