Snowflake Connector

Connect your Snowflake data warehouse to Roe to query transaction data, customer information, and other structured data during agent investigations.

Use Cases

AML/Fraud Investigation: Query transaction history and customer data during investigations
Data Analysis: Enable agents to explore and analyze data using natural language queries
Context Enrichment: Provide agents with access to your data warehouse for comprehensive analysis

Prerequisites

Before connecting Snowflake to Roe, ensure you have:

A Snowflake account with appropriate permissions
A Programmatic Access Token (PAT) OR an RSA Key Pair for authentication
Access to a warehouse, database, and schema

Authentication Methods

Roe supports two authentication methods for Snowflake: Programmatic Access Tokens (PAT) and RSA Key Pair authentication. Both methods bypass MFA and are recommended for programmatic access.

Option 1: Programmatic Access Token (PAT)

Open Snowsight

Navigate to Profile

Click on your user menu (top-right) → My Profile

Go to Authentication

Select the Authentication tab

Generate Token

Under Programmatic access tokens, click Generate new token

Save Token

Copy the token immediately—it’s only shown once!

Option 2: RSA Key Pair Authentication

You can generate an RSA key pair locally and register the public key with your Snowflake user.

Generate Key Pair Locally

Run the following OpenSSL commands in your terminal to generate an encrypted private key and a public key:

# Generate an encrypted private key (you will be prompted to create a passphrase)
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out snowflake_private_key.p8

# Generate the public key
openssl rsa -in snowflake_private_key.p8 -pubout -out snowflake_public_key.pub

Note: If you prefer an unencrypted private key, append -nocrypt to the first command.

Format the Public Key

Snowflake requires the public key body without the header, footer, or newlines. Extract it using:

awk 'NR > 1 && !/-----END PUBLIC KEY-----/ { printf "%s", $0 }' snowflake_public_key.pub

Copy the output.

Log into Snowflake as an admin (e.g., USERADMIN or ACCOUNTADMIN) and run the following SQL:

ALTER USER your_snowflake_username
SET RSA_PUBLIC_KEY = '<paste-public-key-body-here>';

Verify it was set correctly by running DESC USER your_snowflake_username;.

Store your PAT or Private Key securely. Roe encrypts and stores credentials in AWS Secrets Manager.

Configure the Connection

Provide the following information to connect Snowflake:

Authentication (Sensitive)

Choose your authentication method from the dropdown and provide the corresponding fields:

Field	Required	Description
Account	Yes	Snowflake account identifier (e.g., `xy12345.us-east-1`)
Username	Yes	Your Snowflake username
Authentication Method	Yes	Choose either Programmatic Access Token or Key Pair
Token	Conditional	The PAT (required if using Token auth)
Private Key	Conditional	The full PEM-encoded RSA private key including header/footer (required if using Key Pair auth)
Private Key Passphrase	Conditional	The passphrase for your encrypted private key (required if using Key Pair auth with an encrypted key)

Configuration

Field	Required	Description
Warehouse	Yes	Snowflake warehouse (compute resource) to use for queries
Database	Yes	Default database to use for queries
Schema	Yes	Schema (namespace) within the database. `PUBLIC` is a common default
Role	No	Snowflake role for access control

The schema hierarchy in Snowflake is: Account → Database → Schema → TableFor example, PROD_DB.PUBLIC.CUSTOMERS means:

Database: PROD_DB
Schema: PUBLIC
Table: CUSTOMERS

Test the Connection

Click Test Connection to verify that Roe can successfully connect to your Snowflake instance. The test will:

Authenticate using your PAT or Key Pair
Verify access to the specified warehouse, database, and schema
Run a simple query to confirm connectivity

Using Snowflake as a Context Source

Once connected, you can use your Snowflake connection as a context source in agentic workflows like AML Investigation or Fraud Investigation.

Context Source Configuration

When configuring an agent to use Snowflake:

{
  "connection_type": "snowflake",
  "name": "Transaction History",
  "connection_id": "your-connection-uuid",
  "table": "TRANSACTIONS",
  "description": "Customer transaction data for the last 12 months"
}

Field	Description
`name`	Friendly name for this data source
`connection_id`	UUID of your Snowflake connection
`table`	Table to query (agent generates SELECT queries with filters)
`description`	Helps the agent understand what data is available

Agent Capabilities

When Snowflake is configured as a context source, agents can:

Discover schema: Automatically understand table structure
Generate SQL: Create appropriate queries based on natural language
Filter data: Apply relevant filters (e.g., customer ID, date ranges)
Handle errors: Recover from query issues gracefully

Security Best Practices

Use Secure Auth

PATs and Key Pair auth are more secure than passwords and can be revoked independently

Limit Permissions

Create a dedicated role with read-only access to only the required tables

Use Separate Warehouse

Use a dedicated warehouse for Roe to manage resource usage

Monitor Usage

Review Snowflake query history to audit agent data access

Troubleshooting

Connection failed: Invalid credentials

Verify your account identifier, username, and PAT or Private Key/Passphrase are correct. PATs expire and may need to be regenerated. If using a Key Pair, ensure the public key matches.

Connection failed: Warehouse not found

Ensure the warehouse name is correct and your user has USAGE permission on the warehouse.

Connection failed: Database/Schema not found

Verify the database and schema exist and your user has appropriate permissions to access them.

Query timeout

Queries have a 30-second timeout. If your queries are timing out, consider optimizing table indexes or filtering to smaller datasets.

Get Started

Agents

SQL Workspace

Data Resources

Policies

Webhooks

MCP Server

Enterprise

Use Cases

Release Notes

Use Cases

Prerequisites

Authentication Methods

Option 1: Programmatic Access Token (PAT)

Option 2: RSA Key Pair Authentication

Configure the Connection

Authentication (Sensitive)

Configuration

Test the Connection

Using Snowflake as a Context Source

Context Source Configuration

Agent Capabilities

Security Best Practices

Use Secure Auth

Limit Permissions

Use Separate Warehouse

Monitor Usage

Troubleshooting

​Use Cases

​Prerequisites

​Authentication Methods

​Option 1: Programmatic Access Token (PAT)

​Option 2: RSA Key Pair Authentication

​Configure the Connection

​Authentication (Sensitive)

​Configuration

​Test the Connection

​Using Snowflake as a Context Source

​Context Source Configuration

​Agent Capabilities

​Security Best Practices

Use Secure Auth

Limit Permissions

Use Separate Warehouse

Monitor Usage

​Troubleshooting

Use Cases

Prerequisites

Authentication Methods

Option 1: Programmatic Access Token (PAT)

Option 2: RSA Key Pair Authentication

Configure the Connection

Authentication (Sensitive)

Configuration

Test the Connection

Using Snowflake as a Context Source

Context Source Configuration

Agent Capabilities

Security Best Practices

Troubleshooting