Skip to main content
governance · snowflake

Snowflake warehouses with no resource monitor assigned

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

ZopNight flags a Snowflake warehouse that has no resource monitor explicitly assigned in its `RESOURCE_MONITOR` property. Without one there is no warehouse-level credit quota to notify or suspend when spend runs away, so a stuck job or a bad query loop can consume credits until someone reads the bill.

Signal and threshold

How ZopNight evaluates Snowflake warehouses with no resource monitor assigned.
Field Value
Rule IDsRC-2118
Categorygovernance
Severitylow
MetricRESOURCE_MONITOR property
Thresholdno monitor assigned
SourceZopNight
Permissions usedMONITOR on the warehouse

Nothing caps a warehouse by default

A resource monitor tracks credit use by the warehouses assigned to it, plus the cloud services that support them, against a quota for a month, week, day, year or custom range. At thresholds you choose it can notify, suspend the warehouses once running statements finish, or suspend them immediately and cancel what is running. CREATE WAREHOUSE assigns no monitor by default.

Monitors are how Snowflake puts a hard credit ceiling on warehouses. They do not cover serverless features or AI services; Snowflake points to budgets for those.

Listing warehouses without a monitor

Terminal window
SHOW WAREHOUSES
->> SELECT "name", "size", "max_cluster_count", "resource_monitor"
FROM $1
WHERE "resource_monitor" IS NULL OR "resource_monitor" = 'null'
ORDER BY "size";

The resource_monitor column in SHOW WAREHOUSES shows the monitor explicitly assigned to that warehouse. SHOW RESOURCE MONITORS; lists the monitors that exist and their quotas.

What counts as having no monitor

ZopNight reads the warehouse’s resource monitor property. The finding fires when that property is absent, empty, or the literal value null. Any named monitor clears the warehouse, regardless of its quota or which actions it triggers.

Situations the check does not weigh

The check looks only at the warehouse’s own assignment. An account-level monitor, which Snowflake allows once per account to control credit use across all warehouses together, does not count. The rule also does not judge whether an existing monitor’s quota is sensible.

A guardrail, not a saving

This finding shows no dollar figure: a monitor saves nothing until something goes wrong. What it protects against is unbounded spend. A 2X-Large warehouse uses 32 credits an hour on Gen1, so a job that loops over a weekend can burn well over a thousand credits before Monday.

Attaching a monitor

Only the ACCOUNTADMIN role can create resource monitors and assign warehouses to them.

  1. Create a monitor sized to the warehouse’s normal monthly use:
Terminal window
CREATE RESOURCE MONITOR etl_wh_monitor WITH
CREDIT_QUOTA = 500
FREQUENCY = MONTHLY
START_TIMESTAMP = IMMEDIATELY
TRIGGERS ON 75 PERCENT DO NOTIFY
ON 100 PERCENT DO SUSPEND
ON 110 PERCENT DO SUSPEND_IMMEDIATE;
  1. Assign it: ALTER WAREHOUSE etl_wh SET RESOURCE_MONITOR = etl_wh_monitor;
  2. Enable notifications for the people who should hear about it. Snowflake disables resource monitor notifications by default.

See it fire on your bill.

Connect an account read-only in about five minutes. Findings start with the first scan.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·