Snowflake permissions
What access does ZopNight need on Snowflake?
Snowflake is the smallest grant in the platform: just 6 permissions across 2 roles. ZOPNIGHT_READ_ROLE reads ACCOUNT_USAGE for warehouse metering and runs SHOW WAREHOUSES for inventory. ZOPNIGHT_WRITE_ROLE adds exactly one capability, which is suspending and resuming a virtual warehouse on a schedule.
account
| Action | Access | Purpose |
|---|---|---|
| IMPORTED_PRIVILEGES_ON_DATABASE_SNOWFLAKE | cost | |
| MONITOR_USAGE_ON_ACCOUNT | cost | |
| SHOW_GRANTS | discovery |
warehouse
| Action | Access | Purpose |
|---|---|---|
| MONITOR_ON_WAREHOUSE | discovery | |
| USAGE_ON_WAREHOUSE | discovery | |
| OPERATE_ON_WAREHOUSE | scheduling |
ZOPNIGHT_READ_ROLE and ZOPNIGHT_WRITE_ROLE
Snowflake is the smallest grant in the platform: six permissions, five read and one write. There is no IAM here. Access is a Snowflake role, granted to a dedicated service user.
ZOPNIGHT_READ_ROLE covers everything except acting: it reads SNOWFLAKE.ACCOUNT_USAGE for
warehouse metering and storage, and runs SHOW WAREHOUSES for inventory. ZOPNIGHT_WRITE_ROLE
adds exactly one capability: suspending and resuming a virtual warehouse on a schedule.
Key pair or PAT?
Both are supported, and both ship as ready-made SQL setup scripts in read-only and read-write flavours, so you can review exactly what you are granting before you run it.
- Key pair: an RSA key pair on the service user. No shared secret transits, and rotation is
a
ALTER USERaway. - Programmatic access token: simpler to issue, and revocable from the Snowflake UI.
What it costs you to connect read-only
Nothing that runs a query costs nothing on Snowflake, and it is fair to ask. The SHOW commands
are metadata operations and run without a warehouse. ACCOUNT_USAGE queries do need one: the
setup script creates an X-Small ZOPNIGHT_OPS_WH with AUTO_SUSPEND = 60, so it bills only
while discovery queries run (Snowflake bills at least 60 seconds each time a warehouse resumes)
and then suspends. Logins and metadata commands also use cloud-services credits, which Snowflake
bills only above 10% of the day’s warehouse compute. If you leave the warehouse field
empty, ZopNight falls back to COMPUTE_WH. Read-only use costs a small number of credits.
What the write role will and will not do
It suspends a warehouse after checking WAREHOUSE_LOAD_HISTORY, and resumes it on schedule.
It never drops a warehouse, never resizes one, and never touches a database, schema or table.
System warehouses prefixed SYSTEM$ are excluded from scheduling entirely.
Snowflake permissions: common questions
Does connecting ZopNight read-only consume Snowflake credits?
A little. SHOW WAREHOUSES runs without a warehouse, but SNOWFLAKE.ACCOUNT_USAGE queries need one, so the setup script creates an X-Small ZOPNIGHT_OPS_WH that auto-suspends after 60 seconds. Logins and metadata commands also use cloud-services credits, which Snowflake bills only above 10% of the day's warehouse compute. It is a fair question, because on Snowflake very little else is free.
What can ZOPNIGHT_WRITE_ROLE actually do?
One thing: suspend a virtual warehouse after checking WAREHOUSE_LOAD_HISTORY, and resume it on schedule. It never drops a warehouse, never resizes one, and never touches a database, schema or table. Warehouses prefixed SYSTEM$ are excluded entirely.
Key pair or programmatic access token?
Key pair means no shared secret transits, and rotation is one ALTER USER away. A programmatic access token is simpler to issue and revocable from the Snowflake UI. Both ship as ready-made SQL setup scripts in read-only and read-write flavours, so you can review the grant before running it.