> ## Documentation Index
> Fetch the complete documentation index at: https://learn.kubit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Snowflake

> Create a KUBIT role, user, database and warehouse in Snowflake so Kubit queries your data in place with key pair auth.

Kubit connects directly to Snowflake and queries your data in place. You create a dedicated role, user, database and warehouse, all named `KUBIT`, then grant the role read-only access to the schemas Kubit should see. Nothing is copied out of your account. The setup takes about 20 minutes.

## Before you start

* [ ] A Snowflake role that can create roles, users, databases and warehouses (`ACCOUNTADMIN`, or `SECURITYADMIN` plus `SYSADMIN`)
* [ ] `openssl` on your machine, to generate the key pair
* [ ] The schemas that hold the tables or views Kubit should query
* [ ] If your Snowflake account has a network policy, Kubit's IP ranges. See [Allow Kubit's IP ranges](https://learn.kubit.ai/warehouses/ip-allowlist.md).

## Steps

### 1. Create a role

Create a role named `KUBIT`.

```sql theme={null}
CREATE ROLE KUBIT;
```

### 2. Generate a key pair

Kubit authenticates to Snowflake with key pair auth. Generate an encrypted private key and its public key. `openssl` asks for a passphrase. Keep it, since Kubit needs it with the private key.

```bash theme={null}
openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
```

Snowflake's key pair authentication guide covers the options.

### 3. Create a user

Create a user named `KUBIT` with the public key from the previous step. Paste the contents of `rsa_key.pub` without the `-----BEGIN PUBLIC KEY-----` and `-----END PUBLIC KEY-----` lines.

```sql theme={null}
CREATE USER KUBIT RSA_PUBLIC_KEY = '<contents-of-rsa_key.pub>' DEFAULT_ROLE = KUBIT;
GRANT ROLE KUBIT TO USER KUBIT;
```

### 4. Create a database

Kubit keeps a small auxiliary table in its own database to support some features. Create a database named `KUBIT` and make the `KUBIT` role its owner, so Kubit can create and run the tasks that need an owner role.

```sql theme={null}
CREATE DATABASE KUBIT;
GRANT OWNERSHIP ON DATABASE KUBIT TO ROLE KUBIT;
```

### 5. Create a warehouse

Create a warehouse named `KUBIT` and grant the `KUBIT` role `MONITOR`, `USAGE` and `OPERATE` on it. Start small. [Warehouse configuration](#warehouse-configuration) explains when to size up.

```sql theme={null}
CREATE OR REPLACE WAREHOUSE KUBIT
  WAREHOUSE_SIZE = 'XSMALL'
  AUTO_RESUME = TRUE
  AUTO_SUSPEND = 60
  INITIALLY_SUSPENDED = TRUE;
GRANT MONITOR ON WAREHOUSE KUBIT TO ROLE KUBIT;
GRANT USAGE ON WAREHOUSE KUBIT TO ROLE KUBIT;
GRANT OPERATE ON WAREHOUSE KUBIT TO ROLE KUBIT;
```

### 6. Grant read access

Give the `KUBIT` role read-only access to each schema that holds the views Kubit queries. The `FUTURE` grant covers views you add later. Replace `<database>` and `<schema>` with your own names.

```sql theme={null}
GRANT USAGE ON DATABASE <database> TO ROLE KUBIT;
GRANT USAGE ON SCHEMA <database>.<schema> TO ROLE KUBIT;
GRANT SELECT ON ALL VIEWS IN SCHEMA <database>.<schema> TO ROLE KUBIT;
GRANT SELECT ON FUTURE VIEWS IN SCHEMA <database>.<schema> TO ROLE KUBIT;
```

### 7. Add the connection in Kubit

Kubit needs four values: your Snowflake **account locator**, the **private key** (`rsa_key.p8`), the **key passphrase** and the **warehouse name** (`KUBIT`).

![Snowflake Connection setup form](https://mintcdn.com/kubit/9i8QHxqek50tMBGy/images/warehouse/snowflake.png?fit=max\&auto=format\&n=9i8QHxqek50tMBGy\&q=85\&s=a5027d1ae3c6153c309b1b81c0f01d0c)

For help with the setup, share the same four values with the Kubit team through a secure channel such as a password manager.

### 8. Split test and production (optional)

Create a second role, user and warehouse for development. Keeping development queries off the production warehouse avoids any impact on live workloads.

## Verify

Check the grants as an admin. The output lists `USAGE` and `SELECT` on your schemas, and `MONITOR`, `USAGE` and `OPERATE` on warehouse `KUBIT`.

```sql theme={null}
SHOW GRANTS TO ROLE KUBIT;
SHOW FUTURE GRANTS IN SCHEMA <database>.<schema>;
```

## Best practices

### Clustering keys

Kubit queries time series data, so cluster fact tables larger than 1 TB by date. Most Kubit reports also filter by event name, so add event name as the second clustering column. Snowflake's clustering keys reference covers the syntax.

### Warehouse configuration

Four warehouse settings affect Kubit's cost and speed.

| Setting | Recommendation |
| - | - |
| **Type** | Gen2, for analytical workloads |
| **Size** | Start small. Size up only when Query History shows it's needed. If reports are slow, open them in Query Profile and look for bytes spilled to disk above 0. Frequent spilling means the warehouse is too small. |
| **Auto resume** | On, so any Kubit query wakes the warehouse |
| **Auto suspend** | The minimum, 1 minute. A longer idle time saves a few seconds of wake-up on some reports and costs more. |

## Next steps

* [Bring your own warehouse](https://learn.kubit.ai/warehouses/overview.md): how Kubit queries your warehouse in place.
* [Allow Kubit's IP ranges](https://learn.kubit.ai/warehouses/ip-allowlist.md): let Kubit through a network policy or firewall.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.