Snowflake - Resolve AI

Connect Resolve AI to Snowflake to query your warehouses for database and log data during investigations and chats.

Snowflake connections use key-pair (RSA) authentication only. Password and OAuth/API-key authentication are not supported.

Prerequisites

A Snowflake service-account user for Resolve, with key-pair authentication configured (steps below).
A role granted to that user with USAGE on the target warehouse and USAGE/SELECT on every database, schema, and table Resolve should query.
If your account uses a network policy, allow traffic from Resolve AI’s cloud or from your Resolve Satellite’s egress IP.

Set up key-pair authentication in Snowflake

Generate an RSA key pair

generate an unencrypted key

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

For an encrypted key with a passphrase, drop -nocrypt and add -v2 aes-256-cbc:

generate an encrypted key

openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 aes-256-cbc -inform PEM -out rsa_key.p8
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

See Snowflake key-pair authentication for details.

Create the service-account user and register the public key

CREATE USER RESOLVEAI TYPE = SERVICE;
ALTER USER RESOLVEAI SET RSA_PUBLIC_KEY = '<public key body, without the BEGIN/END header lines>';

Snowflake validates key-pair logins against the user’s LOGIN_NAME, not its NAME. These can diverge — especially after a rename. Run DESCRIBE USER <user> and confirm LOGIN_NAME exactly matches the username you will enter in Resolve, or authentication fails with JWT token is invalid.

Copy the public key fingerprint

DESCRIBE USER RESOLVEAI;

Copy the RSA_PUBLIC_KEY_FP value — it looks like SHA256:abc123.... Use this value verbatim; do not compute a fingerprint yourself.

Grant access

Grant the service account’s role access to the warehouse and data Resolve should query:

GRANT USAGE ON WAREHOUSE <warehouse> TO ROLE <role>;
GRANT USAGE ON DATABASE <database> TO ROLE <role>;
GRANT USAGE ON ALL SCHEMAS IN DATABASE <database> TO ROLE <role>;
GRANT SELECT ON ALL TABLES IN DATABASE <database> TO ROLE <role>;

If the role can’t see a database, Resolve connects successfully but only sees default databases such as SNOWFLAKE and SNOWFLAKE_SAMPLE_DATA. Verify with SHOW GRANTS TO ROLE <role>.

Connect Snowflake

Connection fields

Field	Required	Description
`organizationName`	Yes	Snowflake organization name.
`accountName`	Yes	Snowflake account name.
`url`	Yes	Snowflake account URL, e.g. `https://xy12345.us-east-1.snowflakecomputing.com`.
`username`	Yes	The service-account user. Must match the user’s `LOGIN_NAME` in Snowflake.
`privateKey`	Yes	The base64 body of the private key only — strip the `-----BEGIN/END PRIVATE KEY-----` lines.
`publicKeyFingerprint`	Yes	The `SHA256:...` value from `DESCRIBE USER` → `RSA_PUBLIC_KEY_FP`.
`warehouse`	Yes	Warehouse Resolve uses to run queries.
`privateKeyPassphrase`	No	Only if you generated an encrypted private key.
`databases`	No	Databases Resolve may use for general database queries.
`logDatabases`	No	Databases containing log data.

Connect from the Resolve UI

Open Snowflake Integration in Resolve AI.
Click Add Connection.
Enter a Name (e.g., Snowflake-Main).
Leave Environments blank to apply to all environments, or list specific ones that match your Satellite config.
Fill in the connection fields from the table above.
Click Save.

The saved private key displays as *** — that is masking in the UI, not the stored value.

Connect from the Resolve Satellite

Before setting up this integration on-prem, ensure the Resolve Satellite is installed in your environment. Add the integration to your Satellite configuration:

integrations.yaml

integrations:
  snowflakeIntegration:
    type: snowflake
    create: true
    connection:
      organizationName: <organization-name>
      accountName: <account-name>
      url: https://<account>.<region>.snowflakecomputing.com
      username: <service-account-user> # must match LOGIN_NAME
      privateKey: <base64 private key body, headers stripped>
      publicKeyFingerprint: SHA256:<fingerprint from DESCRIBE USER>
      warehouse: <warehouse>
      # privateKeyPassphrase: <passphrase>   # only for encrypted keys
      # databases: ["<database>"]
      # logDatabases: ["<log-database>"]

Apply the updated configuration and restart the Resolve Satellite to pick up the new integration. Consider mounting the private key from a Kubernetes secret — see Secret Management.

Verify the integration

Once saved, the connection status is shown on the integration page. A green status indicates Resolve AI can authenticate to Snowflake and run test queries.

Troubleshooting

Symptom	Likely Cause	Resolution
Health check fails and Snowflake shows no login attempts	The private key can’t be parsed on the Resolve side — the request never reaches Snowflake	Re-paste `privateKey` as the base64 body only, with the `-----BEGIN/END-----` lines and line breaks removed
`401` with `JWT token is invalid` (code `390144`)	`username` doesn’t match the user’s `LOGIN_NAME`, or the fingerprint doesn’t match the registered key	Run `DESCRIBE USER` and confirm `LOGIN_NAME` and `RSA_PUBLIC_KEY_FP` exactly match the values in Resolve; after a rename, re-run `ALTER USER ... SET RSA_PUBLIC_KEY`
Connects, but Resolve only sees `SNOWFLAKE` / `SNOWFLAKE_SAMPLE_DATA`	The service account’s role has no grants on your databases	Grant `USAGE`/`SELECT` as in step 4 and verify with `SHOW GRANTS TO ROLE <role>`
Connection times out	A Snowflake network policy blocks Resolve	Allow Resolve AI’s cloud (or your Satellite’s egress IP) in the network policy

​Prerequisites

​Set up key-pair authentication in Snowflake

​Connect Snowflake

​Connection fields

​Connect from the Resolve UI

​Connect from the Resolve Satellite

​Verify the integration

​Troubleshooting

Prerequisites

Set up key-pair authentication in Snowflake

Connect Snowflake

Connection fields

Connect from the Resolve UI

Connect from the Resolve Satellite

Verify the integration

Troubleshooting