Skip to main content
governance · snowflake

Multi-cluster Snowflake warehouses whose max cluster count sits far above observed peak

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

ZopNight flags a multi-cluster Snowflake warehouse with `MAX_CLUSTER_COUNT` above 2 whose peak average cluster count stayed below 2 over 14 days. The extra headroom costs nothing while unused, but it lets a burst of queries start clusters that multiply hourly credits with no one approving the spend.

Signal and threshold

How ZopNight evaluates Multi-cluster Snowflake warehouses whose max cluster count sits far above observed peak.
Field Value
Rule IDsRC-2105
Categorygovernance
Severitylow
Metricaverage running clusters
Thresholdmax clusters > 2 and peak < 2
Evaluation window14d
SourceZopNight
Permissions usedMONITOR on the warehouse · SNOWFLAKE.USAGE_VIEWER · SNOWFLAKE.GOVERNANCE_VIEWER

The ceiling sets the worst-case hourly bill

A multi-cluster warehouse, an Enterprise Edition feature, runs between a minimum and a maximum number of clusters of the same size. In Auto-scale mode Snowflake starts clusters as load rises, up to the maximum, and shuts them down as it falls. The maximum credits per hour are the size’s rate multiplied by the maximum cluster count: Snowflake’s example is a Medium warehouse with 3 clusters topping out at 12 credits an hour.

Unused headroom costs nothing on its own. The risk is that a runaway dashboard or a flood of retries can use it, and Snowflake’s advice is to start small (for example maximum 2 or 3) and raise the limit as you learn the workload.

Comparing the setting with what actually ran

Terminal window
SHOW WAREHOUSES
->> SELECT "name", "size", "scaling_policy", "min_cluster_count", "max_cluster_count"
FROM $1
WHERE "max_cluster_count" > 2;

Then see how many clusters served queries over the same two weeks. QUERY_HISTORY records the CLUSTER_NUMBER each statement ran on, and reading it takes the GOVERNANCE_VIEWER SNOWFLAKE database role:

Terminal window
SELECT warehouse_name, MAX(cluster_number) AS highest_cluster_used
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
WHERE start_time >= DATEADD('day', -14, CURRENT_TIMESTAMP())
GROUP BY warehouse_name;

Over 2 allowed, never averaging 2 in use

ZopNight needs the warehouse’s maximum cluster count, and it must be greater than 2. It then reads the average number of running clusters over the last 14 days and takes the highest value in that window. The finding fires when even that peak is below 2, meaning the warehouse never averaged two clusters over any measured period.

When the maximum is left alone

Warehouses with a maximum of 1 or 2 are never flagged, and neither is a warehouse whose maximum could not be read. With no cluster-count series or no datapoints in the 14 days, nothing is raised. A single hour where the average reached 2 or more is enough to clear the warehouse.

Governance, not a computed saving

This finding carries no dollar figure, because a high maximum does not cost anything until it is used. What it prevents is surprise spend: each extra cluster that starts bills at the full rate of the warehouse size. The opposite problem, clusters held running all the time, is Snowflake Warehouse Over-Provisioned Min Clusters.

Lowering the maximum

  1. Check for known peaks outside the 14-day window, such as quarter-end jobs.
  2. Set the ceiling near what the workload has actually used: ALTER WAREHOUSE bi_wh SET MAX_CLUSTER_COUNT = 2; In Auto-scale mode the maximum must stay greater than the minimum.
  3. Watch queued load in WAREHOUSE_LOAD_HISTORY (AVG_QUEUED_LOAD) for a week. Persistent queuing means the ceiling is now too low.

See it fire on your bill.

Connect an account read-only in about five minutes. Findings start with the first scan.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·