The Snowflake rule set · ZopDev University

Outcome

By the end of this lesson, you will be able to navigate the twenty Snowflake rules RC-2100 to RC-2119, tell the five priced rules from the fifteen advisory ones, and prioritise them by likely impact on a real account.


Prerequisites	M2.12.L2 · M2.1 (the rule library)
Time	9 minutes

1. Concept

Snowflake recommendations come from twenty native rules, RC-2100 to RC-2119, built on the same rule interface you met in M2.1. They are evaluated alongside every AWS, Azure and GCP rule. An older catalog-driven engine once served Snowflake on its own; that engine was removed, and its Snowflake coverage was ported to these rules.

The first thing to understand about them is that most carry no dollar figure.

PRICED (5 rules)                ADVISORY (15 rules)
─────────────────────────────────────────────────────────────
A saving computed from the      A manual Snowflake change
same credits x edition rate     with no defensible dollar
ZopNight prices cost on.        figure, so none is shown.

RC-2101 idle warehouse          Category governance, so the
RC-2104 oversized warehouse     $5 low-savings floor never
RC-2112 auto-clustering         drops them.
RC-2113 MV refresh
RC-2114 search optimization

The priced rules follow concrete-or-abstain: if the cost or credit rate is not available, the saving is zero and the finding is dropped rather than shown as a $0 cost recommendation.

Snowflake findings are cost and governance findings. There is no Snowflake security or compliance family.

The twenty rules, grouped by resource

WAREHOUSES  (the majority of recoverable spend)
  RC-2101 idle                credits burned, zero queries
                              over 14 days        PRICED
  RC-2104 oversized           p95 load under 30% and p95
                              remote spill under 1 MiB,
                              14 days             PRICED
                              (half the warehouse's cost:
                              one size down halves credits)
  RC-2106 undersized          heavy remote spill (p95 over
                              1 GiB): resize up
  RC-2102 min clusters        MIN_CLUSTER_COUNT held above
                              an observed average under 1.5
  RC-2105 max clusters        MAX_CLUSTER_COUNT above 2 and
                              peak average cluster count
                              under 2 over 14 days
  RC-2107 under-utilized      active under 4 h/day over 30
                              days; suggests merging into a
                              shared warehouse
  RC-2100 auto-suspend        unset, 0, or above 120 s
  RC-2103 statement timeout   unset, or left at the 48h
                              default
  RC-2118 resource monitor    none attached to the warehouse
  RC-2119 tags                none of team / cost_center /
                              environment

TABLES
  RC-2108 retention           Time Travel over 7 days on a
                              table over 1 GiB
  RC-2109 transient           a permanent table carrying
                              Fail-safe over 1 GiB
  RC-2110 cold table          over 100 GiB, zero reads in
                              90 days
  RC-2112 auto-clustering     clustering credits, under 100
                              queries in 30 days  PRICED
  RC-2114 search optimization under 10 point lookups in 30
                              days                PRICED

MATERIALIZED VIEWS
  RC-2113                     refresh credits outweigh the
                              query benefit       PRICED

SNOWPIPE
  RC-2115                     over 1,000 files averaging
                              under 50 MB each

STAGES
  RC-2111                     no COPY in over 30 days

ACCOUNT LEVEL (advisory)
  RC-2116 capacity pricing    a steady on-demand baseline
                              (abstains today: the baseline
                              metric is not yet keyed to the
                              account)
  RC-2117 edition review      on Business Critical or VPS

How to prioritise on a real account

FIRST, ALWAYS: the priced warehouse rules.
  Compute is the majority of a typical Snowflake bill, and
  RC-2104 (oversized) and RC-2101 (idle) are the two rules
  with a real dollar figure and the largest single-action
  impact.

SECOND: the guardrails.
  auto-suspend, statement timeout, resource monitor and
  tags do not save money today. They cap the worst case,
  which on a credit-based model is unbounded. A runaway
  query on an X-Large with no statement timeout is the
  Snowflake equivalent of a forgotten override.

THIRD: Snowpipe file-batching.
  Frequently the largest surprise, because serverless spend
  sits outside the warehouse figure most teams watch. The
  card carries no dollar figure; measure the pipe's credits
  before and after.

FOURTH: the table rules.
  The two priced ones (auto-clustering, search optimization)
  first. The rest are individually small, collectively
  material on a large account, and the safest to act on.

LAST: the two account-level advisories.
  Capacity pricing and edition review are procurement
  conversations, not engineering actions. They belong in a
  renewal discussion.

The guardrail rules are not savings, and that matters

Four of the advisory rules (auto-suspend, statement timeout, resource monitor, tags) are guardrails. They show no dollar figure, because their value is a loss that has not happened yet.

Do not judge them by savings. A resource monitor is worth having not because it saves money on an average day, but because it bounds the day something goes wrong. On a credit model where a single oversized warehouse can burn a month’s budget in a weekend, that bound is the point.

Reading a Snowflake finding

The card looks like any other recommendation, and the same discipline from M2.1 L5 applies. Two Snowflake-specific things to check:

1. WHICH WINDOW did the rule measure?
   RC-2104 reads the last 14 days of load. Snowflake
   workloads are frequently monthly rather than daily: if
   those 14 days contained no month-end close, check the
   close yourself before you resize.

2. IS THE WAREHOUSE SHARED?
   RC-2107's merge suggestion is the one most likely to
   be right about the waste and wrong about the politics.
   Two teams sharing one warehouse lose the ability to
   attribute their own spend.

2. Demo

A first pass on a mid-size account:

ACCOUNT: 14 warehouses, ~4,200 tables
         $41,200/mo ($38,900 compute + $2,300 storage)

OPEN SNOWFLAKE FINDINGS: 25

PRICED (6 findings)                            SAVING
  RC-2104 oversized  WH_ETL_MAIN  L -> M        $4,100/mo
  RC-2104 oversized  WH_BI_PROD   XL -> L       $3,800/mo
  RC-2101 idle       WH_MIGRATION_TMP             $890/mo
  RC-2112 auto-clustering, 2 tables               $260/mo
  RC-2113 MV refresh, 1 view                      $140/mo
  ──────────────────────────────────────────────────────
                                                $9,190/mo

ADVISORY (19 findings, no dollar figure)
  Warehouses (8)
    RC-2107 under-utilized: WH_ADHOC_1, WH_ADHOC_2
    RC-2102 min clusters 2 on WH_BI_PROD
    RC-2100 auto-suspend disabled on WH_ADHOC_2
    RC-2103 no statement timeout on WH_ETL_MAIN
    RC-2118 no resource monitor: WH_ADHOC_1, WH_ADHOC_2
    RC-2119 WH_MIGRATION_TMP carries no cost tags
  Snowpipe (1)
    RC-2115 the events pipe: 18M files/day averaging
    4 KB. Batching toward 100-250 MB files is an
    ingestion change, not a Snowflake setting.
  Tables (9)
    RC-2108 six staging tables on 30-day Time Travel
    RC-2109 three rebuildable tables paying Fail-safe
  Account (1)
    RC-2117 Business Critical edition -> renewal question

WHAT THE TEAM DID
  Week 1: the two resize-downs and the idle warehouse.
          $8,790/mo, three actions, no code changes.
  Week 1: ALL the guardrails, despite no dollar figure.
          The missing statement timeout on WH_ETL_MAIN was
          the one that mattered: a runaway query there had
          burned $2,300 in one weekend two months earlier,
          which is how the account got audited at all.
  Week 2: suspended clustering on the two tables and
          dropped the view. $400/mo.
  Week 3: Snowpipe batching, after a data-eng sprint.
  Deferred: merging the two ad-hoc warehouses. Both belong
          to teams who want their own spend visible.
          Correct call: the card carries no dollar figure,
          and the loss of attribution is certain.

3. Hands-on (6 min)

1. Filter Recommendations to the RC-21xx range.
   Total findings: ______   Total savings: $______

2. Split them:
   priced rules        ______ findings  $______
   advisory rules      ______ findings  (no figure)
     of which guardrails ______
     of which account    ______

3. Take your largest RC-2104 finding. Did its 14-day
   window contain a month-end close?            Y / N
   If N, check the close before acting.

4. Check all four guardrails regardless of savings:
   auto-suspend set tight everywhere?           Y / N
   statement timeout set on ETL warehouses?     Y / N
   resource monitor on every warehouse?         Y / N
   warehouses carry team / cost tags?           Y / N
   Any N is worth fixing this week.

5. If RC-2107 appears, name the teams that use the
   warehouse and decide the attribution question BEFORE
   the cost question:
   ______________________________________________

4. Knowledge check

Q1

How does ZopNight produce Snowflake recommendations today?

A. From a separate capability-catalog engine with no fallback
B. From Snowflake’s own cost advisor, imported nightly
C. From twenty native rules on the same rule interface as AWS
D. From the warehouse schedule history, not from metrics

Show answer

Correct: C. The catalog-driven engine that first served Snowflake was removed, and its coverage was ported to native rules RC-2100 to RC-2119 on the same rule interface as every other provider. A describes the removed engine. ZopNight does not import a Snowflake advisor, and recommendations come from usage metrics and configuration, not schedule history.

Q2

Fifteen of the twenty Snowflake rules carry no dollar figure. Four of them are the guardrails: auto-suspend, statement timeout, resource monitor and tags. The right way to treat those four:

A. Act on them anyway
B. Dismiss them, since they recover nothing
C. Wait until they show savings
D. Route them to the security backlog

Show answer

Correct: A. Their value is a loss that has not happened yet. On a credit model a single runaway query on an oversized warehouse can burn a month’s budget in a weekend, and these bound that. A cap is not worth having because of what it saves on an average day; it is worth having because of what it bounds on the worst one.

Q3

RC-2107 flags two ad-hoc warehouses, owned by two different teams, as active under four hours a day, and suggests merging them into one shared warehouse. The consideration that should be settled first:

A. Whether the warehouses are the same size
B. Whether the teams are in the same timezone
C. Whether auto-suspend is set on both
D. Attribution

Show answer

Correct: D. Two teams sharing one warehouse lose the ability to see their own spend, and a merge suggestion is the one most likely to be right about the waste and wrong about the organisation. Declining it to preserve attribution is a defensible call. This mirrors the shared-resource attribution problem in T4.M4.5.L2. Merging spend into one bucket makes a report look tidier and makes accountability worse, and the card carries no dollar figure to weigh against that.

5. Apply

Work the RC-21xx findings in the order the lesson gives: the priced warehouse rules first for the money, guardrails next regardless of savings, Snowpipe third because it is the usual surprise, tables fourth, and the two account-level advisories into your renewal conversation rather than your sprint.

Treat the rule cards in the product as the source of truth over any count in prose.

Glossary terms touched

Concrete-or-abstain

Outcome

1. Concept

The twenty rules, grouped by resource

How to prioritise on a real account

The guardrail rules are not savings, and that matters

Reading a Snowflake finding

2. Demo

3. Hands-on (6 min)

4. Knowledge check

Q1

Q2

Q3

5. Apply

Related lessons

Glossary terms touched

Start with the bill.