# Snowflake IAM permissions

> Snowflake is the smallest grant in the platform: just 6 permissions across 2 roles. ZOPNIGHT_READ_ROLE reads ACCOUNT_USAGE for warehouse metering and runs SHOW WAREHOUSES for inventory. ZOPNIGHT_WRITE_ROLE adds exactly one capability, which is suspending and resuming a virtual warehouse on a schedule.

Source: https://zop.dev/integrations/snowflake/permissions
Updated: 2026-08-20

---

## Common questions

### Does connecting ZopNight read-only consume Snowflake credits?

No. Inventory reads come from SNOWFLAKE.ACCOUNT_USAGE views and SHOW WAREHOUSES, both metadata operations that do not spin up a warehouse. It is a fair question, because on Snowflake very little else is free.

### What can ZOPNIGHT_WRITE_ROLE actually do?

One thing: suspend a virtual warehouse after checking WAREHOUSE_LOAD_HISTORY, and resume it on schedule. It never drops a warehouse, never resizes one, and never touches a database, schema or table. Warehouses prefixed SYSTEM$ are excluded entirely.

### Key pair or programmatic access token?

Key pair means no shared secret transits, and rotation is one ALTER USER away. A programmatic access token is simpler to issue and revocable from the Snowflake UI. Both ship as ready-made SQL setup scripts in read-only and read-write flavours, so you can review the grant before running it.

## ZOPNIGHT_READ_ROLE and ZOPNIGHT_WRITE_ROLE

Snowflake is the smallest grant in the platform: **six permissions**, five read and one write.
There is no IAM here. Access is a Snowflake role, granted to a dedicated service user.

`ZOPNIGHT_READ_ROLE` covers everything except acting: it reads `SNOWFLAKE.ACCOUNT_USAGE` for
warehouse metering and storage, and runs `SHOW WAREHOUSES` for inventory. `ZOPNIGHT_WRITE_ROLE`
adds exactly one capability: suspending and resuming a virtual warehouse on a schedule.

## Key pair or PAT?

Both are supported, and both ship as ready-made SQL setup scripts in read-only and read-write
flavours, so you can review exactly what you are granting before you run it.

- **Key pair**: an RSA key pair on the service user. No shared secret transits, and rotation is
  a `ALTER USER` away.
- **Programmatic access token**: simpler to issue, and revocable from the Snowflake UI.

## What it costs you to connect read-only

Nothing that runs a query costs nothing on Snowflake, and it is fair to ask. Inventory reads use
`ACCOUNT_USAGE` views, which are metadata and do not spin up a warehouse. The `SHOW` commands
are metadata operations too. Connecting ZopNight read-only does not consume credits.

## What the write role will and will not do

It suspends a warehouse after checking `WAREHOUSE_LOAD_HISTORY`, and resumes it on schedule.
It never drops a warehouse, never resizes one, and never touches a database, schema or table.
System warehouses prefixed `SYSTEM$` are excluded from scheduling entirely.