Snowflake

Connect Snowflake with a dedicated user and role. The connector uses RSA key-pair authentication and discovers only the databases and schemas you select.

1. Create the key pair

Generate a PKCS#8 private key and its matching public key:

openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 aes-256-cbc -inform PEM -out rsa_key.p8
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

Enter a strong passphrase when prompted and keep both the passphrase and rsa_key.p8 secure. You will paste the key's full PEM content and its passphrase into the connector form. To assign the public key to the Snowflake user, remove the header, footer, and line breaks from rsa_key.pub.

2. Create a role and user

CREATE ROLE IF NOT EXISTS SUNDIAL_ROLE;

CREATE USER SUNDIAL_USER
  RSA_PUBLIC_KEY = '<public_key_content>'
  DEFAULT_ROLE = SUNDIAL_ROLE;

GRANT ROLE SUNDIAL_ROLE TO USER SUNDIAL_USER;

Use your own naming convention if required.

3. Grant warehouse and data access

Grant the role usage on the query warehouse and on each database and schema Sundial should discover:

GRANT USAGE ON WAREHOUSE <warehouse_name> TO ROLE SUNDIAL_ROLE;

GRANT USAGE ON DATABASE <database_name> TO ROLE SUNDIAL_ROLE;
GRANT USAGE ON SCHEMA <database_name>.<schema_name> TO ROLE SUNDIAL_ROLE;

Grant read access to the tables and views that Sundial may query:

GRANT SELECT ON ALL TABLES IN SCHEMA <database_name>.<schema_name> TO ROLE SUNDIAL_ROLE;
GRANT SELECT ON FUTURE TABLES IN SCHEMA <database_name>.<schema_name> TO ROLE SUNDIAL_ROLE;
GRANT SELECT ON ALL VIEWS IN SCHEMA <database_name>.<schema_name> TO ROLE SUNDIAL_ROLE;
GRANT SELECT ON FUTURE VIEWS IN SCHEMA <database_name>.<schema_name> TO ROLE SUNDIAL_ROLE;

Repeat the database, schema, table, and view grants for each scope you plan to select. Use grants on individual objects instead if your access policy requires a narrower scope.

4. Add the connector

In Sundial:

1. Open Context Engine → Connectors & MCP.
2. Click Add Connector, then select Snowflake.
3. Enter:
   • Connection Name
   • Account Identifier, such as xy12345.us-east-1
   • Username
   • RSA Private Key (the full PKCS#8 PEM content)
   • Private Key Passphrase, if the key is encrypted
   • Warehouse
   • Role
4. Click Test & Continue.
5. Select the databases and schemas to sync.
6. Review the scope and start the initial sync.

After setup, open Context Engine → Syncs to monitor syncs or change the schedule.