Snowflake Account

The Snowflake account is the container everything else lives in, holding warehouses, databases, and users, addressed by a locator such as xy12345.us-east-1.aws. It has no meter of its own, yet it holds the two numbers that multiply every meter beneath it: the edition, and any capacity commitment negotiated against it.

Edition is the price of a credit

A credit is not a fixed amount of money. Standard, Enterprise, and Business Critical price the identical warehouse-second differently, so the same workload costs materially more on a higher edition. Capacity commitments live at the account level too, trading a spend floor for discounted rates. ZopNight detects the edition once per discovery cycle from SNOWFLAKE.ORGANIZATION_USAGE.ACCOUNTS; when that view is unreadable, which is typical for member and reseller accounts, the edition falls back to empty and downstream pricing defaults to Enterprise.

What the account probe captures

Discovery emits exactly 1 resource per account, built from a cheap SELECT CURRENT_ACCOUNT(), CURRENT_REGION(), CURRENT_ROLE() probe. Network-policy and MFA posture are deliberately not captured: those live behind ORGADMIN-only views the scoped service role does not hold. The cloud provider is derived from the account host rather than queried.

Where the monthly total reconciles

Warehouse credits, storage TB-months, and every serverless stream (Snowpipe, materialized-view refresh, auto-clustering, search optimization) settle here. ZopNight reconciles monthly totals from USAGE_IN_CURRENCY_DAILY and tracks a steady-baseline-credits metric, so a quiet week that still burns credits registers as a baseline worth questioning rather than noise.

Recommendations stay cost-only

Account-level findings are deliberately limited to cost: tagging coverage and warehouse consolidation in the RC-2100 series. Security posture is out of scope for this resource type, both because the signal is unavailable to the scoped role and because mixing the two dilutes ownership of each.

Confirm what discovery would see

SELECT CURRENT_ACCOUNT(), CURRENT_REGION(), CURRENT_ROLE();

Run this as the service user. The three values returned are precisely the identity, placement, and privilege context the account resource records, and a surprising CURRENT_ROLE() here explains most discovery gaps before anything else needs debugging.