> ## Documentation Index > Fetch the complete documentation index at: https://docs.datafold.com/llms.txt > Use this file to discover all available pages before exploring further. # Snowflake > Connect Datafold to Snowflake for data diffing, CI/CD testing, lineage, and migration validation. Includes setup instructions and required permissions. **NOTE**: Datafold needs permissions in your Snowflake dataset to read your table data. You will need to be a Snowflake *Admin* in order to grant the required permissions. **Steps to complete:** * [Create a user and role for Datafold](/integrations/databases/snowflake#create-a-user-and-role-for-datafold) * [Setup password-based](/integrations/databases/snowflake#set-up-password-based-authentication) or [Use key-pair authentication](/integrations/databases/snowflake#use-key-pair-authentication) * [Create a temporary schema](/integrations/databases/snowflake#create-schema-for-datafold) * [Give the Datafold role access to your warehouse](/integrations/databases/snowflake#give-the-datafold-role-access) * [Configure your data connection in Datafold](/integrations/databases/snowflake#configure-in-datafold) ## Create a user and role for Datafold > A [full script](/integrations/databases/snowflake#full-script) can be found at the bottom of this page. It is best practice to create a separate role for the Datafold integration (e.g., `DATAFOLDROLE`): ``` CREATE ROLE DATAFOLDROLE; CREATE USER DATAFOLD DEFAULT_ROLE = "DATAFOLDROLE" MUST_CHANGE_PASSWORD = FALSE; GRANT ROLE DATAFOLDROLE TO USER DATAFOLD; ``` To provide column-level lineage, Datafold needs to read & parse all SQL statements executed in your Snowflake account: ``` GRANT MONITOR EXECUTION ON ACCOUNT TO ROLE DATAFOLDROLE; GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE DATAFOLDROLE; ``` ## Set up password-based authentication Datafold supports username/password authentication, but also key-pair authentication. ``` ALTER USER DATAFOLD SET PASSWORD = 'SomethingSecret'; ``` You can set the username/password in the Datafold web UI. ### Use key-pair authentication If you would like to use key-pair authentication, go to **Settings** -> **Data Connections** -> **Your Snowflake Connection**, and change Authentication method from **Password** to **Key Pair**. Generate and Download the Key Pair file, and use the value within the file when running the following command in Snowflake to set the key for this Snowflake role: ``` ALTER USER DATAFOLD SET rsa_public_key='...' ``` ## Create schema for Datafold Datafold utilizes a temporary dataset to materialize scratch work and keep data processing in the your warehouse. ``` CREATE SCHEMA .DATAFOLD_TMP; GRANT ALL ON SCHEMA .DATAFOLD_TMP TO DATAFOLDROLE; ``` ## Give the Datafold role access Datafold will only scan the tables that it has access to. The snippet below will give Datafold read access to a database. If you have more than one database that you want to use in Datafold, rerun the script below for each one. ```Bash theme={null} /* Repeat for every DATABASE to be usable in Datafold. This allows Datafold to correctly discover, profile & diff each table */ GRANT USAGE ON WAREHOUSE TO ROLE DATAFOLDROLE; GRANT USAGE ON DATABASE TO ROLE DATAFOLDROLE; GRANT USAGE ON ALL SCHEMAS IN DATABASE TO ROLE DATAFOLDROLE; GRANT USAGE ON FUTURE SCHEMAS IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON ALL TABLES IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON FUTURE TABLES IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON ALL VIEWS IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON FUTURE VIEWS IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE TO ROLE DATAFOLDROLE; GRANT ALL PRIVILEGES ON ALL DYNAMIC TABLES IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON FUTURE DYNAMIC TABLES IN DATABASE TO ROLE DATAFOLDROLE; ``` ## Full Script ```Bash theme={null} --Step 1: Create a user and role for Datafold CREATE ROLE DATAFOLDROLE; CREATE USER DATAFOLD DEFAULT_ROLE = "DATAFOLDROLE" MUST_CHANGE_PASSWORD = FALSE; GRANT ROLE DATAFOLDROLE TO USER DATAFOLD; GRANT MONITOR EXECUTION ON ACCOUNT TO ROLE DATAFOLDROLE; GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE DATAFOLDROLE; --Step 2a: Use password-based authentication ALTER USER DATAFOLD SET PASSWORD = 'SomethingSecret'; --OR --Step 2b: Use key-pair authentication --ALTER USER DATAFOLD SET rsa_public_key='abc..' --Step 3: Create schema for Datafold CREATE SCHEMA .DATAFOLD_TMP; GRANT ALL ON SCHEMA .DATAFOLD_TMP TO DATAFOLDROLE; --Step 4: Give the Datafold role access to your data connection /* Repeat for every DATABASE to be usable in Datafold. This allows Datafold to correctly discover, profile & diff each table */ GRANT USAGE ON WAREHOUSE TO ROLE DATAFOLDROLE; GRANT USAGE ON DATABASE TO ROLE DATAFOLDROLE; GRANT USAGE ON ALL SCHEMAS IN DATABASE TO ROLE DATAFOLDROLE; GRANT USAGE ON FUTURE SCHEMAS IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON ALL TABLES IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON FUTURE TABLES IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON ALL VIEWS IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON FUTURE VIEWS IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE TO ROLE DATAFOLDROLE; GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE TO ROLE DATAFOLDROLE; ``` ## Validate Snowflake Grants for Datafold Run these queries to validate that the grants have been set up correctly: > Note: More results may be returned than shown in the screenshots below if you have granted access to multiple roles/users Example Placeholders: * `` = `DEV` * `` = `DEMO` ``` -- Validate database usage for the DATAFOLDROLE SHOW GRANTS ON DATABASE ; ``` ``` -- Validate warehouse usage for the DATAFOLDROLE SHOW GRANTS ON WAREHOUSE ; ``` ``` -- Validate schema permissions for the DATAFOLDROLE SHOW GRANTS ON SCHEMA .DATAFOLD_TMP; ``` ## A note on future grants The above database grants will be insufficient if any future grants have been defined at the schema level, because [schema-level grants will override database-level grants](https://docs.snowflake.com/en/sql-reference/sql/grant-privilege#considerations). In that case, you will need to execute future grants for every existing *schema* that Datafold will operate on. ```Bash theme={null} GRANT SELECT ON FUTURE TABLES IN SCHEMA . TO ROLE DATAFOLDROLE; GRANT SELECT ON FUTURE VIEWS IN SCHEMA . TO ROLE DATAFOLDROLE; GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN SCHEMA . TO ROLE DATAFOLDROLE; GRANT SELECT ON ALL TABLES IN SCHEMA . TO ROLE DATAFOLDROLE; GRANT SELECT ON ALL VIEWS IN SCHEMA . TO ROLE DATAFOLDROLE; GRANT SELECT ON ALL MATERIALIZED VIEWS IN SCHEMA . TO ROLE DATAFOLDROLE; ``` ## Configure in Datafold | Field Name | Description | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name | A name given to the data connection within Datafold | | Account identifier | The Org name-Account name pair for your Snowflake account. This can be found in the browser address string. It may look like [https://orgname-accountname.snowflakecomputing.com](https://orgname-accountname.snowflakecomputing.com) or [https://app.snowflake.com/orgname/accountname](https://app.snowflake.com/orgname/accountname). In the setup form, enter \-\. | | User | The username set in the [Setup password-based](/integrations/databases/snowflake#set-up-password-based-authentication) authentication section | | Password | The password set in the [Setup password-based](/integrations/databases/snowflake#set-up-password-based-authentication) authentication section | | Key Pair file | The key file generated in the [Use key-pair authentication](/integrations/databases/snowflake#use-key-pair-authentication) section | | Warehouse | The Snowflake warehouse name | | Schema for temporary tables | The schema name you created with our script (\.DATAFOLD\_TMP) | | Role | The role you created for Datafold (Typically DATAFOLDROLE) | | Default DB | A database the role above can access. If more than one database was added, whichever you prefer to be the default | > Note: Please review the documentation for the account name. Datafold uses Format 1 (Preferred): [https://docs.snowflake.com/en/user-guide/admin-account-identifier#using-an-account-locator-as-an-identifier](https://docs.snowflake.com/en/user-guide/admin-account-identifier#using-an-account-locator-as-an-identifier) Click **Create**. Your data connection is ready!