> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake

Connect Resolve AI to [Snowflake](https://www.snowflake.com/) to query your warehouses for **database** and **log** data during investigations and chats.

<Info>
  Snowflake connections use **key-pair (RSA) authentication only**. Password and OAuth/API-key authentication are not supported.
</Info>

## Prerequisites

* A Snowflake **service-account user** for Resolve, with key-pair authentication configured (steps below).
* A **role** granted to that user with `USAGE` on the target warehouse and `USAGE`/`SELECT` on every database, schema, and table Resolve should query.
* If your account uses a **network policy**, allow traffic from Resolve AI's cloud or from your [Resolve Satellite](/resolve-satellite)'s egress IP.

## Set up key-pair authentication in Snowflake

<Steps>
  <Step title="Generate an RSA key pair">
    ```shell generate an unencrypted key theme={null}
    openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
    openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
    ```

    For an encrypted key with a passphrase, drop `-nocrypt` and add `-v2 aes-256-cbc`:

    ```shell generate an encrypted key theme={null}
    openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 aes-256-cbc -inform PEM -out rsa_key.p8
    openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
    ```

    See [Snowflake key-pair authentication](https://docs.snowflake.com/en/user-guide/key-pair-auth) for details.
  </Step>

  <Step title="Create the service-account user and register the public key">
    ```sql theme={null}
    CREATE USER RESOLVEAI TYPE = SERVICE;
    ALTER USER RESOLVEAI SET RSA_PUBLIC_KEY = '<public key body, without the BEGIN/END header lines>';
    ```

    <Warning>
      Snowflake validates key-pair logins against the user's **`LOGIN_NAME`**, not its `NAME`. These can diverge — especially after a rename. Run `DESCRIBE USER <user>` and confirm `LOGIN_NAME` exactly matches the username you will enter in Resolve, or authentication fails with `JWT token is invalid`.
    </Warning>
  </Step>

  <Step title="Copy the public key fingerprint">
    ```sql theme={null}
    DESCRIBE USER RESOLVEAI;
    ```

    Copy the `RSA_PUBLIC_KEY_FP` value — it looks like `SHA256:abc123...`. Use this value verbatim; do not compute a fingerprint yourself.
  </Step>

  <Step title="Grant access">
    Grant the service account's role access to the warehouse and data Resolve should query:

    ```sql theme={null}
    GRANT USAGE ON WAREHOUSE <warehouse> TO ROLE <role>;
    GRANT USAGE ON DATABASE <database> TO ROLE <role>;
    GRANT USAGE ON ALL SCHEMAS IN DATABASE <database> TO ROLE <role>;
    GRANT SELECT ON ALL TABLES IN DATABASE <database> TO ROLE <role>;
    ```

    If the role can't see a database, Resolve connects successfully but only sees default databases such as `SNOWFLAKE` and `SNOWFLAKE_SAMPLE_DATA`. Verify with `SHOW GRANTS TO ROLE <role>`.
  </Step>
</Steps>

## Connect Snowflake

### Connection fields

| Field                  | Required | Description                                                                                  |
| ---------------------- | -------- | -------------------------------------------------------------------------------------------- |
| `organizationName`     | Yes      | Snowflake organization name.                                                                 |
| `accountName`          | Yes      | Snowflake account name.                                                                      |
| `url`                  | Yes      | Snowflake account URL, e.g. `https://xy12345.us-east-1.snowflakecomputing.com`.              |
| `username`             | Yes      | The service-account user. Must match the user's `LOGIN_NAME` in Snowflake.                   |
| `privateKey`           | Yes      | The base64 body of the private key only — strip the `-----BEGIN/END PRIVATE KEY-----` lines. |
| `publicKeyFingerprint` | Yes      | The `SHA256:...` value from `DESCRIBE USER` → `RSA_PUBLIC_KEY_FP`.                           |
| `warehouse`            | Yes      | Warehouse Resolve uses to run queries.                                                       |
| `privateKeyPassphrase` | No       | Only if you generated an encrypted private key.                                              |
| `databases`            | No       | Databases Resolve may use for general database queries.                                      |
| `logDatabases`         | No       | Databases containing log data.                                                               |

### Connect from the Resolve UI

1. Open [Snowflake Integration](https://app0.resolve.ai/integrations/snowflake/connect) in Resolve AI.
2. Click **Add Connection**.
3. Enter a **Name** (e.g., `Snowflake-Main`).
4. Leave **Environments** blank to apply to all environments, or list specific ones that match your Satellite config.
5. Fill in the connection fields from the table above.
6. Click **Save**.

The saved private key displays as `***` — that is masking in the UI, not the stored value.

### Connect from the Resolve Satellite

Before setting up this integration on-prem, ensure the [Resolve Satellite](/resolve-satellite) is installed in your environment. Add the integration to your Satellite configuration:

```yaml integrations.yaml theme={null}
integrations:
  snowflakeIntegration:
    type: snowflake
    create: true
    connection:
      organizationName: <organization-name>
      accountName: <account-name>
      url: https://<account>.<region>.snowflakecomputing.com
      username: <service-account-user> # must match LOGIN_NAME
      privateKey: <base64 private key body, headers stripped>
      publicKeyFingerprint: SHA256:<fingerprint from DESCRIBE USER>
      warehouse: <warehouse>
      # privateKeyPassphrase: <passphrase>   # only for encrypted keys
      # databases: ["<database>"]
      # logDatabases: ["<log-database>"]
```

Apply the updated configuration and restart the Resolve Satellite to pick up the new integration. Consider mounting the private key from a Kubernetes secret — see [Secret Management](/secret-management).

## Verify the integration

Once saved, the connection status is shown on the integration page. A green status indicates Resolve AI can authenticate to Snowflake and run test queries.

## Troubleshooting

| Symptom                                                               | Likely Cause                                                                                          | Resolution                                                                                                                                                           |
| --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Health check fails and Snowflake shows **no login attempts**          | The private key can't be parsed on the Resolve side — the request never reaches Snowflake             | Re-paste `privateKey` as the base64 body only, with the `-----BEGIN/END-----` lines and line breaks removed                                                          |
| `401` with `JWT token is invalid` (code `390144`)                     | `username` doesn't match the user's `LOGIN_NAME`, or the fingerprint doesn't match the registered key | Run `DESCRIBE USER` and confirm `LOGIN_NAME` and `RSA_PUBLIC_KEY_FP` exactly match the values in Resolve; after a rename, re-run `ALTER USER ... SET RSA_PUBLIC_KEY` |
| Connects, but Resolve only sees `SNOWFLAKE` / `SNOWFLAKE_SAMPLE_DATA` | The service account's role has no grants on your databases                                            | Grant `USAGE`/`SELECT` as in step 4 and verify with `SHOW GRANTS TO ROLE <role>`                                                                                     |
| Connection times out                                                  | A Snowflake network policy blocks Resolve                                                             | Allow Resolve AI's cloud (or your Satellite's egress IP) in the network policy                                                                                       |