Outcome
By the end of this lesson, you will be able to navigate the RC-2100 to RC-2119 Snowflake signals, explain why they are served by the V2 engine rather than the V1 rule interface, and prioritise the twenty by likely impact on a real account.
| Tier | Engineer |
| JTBD | ”Know which Snowflake finding to act on first, and which are guardrails rather than savings.” |
| Personas | Platform Engineer · Data Engineer · FinOps Lead |
| Prerequisites | M2.12.L2 · M2.1 (the rule library) |
| Time | 9 minutes |
| Bloom verb | Navigate (Apply), Explain (Understand), Prioritise (Evaluate) |
1. Concept
Snowflake recommendations are V2-only, and that is the first thing to understand about them.
V1 V2─────────────────────────────────────────────────────────────The Rule interface you met A catalog-driven engine:in M2.1: Go rules under capability YAML underinternal/rules/, each with providers/snowflake/*.yamlEvaluate(), MetricsAware, plus signal definitions inPricingAware signals/*/snowflake-*.yaml
455 distinct RC-* ids 141 catalogs / ~508553 registered instances capabilities, of which 6 catalogs are SnowflakeV2 is the live engine (gated by REC_ENGINE_V2_ENABLED), and both engines run side by side during validation. Snowflake never had a V1 implementation: it arrived after V2 existed, so it was built there and there is no V1 fallback for it.
The practical consequence: Snowflake findings are cost-optimisation only. There is no Snowflake security or compliance family, because the increment did not ship one.
The twenty signals, grouped by where the money is
WAREHOUSES (the majority of recoverable spend) idle / suspend a warehouse burning credits it does not need to resize down oversized for its workload resize up spilling to disk, where the spill dominates runtime multi-cluster min / max min too high, or max wider than concurrency needs consolidate several warehouses doing one warehouse's work auto-suspend guardrail threshold long or disabled statement timeout guardrail runaway queries uncapped resource-monitor guardrail no credit ceiling in place tag guardrail warehouse not attributable
TABLES retention Time Travel longer than the table's value justifies transient a rebuildable table paying for Fail-safe archive cold data on hot storage suspend clustering automatic clustering running on a table that no longer benefits drop search-optimization a search-optimization service nothing queries that way
MATERIALIZED VIEWS maintenance cost against actual query benefit
SNOWPIPE file-batching: many small files ingested individually cost far more than the same volume batched
ORPHAN STAGES stages nothing loads from
ACCOUNT LEVEL (advisory) capacity contract consumption pattern versus the committed contract edition downgrade paying for an edition whose features are unusedHow to prioritise on a real account
FIRST, ALWAYS: the warehouse signals. Compute is the majority of a typical Snowflake bill, and resize-down plus consolidate are the two levers with the largest single-action impact.
SECOND: the guardrails. auto-suspend, statement timeout and resource monitor do not save money today. They cap the worst case, which on a credit-based model is unbounded. A runaway query on an X-Large with no statement timeout is the Snowflake equivalent of a forgotten override.
THIRD: Snowpipe file-batching. Frequently the largest surprise, because serverless spend sits outside the warehouse figure most teams watch.
FOURTH: the table signals. Individually small, collectively material on a large account, and the safest to act on.
LAST: the two account-level advisories. Capacity contract and edition downgrade are procurement conversations, not engineering actions. They carry no one-click anything and belong in a renewal discussion.The guardrail signals are not savings, and that matters
Four of the twenty (auto-suspend, statement timeout, resource monitor, tag) are guardrails. They will not show a compelling dollar figure, because their value is a loss that has not happened yet.
Do not judge them by savings. A resource monitor is worth having for the same reason Max Override Duration is worth setting: not because it saves money on an average day, but because it bounds the day something goes wrong. On a credit model where a single oversized warehouse can burn a month’s budget in a weekend, that bound is the point.
Reading a V2 Snowflake finding
The card looks like any other recommendation, and the same discipline from M2.1 L5 applies. Two Snowflake-specific things to check:
1. WHICH WINDOW did the signal measure? Snowflake workloads are frequently weekly rather than daily. A resize-down measured over a week that contained no month-end close will under-size.
2. IS THE WAREHOUSE SHARED? The consolidate signal is the one most likely to be right about the money and wrong about the politics. Two teams sharing one warehouse lose the ability to attribute their own spend.2. Demo
A first pass on a mid-size account:
ACCOUNT: 14 warehouses, ~4,200 tables, $41,200/mo compute
OPEN SNOWFLAKE FINDINGS: 31
WAREHOUSE SIGNALS POTENTIAL resize down WH_ETL_MAIN L -> M $4,100/mo resize down WH_BI_PROD XL -> L $3,800/mo consolidate WH_ADHOC_1 + WH_ADHOC_2 $1,200/mo idle/suspend WH_MIGRATION_TMP $890/mo multi-cluster WH_BI_PROD min 2 -> 1 $700/mo ────────────────────────────────────────────────────── $10,690/mo
SNOWPIPE file-batching on the events pipe $2,900/mo (18M files/day averaging 4 KB. Batching to ~64 MB targets is an ingestion change, not a Snowflake setting.)
TABLE SIGNALS (11 findings) $1,340/mo mostly retention on staging tables carrying 7-day Time Travel they do not need
GUARDRAILS (4 findings) $0 auto-suspend disabled on WH_ADHOC_2 no statement timeout on WH_ETL_MAIN no resource monitor on the account WH_MIGRATION_TMP has no cost-centre tag
ACCOUNT ADVISORY (2 findings) $0 edition downgrade: Business Critical features show no usage in 90 days -> renewal question capacity contract: consumption 23% under commit
WHAT THE TEAM DID Week 1: the two resize-downs and the idle warehouse. $8,790/mo, three actions, no code changes. Week 1: ALL FOUR guardrails, despite $0 savings. The missing statement timeout on WH_ETL_MAIN was the one that mattered: a runaway query there had burned $2,300 in one weekend two months earlier, which is how the account got audited at all. Week 3: Snowpipe batching, after a data-eng sprint. Deferred: consolidate. Both ad-hoc warehouses belong to teams who want their own spend visible. Correct call: $1,200/mo is not worth losing attribution over.3. Hands-on (6 min)
1. Filter Recommendations to the RC-21xx range. Total findings: ______ Total savings: $______
2. Split them: warehouse signals ______ findings $______ table signals ______ findings $______ guardrails ______ findings $0 account advisory ______ findings $0
3. Take your largest resize-down. What window did the signal measure? ______ days Did that window contain a month-end close? Y / N If N, widen before acting.
4. Check all four guardrails regardless of savings: auto-suspend set tight everywhere? Y / N statement timeout set on ETL warehouses? Y / N resource monitor on the account? Y / N warehouses carry a cost-centre tag? Y / N Any N is worth fixing this week.
5. If a consolidate signal appears, name the teams involved and decide the attribution question BEFORE the cost question: ______________________________________________4. Knowledge check
Q1
Why are Snowflake recommendations served by the V2 engine rather than the V1 rule interface?
A. V1 does not support non-cloud providers
B. Snowflake arrived after V2 existed, so it was built as a V2 capability catalog (providers/snowflake/*.yaml plus signal definitions) with no V1 implementation to fall back to
C. V2 is faster for large table counts
D. V1 was retired entirely before Snowflake support shipped, so there was never a V1 Snowflake rule to migrate and the whole family started life on the newer engine
Show answer
Correct: B. V2 is the live engine, gated by REC_ENGINE_V2_ENABLED. D overstates it: V1 is still the engine behind the 455 RC-* rules and both run side by side during validation. Snowflake simply never had a V1 version.
Q2
Four of the twenty Snowflake signals show $0 potential savings. The right way to treat them:
A. Act on them anyway
B. Dismiss them, since they recover nothing
C. Wait until they show savings
D. Route them to the security backlog
Show answer
Correct: A. Auto-suspend, statement timeout, resource monitor and tag are guardrails: their value is a loss that has not happened yet. On a credit model a single runaway query on an oversized warehouse can burn a month’s budget in a weekend, and these bound that. The reasoning is the same as Max Override Duration in T1.M1.5: a cap is not worth having because of what it saves on an average day, it is worth having because of what it bounds on the worst one.
Q3
A consolidate signal proposes merging two ad-hoc warehouses owned by two different teams, saving $1,200/month. The consideration that should be settled first:
A. Whether the warehouses are the same size
B. Whether the teams are in the same timezone
C. Whether auto-suspend is set on both
D. Attribution
Show answer
Correct: D. Two teams sharing one warehouse lose the ability to see their own spend, and the consolidate signal is the one most likely to be right about the money and wrong about the organisation. Declining it to preserve attribution is a defensible call. This mirrors the shared-resource attribution problem in T3.M3.5.L2. Merging spend into one bucket makes a report look tidier and makes accountability worse, and $1,200/month is usually not worth that trade.
5. Apply
Work the RC-21xx findings in the order the lesson gives: warehouse signals first for the money, guardrails next regardless of savings, Snowpipe third because it is the usual surprise, tables fourth, and the two account-level advisories into your renewal conversation rather than your sprint.
Details for every signal live in the V2 recommendation matrix; treat that and the catalog YAML as the source of truth over any count in prose.
Related lessons
- L3: Scheduling warehouses
- L2: The credit-based cost model
- T2.M2.1.L5: Reading a recommendation card
- T3.M3.5.L2: Team attribution and shared resources
Glossary terms touched
V2 engine · Capability catalog · Guardrail signal · Snowpipe