Warehouses running without a resource monitor attached

The circuit breaker Snowflake will not install for you

Nothing in Snowflake stops a warehouse from spending. Auto-suspend ends idle time, but a warehouse doing real work (a cartesian join someone shipped on Friday, a retry loop resubmitting the same failing query) bills its full rate for as long as the work runs. A Large burns 8 credits per hour, per running cluster. Resource monitors are the only native mechanism that watches cumulative credit consumption against a quota and acts on it, and they are opt-in: no warehouse gets one unless somebody attaches it.

What the check reads

The discoverer captures each warehouse’s resource_monitor attribute; the rule fires when the value is empty or the literal string null, the two shapes Snowflake uses for “none attached”. Confidence is 0.9 because this is configuration, not inference. No spend history is examined: a monitor’s value is what it prevents, so waiting for evidence of a runaway before flagging the gap would be backwards.

Sweep the fleet in two statements

SHOW WAREHOUSES;
SELECT "name", "size", "resource_monitor"
FROM TABLE(RESULT_SCAN(LAST_QUERY_ID()))
WHERE "resource_monitor" = 'null';

Live metadata, no ACCOUNT_USAGE lag. Every row is a warehouse with an uncapped ceiling.

Building a monitor worth having

CREATE RESOURCE MONITOR analytics_rm WITH
  CREDIT_QUOTA = 500
  FREQUENCY = MONTHLY
  START_TIMESTAMP = IMMEDIATELY
  TRIGGERS ON 75 PERCENT DO NOTIFY
           ON 95 PERCENT DO SUSPEND
           ON 100 PERCENT DO SUSPEND_IMMEDIATE;
ALTER WAREHOUSE analytics_wh SET RESOURCE_MONITOR = analytics_rm;

Size the quota from the warehouse’s actual monthly consumption plus sensible headroom, so the monitor is a tripwire for anomalies rather than a routine interruption. A monitor can also be attached at the account level as a global backstop, but per-warehouse monitors are what make the notification actionable: the alert names the workload that blew its budget instead of announcing that something, somewhere, is spending.

Suspend versus suspend immediate

The two suspend triggers differ in what they do to in-flight work: SUSPEND lets running queries finish before stopping the warehouse, SUSPEND_IMMEDIATE cancels them mid-run. The layered pattern above (notify early, graceful stop at 95, hard stop at 100) keeps the hard cancel as a last resort. One operational note: creating resource monitors requires ACCOUNTADMIN, so in most orgs the remediation is a ticket to a specific person; ZopNight surfaces the gap but the grant structure decides who closes it.