Snowflake

Snowflake: the snowflake source, from the snowflake package. Declare the package once in dependencies.yml; DRE installs it on demand:

dependencies.yml

plugins:
  - snowflake

Profile fields

Set in profiles.yml, under connections:, in a target with type: snowflake.

Field	Default	Notes
account (required)		Account identifier, e.g. myorg-myaccount (or a locator like xy12345.eu-west-1)
user (required)		The user to sign in as.
authenticator		How to sign in: snowflake (password, the default), username_password_mfa, externalbrowser, oauth, jwt, programmatic_access_token, workload_identity, or an Okta URL; a private key means key-pair sign-in.
password		Password (or a programmatic access token) Secret: use env_var().
private_key_path		Path to a key-pair private key (PEM), for key-pair sign-in. A file path; ~/ is your home directory.
private_key		A key-pair private key, inline (PEM, or base64 DER) Secret: use env_var().
private_key_passphrase		The private key’s passphrase, if it’s encrypted. Secret: use env_var().
role		Role to use.
warehouse		Warehouse to run queries on.
database		Default database.
schema		Default schema.
token		OAuth access token, JWT, programmatic access token, or OIDC token for workload identity. Secret: use env_var().
oauth_client_id		OAuth client ID, to renew token as a refresh token.
oauth_client_secret		OAuth client secret, to renew token as a refresh token. Secret: use env_var().
workload_identity_provider		For workload_identity: AWS, AZURE, GCP or OIDC.
workload_identity_entra_resource		For workload_identity on Azure: the Entra resource.
query_tag		Tag for every query of the session.
client_session_keep_alive		Keep the session alive while a long report runs.
client_request_mfa_token		Cache the MFA token (username_password_mfa) in the OS keychain.
client_store_temporary_credential		Cache the SSO token (externalbrowser) in the OS keychain.
retries	3	How many times to try connecting again after a temporary error (0: never)
connect_retries		Dbt’s name for retries
connect_timeout	30s	How long to wait for a connection (30s, 2m, or seconds) A duration (30s, 2m) or seconds.
host		Snowflake host, when not .snowflakecomputing.com.
port		Port, with host.
protocol		Https (default) or http, with host.
insecure_mode		Skip the certificate revocation check.
proxy_host		HTTP proxy host.
proxy_port		HTTP proxy port.

Notes

An alpha: snowflake is published as 1.0.0 pre-releases (1.0.0-alpha.N), which dre deps installs while there’s no stable release. It hasn’t yet run against a real Snowflake account. Field names and values are dbt-snowflake’s, so a dbt profile can be copied across.

Field	Notes
account	Required. The account identifier, e.g. myorg-myaccount.
user	Required.
authenticator	How to sign in: snowflake (password, the default), username_password_mfa, externalbrowser, oauth, jwt, programmatic_access_token, workload_identity, or an Okta URL (https://<org>.okta.com). A private key means key-pair sign-in.
password	For password, MFA and Okta sign-in. A programmatic access token also works here.
private_key_path, private_key	Key-pair sign-in: a key file, or the key inline (PEM, or base64 DER).
private_key_passphrase	For an encrypted key.
token	For oauth (an access token, or a refresh token with oauth_client_id and oauth_client_secret), jwt, programmatic_access_token, and workload_identity with OIDC.
workload_identity_provider, workload_identity_entra_resource	For workload_identity: AWS, AZURE, GCP or OIDC, and on Azure the Entra resource.
role, warehouse, database, schema	The session’s defaults.
query_tag	Tags every query of the session.
client_session_keep_alive	Keep the session alive through a long report.
client_request_mfa_token, client_store_temporary_credential	Let the driver cache the MFA token and the SSO token in the OS keychain (on by default on macOS and Windows).
retries (dbt’s connect_retries), connect_timeout	How many times to try connecting again, and how long each attempt may take (a duration such as 30s, or seconds). Defaults 3 and 30s.
host, port, protocol, proxy_host, proxy_port, insecure_mode	Connection details for unusual networks.

connections:
  sf:
    targets:
      dev:        # you, through your company's SSO
        type: snowflake
        account: myorg-myaccount
        user: me@example.com
        authenticator: externalbrowser
        role: REPORTER
        warehouse: REPORTING_WH
        database: ANALYTICS
        schema: MARTS
      prod:       # a service user with a key pair
        type: snowflake
        account: myorg-myaccount
        user: DRE_SVC
        private_key_path: /secrets/dre_svc.p8
        private_key_passphrase: "{{ env_var('DRE_SECRET_SF_KEY_PASSPHRASE') }}"
        role: REPORTER
        warehouse: REPORTING_WH
        database: ANALYTICS
        schema: MARTS

Capabilities: sessions, check (via EXPLAIN), load. One connection is one Snowflake session, held for the whole Binding. load creates a temporary table from one SQL statement, with a warning; it needs a current database and schema.

The driver keeps the SSO and MFA token cache, as it does for dbt; DRE writes nothing to ~/.dre for Snowflake. connections.toml isn’t read. Set SNOWFLAKE_LOG_LEVEL (e.g. DEBUG) to see the driver’s log.

To make reports visible inside Snowflake, deliver them to the bucket behind an external stage with the s3, gcs or azure_blob destination; there’s no Snowflake stage destination.

The package is written in Go, on Snowflake’s official Go driver (gosnowflake).

Test the chosen role and warehouse

The dev profile above shows a browser-authenticated connection. Use the tutorial project structure with snowflake declared and select 1 as connection_check as its result SQL. dre validate --live <report> checks the statement before a preview run. Adapt the monthly finance workbook to Snowflake tables and dialect after that; replace any DuckDB-specific SQL. These are configuration recipes, not a claim that the alpha has been live-tested on Snowflake.

invalid-connection-setting needs the profile repaired before connecting. connection-failed can mean an account identifier or sign-in method mismatch; a scheduler needs a noninteractive identity rather than externalbrowser. query-failed with a missing current schema needs database and schema set for lookup loading, or fully qualified table names. Check that role can use warehouse and read the data. See profiles, error codes, connection and lookup.