# Snowflake | DRE

> The snowflake source: sign-in methods and connection settings.

You're reading the docs for DRE 0.4 (v0.4.4). [This page for 0.5](https://getdre.com/docs/plugin-snowflake/) · [New in 0.5](https://getdre.com/docs/new-in-0.5/)

# Snowflake

Snowflake: the `snowflake` source, from the `snowflake` package. Declare the package once in `dependencies.yml`; DRE installs it on demand:

dependencies.yml

```yaml
plugins:
  - snowflake
```

### Profile fields

Set in `profiles.yml`, under `connections:`, in a target with `type: snowflake`.

Field

Default

Notes

`account` (required)

Account identifier, e.g. myorg-myaccount (or a locator like xy12345.eu-west-1)

`user` (required)

The user to sign in as.

`authenticator`

How to sign in: snowflake (password, the default), username\_password\_mfa, externalbrowser, oauth, jwt, programmatic\_access\_token, workload\_identity, or an Okta URL; a private key means key-pair sign-in.

`password`

Password (or a programmatic access token) Secret: use `env_var()`.

`private_key_path`

Path to a key-pair private key (PEM), for key-pair sign-in. A file path; `~/` is your home directory.

`private_key`

A key-pair private key, inline (PEM, or base64 DER) Secret: use `env_var()`.

`private_key_passphrase`

The private key’s passphrase, if it’s encrypted. Secret: use `env_var()`.

`role`

Role to use.

`warehouse`

Warehouse to run queries on.

`database`

Default database.

`schema`

Default schema.

`token`

OAuth access token, JWT, programmatic access token, or OIDC token for workload identity. Secret: use `env_var()`.

`oauth_client_id`

OAuth client ID, to renew `token` as a refresh token.

`oauth_client_secret`

OAuth client secret, to renew `token` as a refresh token. Secret: use `env_var()`.

`workload_identity_provider`

For workload\_identity: AWS, AZURE, GCP or OIDC.

`workload_identity_entra_resource`

For workload\_identity on Azure: the Entra resource.

`query_tag`

Tag for every query of the session.

`client_session_keep_alive`

Keep the session alive while a long report runs.

`client_request_mfa_token`

Cache the MFA token (username\_password\_mfa) in the OS keychain.

`client_store_temporary_credential`

Cache the SSO token (externalbrowser) in the OS keychain.

`retries`

`3`

How many times to try connecting again after a temporary error (0: never)

`connect_retries`

Dbt’s name for `retries`

`connect_timeout`

`30s`

How long to wait for a connection (`30s`, `2m`, or seconds) A duration (`30s`, `2m`) or seconds.

`host`

Snowflake host, when not .snowflakecomputing.com.

`port`

Port, with host.

`protocol`

Https (default) or http, with host.

`insecure_mode`

Skip the certificate revocation check.

`proxy_host`

HTTP proxy host.

`proxy_port`

HTTP proxy port.

## Notes

An alpha: `snowflake` is published as 1.0.0 pre-releases (`1.0.0-alpha.N`), which `dre deps` installs while there’s no stable release. It hasn’t yet run against a real Snowflake account. Field names and values are dbt-snowflake’s, so a dbt profile can be copied across.

Field

Notes

`account`

Required. The account identifier, e.g. `myorg-myaccount`.

`user`

Required.

`authenticator`

How to sign in: `snowflake` (password, the default), `username_password_mfa`, `externalbrowser`, `oauth`, `jwt`, `programmatic_access_token`, `workload_identity`, or an Okta URL (`https://<org>.okta.com`). A private key means key-pair sign-in.

`password`

For password, MFA and Okta sign-in. A programmatic access token also works here.

`private_key_path`, `private_key`

Key-pair sign-in: a key file, or the key inline (PEM, or base64 DER).

`private_key_passphrase`

For an encrypted key.

`token`

For `oauth` (an access token, or a refresh token with `oauth_client_id` and `oauth_client_secret`), `jwt`, `programmatic_access_token`, and `workload_identity` with OIDC.

`workload_identity_provider`, `workload_identity_entra_resource`

For `workload_identity`: `AWS`, `AZURE`, `GCP` or `OIDC`, and on Azure the Entra resource.

`role`, `warehouse`, `database`, `schema`

The session’s defaults.

`query_tag`

Tags every query of the session.

`client_session_keep_alive`

Keep the session alive through a long report.

`client_request_mfa_token`, `client_store_temporary_credential`

Let the driver cache the MFA token and the SSO token in the OS keychain (on by default on macOS and Windows).

`retries` (dbt’s `connect_retries`), `connect_timeout`

How many times to try connecting again, and how long each attempt may take (a duration such as `30s`, or seconds). Defaults 3 and `30s`.

`host`, `port`, `protocol`, `proxy_host`, `proxy_port`, `insecure_mode`

Connection details for unusual networks.

```yaml
connections:
  sf:
    targets:
      dev:        # you, through your company's SSO
        type: snowflake
        account: myorg-myaccount
        user: me@example.com
        authenticator: externalbrowser
        role: REPORTER
        warehouse: REPORTING_WH
        database: ANALYTICS
        schema: MARTS
      prod:       # a service user with a key pair
        type: snowflake
        account: myorg-myaccount
        user: DRE_SVC
        private_key_path: /secrets/dre_svc.p8
        private_key_passphrase: "{{ env_var('DRE_SECRET_SF_KEY_PASSPHRASE') }}"
        role: REPORTER
        warehouse: REPORTING_WH
        database: ANALYTICS
        schema: MARTS
```

Capabilities: `sessions`, `check` (via `EXPLAIN`), `load`. One connection is one Snowflake session, held for the whole Binding. `load` creates a temporary table from one SQL statement, with a warning; it needs a current database and schema.

The driver keeps the SSO and MFA token cache, as it does for dbt; DRE writes nothing to `~/.dre` for Snowflake. `connections.toml` isn’t read. Set `SNOWFLAKE_LOG_LEVEL` (e.g. `DEBUG`) to see the driver’s log.

To make reports visible inside Snowflake, deliver them to the bucket behind an external stage with the `s3`, `gcs` or `azure_blob` destination; there’s no Snowflake stage destination.

The package is written in Go, on Snowflake’s official Go driver (`gosnowflake`).

## Test the chosen role and warehouse

The dev profile above shows a browser-authenticated connection. Use the [tutorial](https://github.com/get-dre/dre/blob/v0.4.4/examples/tutorial/) project structure with `snowflake` declared and `select 1 as connection_check` as its result SQL. `dre validate --live <report>` checks the statement before a preview run. Adapt the [monthly finance workbook](https://github.com/get-dre/dre/blob/v0.4.4/examples/monthly-finance/) to Snowflake tables and dialect after that; replace any DuckDB-specific SQL. These are configuration recipes, not a claim that the alpha has been live-tested on Snowflake.

`invalid-connection-setting` needs the profile repaired before connecting. `connection-failed` can mean an account identifier or sign-in method mismatch; a scheduler needs a noninteractive identity rather than `externalbrowser`. `query-failed` with a missing current schema needs `database` and `schema` set for lookup loading, or fully qualified table names. Check that `role` can use `warehouse` and read the data. See [profiles](https://getdre.com/docs/v0.4/reference-profiles/), [error codes](https://getdre.com/docs/v0.4/reference-error-codes/), [connection](https://getdre.com/docs/v0.4/glossary/#connection) and [lookup](https://getdre.com/docs/v0.4/glossary/#lookup).

[Previous  
Slack](https://getdre.com/docs/v0.4/plugin-slack/)[Next  
Microsoft Teams](https://getdre.com/docs/v0.4/plugin-teams/)