Skip to main content
governance · snowflake

Snowflake warehouses carrying none of the team, cost_center or environment tags

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

ZopNight flags a Snowflake warehouse that has no value for any of three cost-allocation tags: `team`, `cost_center` and `environment`. Warehouses are where Snowflake compute credits are spent, so an untagged warehouse lands in an unallocated bucket in any showback or chargeback report built on object tags.

Signal and threshold

How ZopNight evaluates Snowflake warehouses carrying none of the team, cost_center or environment tags.
Field Value
Rule IDsRC-2119
Categorygovernance
Severitylow
Metricwarehouse tags
Thresholdteam, cost_center and environment all missing
SourceZopNight
Permissions usedSNOWFLAKE.GOVERNANCE_VIEWER

Credits you cannot attribute are credits nobody owns

Snowflake object tags are schema-level objects you assign to other objects as key and value pairs. Snowflake’s own guidance is that tagging warehouses lets you monitor resource usage and group it by cost center or another organizational unit. Creating and setting tags is available on every edition.

Warehouses are the natural place to tag because they are where most compute credits are metered. When one carries no allocation tags, its spend cannot be split by team or environment, and a growing warehouse has no obvious owner to ask about it.

Checking which warehouses have allocation tags

TAG_REFERENCES lists every tag assignment. This returns warehouses with none of the three tags:

Terminal window
SHOW WAREHOUSES
->> SELECT w."name", w."size"
FROM $1 w
LEFT JOIN (
SELECT DISTINCT object_name
FROM SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES
WHERE domain = 'WAREHOUSE'
AND object_deleted IS NULL
AND LOWER(tag_name) IN ('team', 'cost_center', 'environment')
) t ON t.object_name = w."name"
WHERE t.object_name IS NULL;

The view can lag by up to 2 hours, shows only objects your role can access, and needs the GOVERNANCE_VIEWER role. Snowflake’s cost attribution guide uses the same domain = 'WAREHOUSE' filter to join tags to warehouse metering.

All three tags must be missing

ZopNight reads the warehouse’s tag set and checks for a non-empty value under team, cost_center and environment. It fires only when all three are absent. A warehouse with just one of them, say environment = 'prod', is treated as tagged and left alone.

When a partly tagged warehouse passes

Because the gate is all-missing, partial tagging never produces a finding, and tags under other names do not count. If the tag data cannot be read, it is treated as no tags. Tags on the databases or tables a warehouse queries are not considered: the check is about the warehouse itself.

No saving, but a gap in every cost report

This is a governance finding without a dollar figure. Tagging does not reduce spend; it makes spend reviewable. The risk of leaving it is that the warehouse’s credits stay in an unallocated line that no team is accountable for.

Tagging the warehouse

  1. Create the tags once, in a governance schema, with CREATE TAG: CREATE TAG IF NOT EXISTS governance.tags.team; and the same for cost_center and environment.
  2. Apply them to the warehouse: ALTER WAREHOUSE etl_wh SET TAG governance.tags.team = 'data-eng', governance.tags.cost_center = 'cc-104', governance.tags.environment = 'prod';
  3. The role setting the tags needs either APPLY TAG on the account, or APPLY on each tag plus OWNERSHIP of the warehouse.
  4. Add the tags to whatever creates new warehouses, so new ones arrive tagged.

See it fire on your bill.

Connect an account read-only in about five minutes. Findings start with the first scan.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·