Connect Snowflake to StackSpend

Step 0: Gather the values you will paste into StackSpend

In Snowflake (Projects → Query data), run these two commands first:

SELECT LOWER(CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME()) AS account_identifier;

SHOW WAREHOUSES;

Then run this verification block:

-- Account Identifier (recommended format)
SELECT LOWER(CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME()) AS account_identifier;

-- Find available warehouses
SHOW WAREHOUSES;

-- Verify billed-currency view exists and is accessible
SHOW DATABASES LIKE 'SNOWFLAKE';
SHOW SCHEMAS LIKE 'ORGANIZATION_USAGE' IN DATABASE SNOWFLAKE;
SHOW VIEWS LIKE 'USAGE_IN_CURRENCY_DAILY' IN SCHEMA SNOWFLAKE.ORGANIZATION_USAGE;

SELECT * FROM SNOWFLAKE.ORGANIZATION_USAGE.USAGE_IN_CURRENCY_DAILY LIMIT 10;

Use the account identifier result, one warehouse name from SHOW WAREHOUSES, and your role in StackSpend.

Step 1: Create service user and base grants

To be completed by a Snowflake admin. In Snowflake, open Snowsight → Projects → Query data (or click + to create a SQL file). Run:

USE ROLE ACCOUNTADMIN;

CREATE USER IF NOT EXISTS stackspend_service_user
  DEFAULT_WAREHOUSE = COMPUTE_WH
  DEFAULT_ROLE = ORGADMIN
  MUST_CHANGE_PASSWORD = FALSE;

GRANT ROLE ORGADMIN TO USER stackspend_service_user;
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE ORGADMIN;

SHOW USERS LIKE 'STACKSPEND_SERVICE_USER';

Replace ORGADMIN and COMPUTE_WH with your organization's role and warehouse names if different.

Step 2: Generate key files on your computer

Open Terminal and run:

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

This creates rsa_key.p8 (private key) and rsa_key.pub (public key) in your current terminal folder.

To find them immediately, run:

pwd
ls -lah rsa_key.p8 rsa_key.pub

Optional (Mac): copy private key to clipboard with pbcopy < rsa_key.p8.

Step 3: Attach your public key to the service user

To be completed by a Snowflake admin. Open rsa_key.pub, copy the key text between BEGIN PUBLIC KEY and END PUBLIC KEY, and run:

ALTER USER stackspend_service_user
SET RSA_PUBLIC_KEY = '<PASTE_PUBLIC_KEY_HERE>';

Step 4: Confirm billed-currency view access

To be completed by a Snowflake admin. Confirm this user can query SNOWFLAKE.ORGANIZATION_USAGE.USAGE_IN_CURRENCY_DAILY.

Step 5: Add Snowflake in StackSpend

1. Go to Settings → Providers → Add Provider → Snowflake
2. Enter Account Identifier (example: xy12345.us-east-1)
3. Enter Username: stackspend_service_user
4. Enter Warehouse: COMPUTE_WH (or your admin-provided value)
5. Enter Role: ORGADMIN (or your admin-provided role)
6. Set Authentication Method to Key-pair (this must be selected to show the private key field)
7. Paste the full contents of rsa_key.p8 into Private Key
8. Click Test Connection
9. If test passes, click Save. If test fails, copy the full error and resolve it in Snowflake first.

Reference SQL (admin-only tasks)

USE ROLE ACCOUNTADMIN;

CREATE USER IF NOT EXISTS stackspend_service_user
  DEFAULT_WAREHOUSE = COMPUTE_WH
  DEFAULT_ROLE = ORGADMIN
  MUST_CHANGE_PASSWORD = FALSE;

GRANT ROLE ORGADMIN TO USER stackspend_service_user;
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE ORGADMIN;

SHOW USERS LIKE 'STACKSPEND_SERVICE_USER';

ALTER USER stackspend_service_user
SET RSA_PUBLIC_KEY = '<PASTE_PUBLIC_KEY_HERE>';