Skip to main content

Snowflake Profiler Details

Prerequisites​

  • A Snowflake user that can authenticate with either a Programmatic Access Token (PAT) or key-pair authentication, and that can query the SNOWFLAKE.ACCOUNT_USAGE schema (e.g., the ACCOUNTADMIN role or a role granted IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE).
  • For key-pair auth, the matching public key must be registered on the Snowflake user. See Snowflake key-pair authentication.
  • The rate_sheet step also reads SNOWFLAKE.ORGANIZATION_USAGE.RATE_SHEET_DAILY for the effective credit rate and account tier. This is available to ACCOUNTADMIN in an ORGADMIN-enabled account (the first account in an organization is ORGADMIN-enabled by default, so single-account orgs are covered), or to a custom role granted the ORGANIZATION_BILLING_VIEWER database role. If the account isn't ORGADMIN-enabled — or the organization is on a reseller contract — the view returns no rows, so rate_sheet is skipped and the rest of the profile still completes.
  • Network access from the machine running Lakebridge to your Snowflake account.

Authentication​

The Snowflake profiler supports two authentication methods. Choose one when you run configure-database-profiler.

Programmatic Access Token (PAT)​

Follow Snowflake's official guide to generate a PAT:

Snowflake docs: Programmatic access tokens

You'll need:

  • account — your Snowflake account identifier (e.g., myorg-myaccount.snowflakecomputing.com)
  • user — Snowflake username
  • role, warehouse, database, schema — typically ACCOUNTADMIN, COMPUTE_WH, SNOWFLAKE, ACCOUNT_USAGE
  • The PAT itself (paste when prompted; it's stored under pat in the credentials file)

If your account or user has a network policy, also see Snowflake's docs on bypassing the network policy on a PAT for short-term testing from a dynamic IP.

Key-pair authentication​

Follow Snowflake's guide to create an RSA key pair and assign the public key to the user:

Snowflake docs: Key-pair authentication

You'll need:

  • The same account, user, role, warehouse, database, and schema fields as PAT auth
  • private_key_path — path to the PEM private key file on disk (e.g., /path/to/rsa_key.p8). Lakebridge stores the path, not the PEM contents.
  • private_key_passphrase — only if the private key is encrypted

Existing credentials files without auth_type continue to use PAT authentication (pat).

Configure and run the profiler​

databricks labs lakebridge configure-database-profiler

Pick snowflake when prompted, then choose PAT or Key-Pair and enter the connection details.

databricks labs lakebridge execute-database-profiler

The extract is written to a DuckDB file at ~/.databricks/labs/lakebridge_profilers/snowflake_assessment/profiler_extract.db. It contains raw SNOWFLAKE.ACCOUNT_USAGE data — warehouse usage, query history, storage, and (when applicable) pipe / autoclustering / materialized-view refresh credits. By default each extract looks back 90 days.

To keep extracts shareable on high-volume accounts, query_history includes metrics and QUERY_TYPE for every query in the window but omits QUERY_TEXT. A separate query_samples table holds a random sample of 10,000 rows with QUERY_TEXT (join to query_history on QUERY_ID for full metrics). Login history (user_activity) is not extracted.

Inspect it with:

cd ~/.databricks/labs/lakebridge_profilers/snowflake_assessment
duckdb profiler_extract.db "SHOW TABLES;"
duckdb profiler_extract.db "SELECT * FROM warehouse_usage LIMIT 10;"
duckdb profiler_extract.db "SELECT * FROM query_history LIMIT 10;"
duckdb profiler_extract.db "SELECT query_id, query_type, left(query_text, 80) FROM query_samples LIMIT 10;"