Connecting a Snowflake account

Overview

To onboard your Snowflake environment to DigiUsher, create a dedicated read-only role and service user, grant the necessary privileges, and authenticate via key-pair authentication. This document describes exactly what permissions are requested, why each is needed, and what credentials to provide.

Summary of Access Required

DigiUsher cannot create, modify, or delete any of your Snowflake resources.

Prerequisites

Information to Gather

Roles Required by the Person Performing Setup

Manual Setup

USE ROLE ACCOUNTADMIN;
GRANT ROLE ORGADMIN TO USER <your_username>;

SELECT
    CURRENT_ORGANIZATION_NAME() AS org,
    CURRENT_ACCOUNT_NAME()      AS account;

USE ROLE ACCOUNTADMIN;

CREATE ROLE IF NOT EXISTS digiusher_reader_role;

CREATE USER IF NOT EXISTS digiusher_reader
    DEFAULT_ROLE      = digiusher_reader_role
    DEFAULT_WAREHOUSE = COMPUTE_WH
    COMMENT           = 'Read-only DigiUsher service account';

GRANT ROLE digiusher_reader_role TO USER digiusher_reader;

-- Replace COMPUTE_WH with the warehouse you want DigiUsher to use.
-- Run SHOW WAREHOUSES; to see what's available.
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE digiusher_reader_role;

-- ── Account-level grants (run as ACCOUNTADMIN) ─────────────────────────────
USE ROLE ACCOUNTADMIN;

-- Access to the SNOWFLAKE shared database (unlocks the ACCOUNT_USAGE views)
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE digiusher_reader_role;

-- Lets the reader use the Snowsight cost UI and usage table functions
GRANT MONITOR USAGE ON ACCOUNT TO ROLE digiusher_reader_role;

-- Read-only account-level usage (application + database role)
GRANT APPLICATION ROLE SNOWFLAKE.APP_USAGE_VIEWER
    TO ROLE digiusher_reader_role;
GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER
    TO ROLE digiusher_reader_role;

-- ── Organization-level grants (run as ORGADMIN) ────────────────────────────
USE ROLE ORGADMIN;

-- Read-only organization billing (application role)
GRANT APPLICATION ROLE SNOWFLAKE.APP_ORGANIZATION_BILLING_VIEWER
    TO ROLE digiusher_reader_role;

-- Organization-level database roles (cross-account billing views)
GRANT DATABASE ROLE SNOWFLAKE.ORGANIZATION_USAGE_VIEWER
    TO ROLE digiusher_reader_role;
GRANT DATABASE ROLE SNOWFLAKE.ORGANIZATION_ACCOUNTS_VIEWER
    TO ROLE digiusher_reader_role;
GRANT DATABASE ROLE SNOWFLAKE.ORGANIZATION_BILLING_VIEWER
    TO ROLE digiusher_reader_role;

# Generate an ECDSA P-384 private key (unencrypted, PKCS#8)
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-384 -out digiusher_ec_key.p8

# Derive the public key
openssl pkey -in digiusher_ec_key.p8 -pubout -out digiusher_ec_key.pub

ALTER USER digiusher_reader
    ADD KEY PAIR digiusher_reader_p384
    PUBLIC_KEY = '<paste-public-key-contents-here>';

Connect in DigiUsher

After completing the setup steps, enter the following into DigiUsher to complete the connection:

Verification Checklist

• ORGADMIN role granted to setup user (or confirmed already held)
• Organization name and account name noted from Step 2
• digiusher_reader_role and digiusher_reader created
• Warehouse USAGE grant applied to digiusher_reader_role
• Account-level grants (IMPORTED PRIVILEGES, MONITOR USAGE, APP_USAGE_VIEWER, USAGE_VIEWER) executed as ACCOUNTADMIN
• Organization-level grants (APP_ORGANIZATION_BILLING_VIEWER, ORGANIZATION_* database roles) executed as ORGADMIN
• ECDSA P-384 key pair generated and public key registered via ALTER USER ... ADD KEY PAIR
• Organization name, account name, username, role, warehouse, and private key entered in DigiUsher
• Verification probe passed — DigiUsher confirms access to SNOWFLAKE.ORGANIZATION_USAGE.USAGE_IN_CURRENCY_DAILY and returns cost records
• *.digiusher.com allowlisted in your network/firewall (if applicable)
• digiusher.com allowlisted as an approved sender domain in your email security gateway (if applicable)

Security

What DigiUsher CAN Access (Read-Only)

• SNOWFLAKE.ORGANIZATION_USAGE.USAGE_IN_CURRENCY_DAILY — daily credit consumption and cost per account across the organization
• SNOWFLAKE.ORGANIZATION_USAGE.* — organization-wide usage views (compute, storage, data transfer)
• SNOWFLAKE.ACCOUNT_USAGE.* — account-level resource usage metadata
• Views accessible via SNOWFLAKE.USAGE_VIEWER, ORGANIZATION_BILLING_VIEWER, and related database roles

What DigiUsher CANNOT Do

• Access any user tables, databases, or schemas outside the SNOWFLAKE shared database
• Read query results, stage contents, or any business data
• Create, modify, or delete any object in Snowflake
• View or modify billing settings, warehouse configurations, or account parameters
• Make purchases or changes to your Snowflake contract

Monitoring

Monitor digiusher_reader activity in SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY, filtering on USER_NAME = 'DIGIUSHER_READER'. This provides a full audit trail of every query run by the service account.

Credential Rotation

1. Generate a new ECDSA P-384 key pair (repeat Step 6).
2. Register the new public key under a second named key pair, so both keys are active during the switch-over and there is no interruption:

   ALTER USER digiusher_reader
       ADD KEY PAIR digiusher_reader_p384_new
       PUBLIC_KEY = '<new-public-key>';

3. Update the Private Key in DigiUsher with the new private key.
4. Once DigiUsher reconnects successfully, remove the old key pair:

   ALTER USER digiusher_reader DROP KEY PAIR digiusher_reader_p384;

Revocation

To immediately revoke DigiUsher's access, drop the user:

USE ROLE ACCOUNTADMIN;
DROP USER digiusher_reader;
DROP ROLE digiusher_reader_role;

Alternatively, to suspend access temporarily without dropping the user:

ALTER USER digiusher_reader SET DISABLED = TRUE;

Troubleshooting

GRANT DATABASE ROLE fails with "Insufficient privileges"

• The ORGANIZATION_* database roles require the executing user to have the ORGADMIN role in addition to ACCOUNTADMIN. Run USE ROLE ORGADMIN; before the failing statements, or grant ORGADMIN to your user (Step 1) and retry.

Authentication failure (key-pair)

• Verify the private key entered in DigiUsher is from the same ECDSA P-384 key pair whose public key was registered via ALTER USER ... ADD KEY PAIR — they must match.
• If you regenerated the key pair but only registered the new public key without updating DigiUsher's private key (or vice versa), authentication will fail. Ensure both are updated together.

SNOWFLAKE.ORGANIZATION_USAGE views return no rows

• Organization-level views are only populated for accounts enrolled in Snowflake's organization features. Confirm your account is part of an organization: SELECT CURRENT_ORGANIZATION_NAME(); should return a non-null value.
• Some views may have a 24-hour lag. If the account was very recently provisioned, wait one day and retry.

GRANT IMPORTED PRIVILEGES fails

• This grant requires the role executing it to be ACCOUNTADMIN. Verify your session role with SELECT CURRENT_ROLE(); before running the grant.

Warehouse access denied

• Confirm GRANT USAGE ON WAREHOUSE <warehouse> TO ROLE digiusher_reader_role was applied to the correct warehouse name (case-insensitive, but must match exactly).
• Run SHOW GRANTS TO ROLE digiusher_reader_role; to verify all expected grants are present.

No cost data visible after connection

• Run the verification query below to confirm the service account can see data before reporting an issue:

  SELECT * FROM SNOWFLAKE.ORGANIZATION_USAGE.USAGE_IN_CURRENCY_DAILY
  ORDER BY USAGE_DATE DESC LIMIT 5;

  
• If this returns rows when run as digiusher_reader but DigiUsher shows no data, contact support with the connection name and the output of SHOW GRANTS TO ROLE digiusher_reader_role;.

Need Help?

If you encounter any issues not covered above, contact DigiUsher support at support@digiusher.com and the team will help you get set up.