Skip to main content
governance · snowflake

Snowflake tables keeping more than 7 days of Time Travel and over 1 GiB of history

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

ZopNight flags a Snowflake table whose Time Travel retention is set above 7 days and whose Time Travel storage averaged more than 1 GiB over 14 days. Enterprise accounts can keep up to 90 days of history per table, all billed as storage, so a long window on a high-churn table often stores copies nobody will restore.

Signal and threshold

How ZopNight evaluates Snowflake tables keeping more than 7 days of Time Travel and over 1 GiB of history.
Field Value
Rule IDsRC-2108
Categorygovernance
Severitylow
Metricretention days and TIME_TRAVEL_BYTES
Threshold> 7 days and > 1 GiB average
Evaluation window14d
SourceZopNight
Permissions usedSNOWFLAKE.USAGE_VIEWER · SNOWFLAKE.OBJECT_VIEWER

Every retained day is a day of storage

Time Travel keeps the previous versions of changed or deleted data for the table’s retention period so it can be queried, cloned or undropped. The standard period is 1 day. On Enterprise Edition and above, a permanent table can be set anywhere from 0 to 90 days, and Snowflake states plainly that extended retention needs extra storage that shows up on the monthly bill. When the period ends, the data moves into Fail-safe for a further 7 days.

How much a long window costs depends on churn, not table size. An append-only fact table barely grows its Time Travel footprint. A table that is rewritten or merged daily keeps a copy of every replaced micro-partition for the whole window.

Listing tables by retention and Time Travel bytes

Terminal window
SELECT t.table_catalog || '.' || t.table_schema || '.' || t.table_name AS fqn,
t.retention_time,
ROUND(m.time_travel_bytes / POWER(1024, 3), 2) AS time_travel_gib,
ROUND(m.active_bytes / POWER(1024, 3), 2) AS active_gib
FROM SNOWFLAKE.ACCOUNT_USAGE.TABLES t
JOIN SNOWFLAKE.ACCOUNT_USAGE.TABLE_STORAGE_METRICS m
ON m.id = t.table_id
WHERE t.deleted IS NULL
AND t.retention_time > 7
AND m.time_travel_bytes > 1073741824
ORDER BY m.time_travel_bytes DESC;

RETENTION_TIME in ACCOUNT_USAGE.TABLES is the number of days kept for Time Travel; TIME_TRAVEL_BYTES in TABLE_STORAGE_METRICS is what that history occupies. The two views need the OBJECT_VIEWER and USAGE_VIEWER roles.

Retention above 7 days with more than 1 GiB retained

ZopNight needs the table’s retention setting and fires only when it is above 7 days. It then averages the table’s Time Travel bytes over the last 14 days and requires more than 1 GiB (1,073,741,824 bytes). Both must hold at once, so a 90-day window on a quiet table is left alone because there is little to reclaim.

Tables outside the check

If the retention setting was not captured or is not a number, or the Time Travel series is missing or empty, the rule does not fire. Retention of 7 days or less is treated as reasonable no matter how much history it holds.

Unpriced, with the storage as the prize

This is a governance advisory without a dollar figure. When retention is shortened, history already older than the new window moves into Fail-safe, and on a permanent table it is billed there for 7 more days, so the saving arrives over about a week rather than on the day of the change. What you recover over time is most of the Time Travel bytes shown by the query, at your per-TB storage rate.

Shortening the retention window

  1. Agree the recovery window with whoever owns the data. For a pipeline table that can be rebuilt, 1 day is common.
  2. Apply it with ALTER TABLE, as below.
  3. Check whether an account administrator has set a minimum retention for the account. When one is set, the effective retention is the larger of the two values, so a table-level change can have no effect.
Terminal window
ALTER TABLE stg.orders_merge SET DATA_RETENTION_TIME_IN_DAYS = 1;
SHOW PARAMETERS LIKE 'MIN_DATA_RETENTION_TIME_IN_DAYS' IN ACCOUNT;

For rebuildable tables that also carry heavy Fail-safe bytes, see Snowflake Permanent Table With Large Fail-safe.

See it fire on your bill.

Connect an account read-only in about five minutes. Findings start with the first scan.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·