Skip to main content

Connect Snowflake to Anzenna

Integrate Anzenna with Snowflake to monitor data warehouse access, query activity, and user authentication events.

Prerequisites​

  • Snowflake ACCOUNTADMIN role access
  • Anzenna account
  • Ability to execute SQL in Snowflake
  • Snowflake account identifier

Overview​

The integration provides:

  • Query history monitoring
  • User authentication logs
  • Data access patterns
  • Login history tracking
  • Optional: Network policy restrictions
  • Role and grant auditing

Step-by-Step Instructions​

Part 1: Enable Integration in Anzenna​

  1. Log into Anzenna at

    app.anzenna.ai

  2. Navigate to Settings > Integrations

  3. Find the Snowflake integration card

  4. Toggle the switch to enable the integration

  5. Copy the public key displayed
Public Key Purpose

The public key will be used to establish secure authentication between Anzenna and Snowflake using key-pair authentication.

Part 2: Create Service User in Snowflake​

  1. Open Snowflake in your browser

  2. Navigate to Worksheets and open a new SQL Worksheet

  3. Execute the following SQL script to create the ANZENNA service user:

  -- Create Anzenna service user
  CREATE USER ANZENNA
   TYPE = SERVICE
   DEFAULT_ROLE = PUBLIC
   RSA_PUBLIC_KEY = '<paste-public-key-here>'
   COMMENT = 'Service user for Anzenna integration';

Replace <paste-public-key-here> with the public key you copied from Anzenna (step 5)

Run All Statements

Make sure to click Run All (not just Run) to execute the complete script including all necessary permissions.

Part 3: Grant Permissions​

  1. Grant the ANZENNA user access to LOGIN_HISTORY:

  -- Grant access to account usage views
  GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE PUBLIC;

Or, if using a custom role:

  -- Create custom role for Anzenna
  CREATE ROLE ANZENNA_MONITOR;

  -- Grant necessary privileges
  GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE ANZENNA_MONITOR;

  -- Assign role to user
  GRANT ROLE ANZENNA_MONITOR TO USER ANZENNA;

  -- Set as default role
  ALTER USER ANZENNA SET DEFAULT_ROLE = ANZENNA_MONITOR;
Custom Role

Using a custom role provides better security isolation. See Snowflake documentation for detailed role setup.

  1. Restrict access to Anzenna's IP for enhanced security:

  -- Create network policy for Anzenna
  CREATE NETWORK POLICY ANZENNA_POLICY
  ALLOWED_IP_LIST = ('35.212.173.22');

  -- Apply policy to ANZENNA user ALTER
  USER ANZENNA SET NETWORK_POLICY = ANZENNA_POLICY;

This ensures only Anzenna's servers can authenticate as the ANZENNA user.

Part 5: Complete Connection in Anzenna​

  1. Return to Anzenna > Integrations > Snowflake

  2. Enter your Snowflake account identifier:

Format: <orgname>-<accountname>

  • Examples:
    • acme-prod
    • company-analytics
    • org-account123
Finding Your Account Identifier

Your account identifier appears in your Snowflake URL:

https://<orgname>-<accountname>.snowflakecomputing.com

  1. Enter the username: 

    ANZENNA

  2. Click Connect

  3. Verify the connection shows as Connected successfully

Verification​

  1. Check integration status shows Connected

  2. Wait 15-30 minutes for initial sync

  3. Navigate to Anzenna's Data Warehouse dashboard

  4. Verify Snowflake query activity is appearing

  5. Review login history events are syncing

What Data is Collected​

Login History​

  • Successful authentications
  • Failed login attempts
  • Client applications used
  • IP addresses
  • Timestamps

Query History​

  • Query text (configurable)
  • Execution times
  • Data scanned
  • User who executed
  • Warehouse used

Session Information​

  • Active sessions
  • Session duration
  • Authentication methods
  • Role switches

Access Patterns​

  • Database access
  • Schema usage
  • Table query frequency
  • Data export activities

Security Considerations​

Key-Pair Authentication​

  • Public key auth - More secure than password

  • No password storage - Anzenna never has password

  • Automatic key rotation - Keys can be rotated easily

  • Audit trail - All access logged in Snowflake

Network Policy​

Recommended security measures:

  • Restrict to Anzenna IP: 35.212.173.22

  • Monitor for unauthorized access attempts
  • Review access logs regularly
  • Set up alerts for anomalous activity

Principle of Least Privilege​

The ANZENNA user only needs:

  • Read access to LOGIN_HISTORY view
  • Read access to QUERY_HISTORY view
  • No data modification permissions
  • No administrative capabilities

Troubleshooting​

Connection Fails​

Authentication errors:

  • Verify public key was pasted correctly (no extra spaces/breaks)

  • Ensure RSA_PUBLIC_KEY format is correct

  • Check ANZENNA user was created successfully

  • Verify account identifier format is correct

Public Key Errors​

Invalid key format:

  • Copy entire public key from Anzenna
  • Remove any line breaks or spaces
  • Ensure key starts with proper header
  • Try regenerating key in Anzenna

No Data Appearing​

Query history not syncing:

  • Verify IMPORTED PRIVILEGES were granted

  • Check that SNOWFLAKE database access is enabled

  • Ensure account has query activity to monitor

  • Wait 30 minutes for initial data collection

  • Review Snowflake query history directly

Network Policy Issues​

Connection blocked:

  • Verify IP address is exactly: 35.212.173.22

  • Check network policy is applied to correct user

  • Ensure no conflicting network rules

  • Test without network policy first, then add

Account Identifier Problems​

Cannot connect:

  • Verify format is orgname-accountname

  • Check for typos in identifier
  • Remove any URLs or extra text
  • Confirm identifier matches Snowflake URL

Best Practices​

  1. Use custom role — Better isolation than PUBLIC role

  2. Enable network policy — Restrict to Anzenna IP

  3. Monitor initially — Check for errors in first 48 hours

  4. Document setup — Record account identifier and configuration

  5. Regular audits — Review integration quarterly

  6. Key rotation — Plan for annual key updates

  7. Test queries — Verify correct data is accessible

Integration Maintenance​

Regular Checks​

Perform monthly:

  • Verify connection status
  • Review query coverage
  • Check for any errors
  • Test sample data queries

Key Rotation​

To rotate public keys:

  1. Generate new key pair in Anzenna

  2. Update ANZENNA user in Snowflake with new public key

  3. Test connection with new key
  4. Remove old key after verification

SQL for key update:

  ALTER USER ANZENNA SET RSA_PUBLIC_KEY = '&lt;new-public-key&gt;';

Permission Audits​

Quarterly review:

  • Verify ANZENNA user permissions haven't changed

  • Check network policy is still applied
  • Review access logs for anomalies

  • Ensure integration still meets security requirements

Advanced Configuration​

Custom Role Setup​

For organizations requiring stricter access control:

  -- Create dedicated role
  CREATE ROLE ANZENNA_MONITOR;

  -- Grant specific view access
  GRANT USAGE ON DATABASE SNOWFLAKE TO ROLE ANZENNA_MONITOR;
  GRANT USAGE ON SCHEMA SNOWFLAKE.ACCOUNT_USAGE TO ROLE ANZENNA_MONITOR;
  GRANT SELECT ON VIEW SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY TO ROLE ANZENNA_MONITOR;
  GRANT SELECT ON VIEW SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY TO ROLE ANZENNA_MONITOR;

  -- Assign to user
  GRANT ROLE ANZENNA_MONITOR TO USER ANZENNA;
  ALTER USER ANZENNA SET DEFAULT_ROLE = ANZENNA_MONITOR;

Monitoring Multiple Accounts​

If you have multiple Snowflake accounts:

  • Create separate integrations in Anzenna for each

  • Use different service users in each account

  • Apply consistent security policies

  • Monitor all accounts from single Anzenna dashboard

Snowflake Editions​

The integration works with all Snowflake editions:

  • Standard - Basic monitoring

  • Enterprise - Enhanced features

  • Business Critical - Full capabilities

  • VPS - All features with added isolation

Need help? Contact

Anzenna Support

for assistance.