Snowflake permissions
What access does ZopNight need on Snowflake?
Snowflake is the smallest grant in the platform: just 6 permissions across 2 roles. ZOPNIGHT_READ_ROLE reads ACCOUNT_USAGE for warehouse metering and runs SHOW WAREHOUSES for inventory. ZOPNIGHT_WRITE_ROLE adds exactly one capability, which is suspending and resuming a virtual warehouse on a schedule.
account
| Action | Access | Purpose |
|---|---|---|
| IMPORTED_PRIVILEGES_ON_DATABASE_SNOWFLAKE | cost | |
| MONITOR_USAGE_ON_ACCOUNT | cost | |
| SHOW_GRANTS | discovery |
warehouse
| Action | Access | Purpose |
|---|---|---|
| MONITOR_ON_WAREHOUSE | discovery | |
| USAGE_ON_WAREHOUSE | discovery | |
| OPERATE_ON_WAREHOUSE | scheduling |
ZOPNIGHT_READ_ROLE and ZOPNIGHT_WRITE_ROLE
Snowflake is the smallest grant in the platform: six permissions, five read and one write. There is no IAM here. Access is a Snowflake role, granted to a dedicated service user.
ZOPNIGHT_READ_ROLE covers everything except acting: it reads SNOWFLAKE.ACCOUNT_USAGE for
warehouse metering and storage, and runs SHOW WAREHOUSES for inventory. ZOPNIGHT_WRITE_ROLE
adds exactly one capability: suspending and resuming a virtual warehouse on a schedule.
Key pair or PAT?
Both are supported, and both ship as ready-made SQL setup scripts in read-only and read-write flavours, so you can review exactly what you are granting before you run it.
- Key pair: an RSA key pair on the service user. No shared secret transits, and rotation is
a
ALTER USERaway. - Programmatic access token: simpler to issue, and revocable from the Snowflake UI.
What it costs you to connect read-only
Nothing that runs a query costs nothing on Snowflake, and it is fair to ask. Inventory reads use
ACCOUNT_USAGE views, which are metadata and do not spin up a warehouse. The SHOW commands
are metadata operations too. Connecting ZopNight read-only does not consume credits.
What the write role will and will not do
It suspends a warehouse after checking WAREHOUSE_LOAD_HISTORY, and resumes it on schedule.
It never drops a warehouse, never resizes one, and never touches a database, schema or table.
System warehouses prefixed SYSTEM$ are excluded from scheduling entirely.
Snowflake permissions: common questions
Does connecting ZopNight read-only consume Snowflake credits?
No. Inventory reads come from SNOWFLAKE.ACCOUNT_USAGE views and SHOW WAREHOUSES, both metadata operations that do not spin up a warehouse. It is a fair question, because on Snowflake very little else is free.
What can ZOPNIGHT_WRITE_ROLE actually do?
One thing: suspend a virtual warehouse after checking WAREHOUSE_LOAD_HISTORY, and resume it on schedule. It never drops a warehouse, never resizes one, and never touches a database, schema or table. Warehouses prefixed SYSTEM$ are excluded entirely.
Key pair or programmatic access token?
Key pair means no shared secret transits, and rotation is one ALTER USER away. A programmatic access token is simpler to issue and revocable from the Snowflake UI. Both ship as ready-made SQL setup scripts in read-only and read-write flavours, so you can review the grant before running it.