Snowflake - AnomalyArmor

Connect AnomalyArmor to your Snowflake data warehouse to monitor schemas, track freshness, and detect schema drift across your tables and views.

Requirements

Before connecting, ensure you have:

Snowflake account with database access
Virtual warehouse for query execution
User with SELECT permissions on information_schema and target schemas
Network access from AnomalyArmor to your Snowflake account

Connection Settings

Field	Description	Example
Connection Name	Friendly identifier	`Snowflake Production`
Account	Snowflake account identifier	`xy12345.us-east-1.aws`
Database	Database (catalog) to monitor	`PRODUCTION_DB`
Warehouse	Virtual warehouse name	`COMPUTE_WH`
Username	Snowflake user account	`anomalyarmor_user`
Password	User password	`••••••••`
Schema (Optional)	Default schema	`PUBLIC`
Role (Optional)	Role to use	`ANOMALYARMOR_ROLE`

Finding Your Account Identifier

Your account identifier format depends on your cloud provider and region:

Cloud Provider	Format
Standard (AWS)	`xy12345.us-east-1.aws`
Azure	`xy12345.east-us-2.azure`
GCP	`xy12345.us-central1.gcp`

Find your account identifier in the Snowflake web interface URL:

Snowflake URL showing account identifier xy12345.us-east-1.aws

Include the full account identifier with region and cloud provider. Using just the account locator (e.g., xy12345) may not work for all regions.

Creating a Read-Only User

Create a dedicated user and role with minimal permissions.

Quick Setup: Download the Snowflake permissions script for a ready-to-use SQL template with role and user setup.

-- Create a read-only role for AnomalyArmor
CREATE ROLE IF NOT EXISTS ANOMALYARMOR_ROLE;

-- Grant database access
GRANT USAGE ON DATABASE your_database TO ROLE ANOMALYARMOR_ROLE;

-- Grant schema access (for all schemas)
GRANT USAGE ON ALL SCHEMAS IN DATABASE your_database TO ROLE ANOMALYARMOR_ROLE;
GRANT USAGE ON FUTURE SCHEMAS IN DATABASE your_database TO ROLE ANOMALYARMOR_ROLE;

-- Grant SELECT on all tables
GRANT SELECT ON ALL TABLES IN DATABASE your_database TO ROLE ANOMALYARMOR_ROLE;
GRANT SELECT ON FUTURE TABLES IN DATABASE your_database TO ROLE ANOMALYARMOR_ROLE;

-- Grant SELECT on all views
GRANT SELECT ON ALL VIEWS IN DATABASE your_database TO ROLE ANOMALYARMOR_ROLE;
GRANT SELECT ON FUTURE VIEWS IN DATABASE your_database TO ROLE ANOMALYARMOR_ROLE;

-- Grant warehouse usage
GRANT USAGE ON WAREHOUSE your_warehouse TO ROLE ANOMALYARMOR_ROLE;

-- Create user and assign role
CREATE USER IF NOT EXISTS anomalyarmor_user
  PASSWORD = 'your_secure_password'
  DEFAULT_ROLE = ANOMALYARMOR_ROLE
  DEFAULT_WAREHOUSE = your_warehouse;

GRANT ROLE ANOMALYARMOR_ROLE TO USER anomalyarmor_user;

Per-Schema Permissions

For more granular control:

-- Grant access to specific schemas only
GRANT USAGE ON SCHEMA your_database.raw TO ROLE ANOMALYARMOR_ROLE;
GRANT USAGE ON SCHEMA your_database.staging TO ROLE ANOMALYARMOR_ROLE;
GRANT USAGE ON SCHEMA your_database.marts TO ROLE ANOMALYARMOR_ROLE;

-- Grant SELECT per schema
GRANT SELECT ON ALL TABLES IN SCHEMA your_database.raw TO ROLE ANOMALYARMOR_ROLE;
GRANT SELECT ON ALL TABLES IN SCHEMA your_database.staging TO ROLE ANOMALYARMOR_ROLE;
GRANT SELECT ON ALL TABLES IN SCHEMA your_database.marts TO ROLE ANOMALYARMOR_ROLE;

Authentication Methods

Password Authentication
Key-Pair Authentication (Recommended)

Standard username/password authentication. Simplest setup for getting started.In AnomalyArmor:

Enter your username and password
No additional configuration required

More secure authentication using RSA key pairs. Recommended for production.Step 1: Generate Key Pair

# Generate private key (unencrypted for automation)
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out snowflake_key.p8 -nocrypt

# Generate public key
openssl rsa -in snowflake_key.p8 -pubout -out snowflake_key.pub

# View public key (for Snowflake)
cat snowflake_key.pub

Step 2: Assign Public Key to User

-- Remove the header/footer lines from the public key
ALTER USER anomalyarmor_user SET RSA_PUBLIC_KEY='MIIBIjANBgkqhki...';

Step 3: Configure in AnomalyArmor

Set Authenticator to snowflake_jwt
Provide the contents of snowflake_key.p8 as the Private Key
If your key is encrypted, provide the Private Key Passphrase
Leave password field empty

For encrypted keys, generate with: openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 aes256 -inform PEM -out snowflake_key.p8

Key-pair authentication is more secure because:

No password to rotate
Keys can’t be phished
Supports hardware security modules

Virtual Warehouse Considerations

Warehouse Sizing

AnomalyArmor runs lightweight metadata queries. Recommended warehouse configuration:

Environment	Size	Notes
Development	X-Small	Sufficient for testing
Production	Small	Faster query execution

Auto-Suspend Configuration

Enable auto-suspend to minimize costs:

-- Configure warehouse for auto-suspend (1-5 minutes recommended)
ALTER WAREHOUSE your_warehouse SET
  AUTO_SUSPEND = 60       -- Suspend after 60 seconds idle
  AUTO_RESUME = TRUE      -- Resume automatically on query
  INITIALLY_SUSPENDED = TRUE;

AnomalyArmor queries typically complete in under a second. With 1-minute auto-suspend, you’ll pay only for actual query time.

Cost Estimation

Metric	Value
Query duration	< 1 second per discovery
With 1-min auto-suspend	~$0.01-0.05 per discovery
Hourly monitoring	~$15-30/month

Network Policies

If your Snowflake account uses network policies, add AnomalyArmor’s IP addresses:

-- View existing network policies
SHOW NETWORK POLICIES;

-- Add AnomalyArmor IPs to your allowlist
ALTER NETWORK POLICY your_policy SET
  ALLOWED_IP_LIST = ('34.xxx.xxx.xxx/32', '35.xxx.xxx.xxx/32', ...);

Find AnomalyArmor’s current IP addresses in Settings > Security in the AnomalyArmor dashboard.

What We Monitor

AnomalyArmor discovers and monitors these Snowflake objects:

Object Type	Monitored	Notes
Tables	Yes	Including managed and external
Views	Yes	Standard and materialized
Schemas	Yes	Schema-level metadata
Stages	No	External/internal stages not monitored
Streams	No	Change data capture not monitored
Tasks	No	Scheduled tasks not monitored

Metadata Captured

For each table and view:

Table name and schema
Column names and data types
Nullability and default values
Last modified timestamp (for freshness)
Partition information (where applicable)

Multiple Databases

To monitor multiple databases, create separate data sources for each:

Data Source	Database
Snowflake Production	`PRODUCTION_DB`
Snowflake Staging	`STAGING_DB`
Snowflake Analytics	`ANALYTICS_DB`

Each data source needs access to its respective database. Use the same credentials if they have permissions across databases.

Connection Architecture

What We Query

AnomalyArmor runs these types of queries:

-- List tables and views
SELECT table_catalog, table_schema, table_name, table_type
FROM YOUR_DATABASE.INFORMATION_SCHEMA.TABLES
WHERE table_schema NOT IN ('INFORMATION_SCHEMA');

-- Get column details
SELECT column_name, data_type, is_nullable, column_default
FROM YOUR_DATABASE.INFORMATION_SCHEMA.COLUMNS
WHERE table_schema = 'YOUR_SCHEMA' AND table_name = 'YOUR_TABLE';

-- Check freshness (for tables with timestamp columns)
SELECT MAX(your_timestamp_column) FROM your_table;

Impact: Minimal. These are metadata queries that don’t scan table data.

Troubleshooting

Connection test fails

Common causes:

Invalid account identifier
Wrong username or password
Warehouse doesn’t exist or is suspended

Solutions:

Verify account identifier includes region and cloud (e.g., xy12345.us-east-1.aws)
Test credentials in Snowflake web interface first
Ensure warehouse exists: SHOW WAREHOUSES;
Resume warehouse if suspended: ALTER WAREHOUSE your_wh RESUME;

Incorrect username or password

Causes:

Typo in credentials
User doesn’t exist
Password expired

Solutions:

Verify user exists: SHOW USERS LIKE 'anomalyarmor%';
Reset password if needed
For key-pair auth, verify public key is assigned to user

Account not found

Causes:

Missing region or cloud in account identifier
Account locator typo

Solutions:

Get full account identifier from Snowflake URL
Include region and cloud: xy12345.us-east-1.aws
Try alternative formats if needed

Warehouse does not exist

Causes:

Typo in warehouse name
User lacks USAGE on warehouse
Warehouse was deleted

Solutions:

List warehouses: SHOW WAREHOUSES;
Grant usage: GRANT USAGE ON WAREHOUSE wh TO ROLE role;
Check warehouse name is exact match (case-sensitive)

IP address blocked

Causes:

Network policy restricting access
AnomalyArmor IPs not allowlisted

Solutions:

Check network policies: SHOW NETWORK POLICIES;
Add AnomalyArmor IPs to allowlist
Contact your Snowflake admin for policy changes

Role does not exist

Causes:

Role typo
Role was deleted
User not granted the role

Solutions:

List roles: SHOW ROLES;
Check grants: SHOW GRANTS TO USER your_user;
Grant role: GRANT ROLE role TO USER user;

No tables found in discovery

Causes:

User lacks SELECT permissions
Schema filter excluding all schemas
Empty database

Solutions:

Test query as user: SELECT * FROM your_db.INFORMATION_SCHEMA.TABLES LIMIT 5;
Check grants: SHOW GRANTS TO ROLE your_role;
Grant SELECT on schemas: GRANT SELECT ON ALL TABLES IN SCHEMA schema TO ROLE role;

Best Practices

Use Dedicated Service Account

Create a dedicated user for AnomalyArmor rather than using personal accounts:

Dedicated users persist regardless of employee changes
Easier to audit and manage permissions
Can be easily rotated or disabled

Use Key-Pair Authentication for Production

Password authentication works but key-pair is more secure:

No password to rotate
Keys can’t be phished
Better audit trail
Supports hardware security modules

Monitor Your Production Database

Start with your production database where schema changes have the most impact:

Priority	Database	Importance
1	Production database	Critical
2	Staging database	Important
3	Development databases	Optional

Choose the Right Warehouse Size

Metadata queries are lightweight. X-Small is sufficient but Small provides faster startup:

Warehouse Size	Credit/Hour	Recommendation
X-Small	1	Development
Small	2	Production

Common Questions

How much Snowflake credit does AnomalyArmor consume?

Minimal. Discovery runs metadata queries against information_schema.tables/columns which auto-suspend the warehouse promptly. Typical daily consumption is under 1 credit on an X-Small warehouse. Use a dedicated X-Small warehouse for AnomalyArmor to keep cost visibility clean.

What’s the correct format for the Snowflake account identifier?

Include the full account.region.cloud format (e.g., xy12345.us-east-1.aws), not just the account locator. The URL in your Snowflake web interface shows it: https://app.snowflake.com/<region>/<account>/.... Getting this wrong is the most common first-connect error.

Can AnomalyArmor monitor multiple Snowflake databases (catalogs) with one connection?

Not today. Connect each Snowflake database as a separate data source. A shared ANOMALYARMOR_ROLE with USAGE on multiple databases simplifies permission setup across them.

How do I give AnomalyArmor access to future tables in Snowflake?

Use FUTURE grants: GRANT SELECT ON FUTURE TABLES IN DATABASE <db> TO ROLE ANOMALYARMOR_ROLE (and likewise for FUTURE SCHEMAS and FUTURE VIEWS). New objects inherit SELECT automatically - no re-grant needed after each deploy. Sharing works but obscures cost attribution. A dedicated X-Small warehouse with AUTO_SUSPEND = 60 isolates AnomalyArmor’s credit usage and prevents unrelated queries from keeping the warehouse warm longer than needed.

Getting Started

Core Concepts

Data Sources

Detect Schema Changes

Monitor Data Health

Coverage Tiers

Get Notified

Understand Your Data

Organize & Tag

Guides

Account & Settings

Security

Help

Downloads

Documentation Index

​Requirements

​Connection Settings

​Finding Your Account Identifier

​Creating a Read-Only User

​Per-Schema Permissions

​Authentication Methods

​Virtual Warehouse Considerations

​Warehouse Sizing

​Auto-Suspend Configuration

​Cost Estimation

​Network Policies

​What We Monitor

​Metadata Captured

​Multiple Databases

​Connection Architecture

​What We Query

​Troubleshooting

​Best Practices

​Use Dedicated Service Account

​Use Key-Pair Authentication for Production

​Monitor Your Production Database

​Choose the Right Warehouse Size

​Common Questions

​How much Snowflake credit does AnomalyArmor consume?

​What’s the correct format for the Snowflake account identifier?

​Can AnomalyArmor monitor multiple Snowflake databases (catalogs) with one connection?

​How do I give AnomalyArmor access to future tables in Snowflake?

​Do I need a separate warehouse for AnomalyArmor, or can it share my existing one?

​Next Steps

Run Discovery

Set Up Alerts

Requirements

Connection Settings

Finding Your Account Identifier

Creating a Read-Only User

Per-Schema Permissions

Authentication Methods

Virtual Warehouse Considerations

Warehouse Sizing

Auto-Suspend Configuration

Cost Estimation

Network Policies

What We Monitor

Metadata Captured

Multiple Databases

Connection Architecture

What We Query

Troubleshooting

Best Practices

Use Dedicated Service Account

Use Key-Pair Authentication for Production

Monitor Your Production Database

Choose the Right Warehouse Size

Common Questions

How much Snowflake credit does AnomalyArmor consume?

What’s the correct format for the Snowflake account identifier?

Can AnomalyArmor monitor multiple Snowflake databases (catalogs) with one connection?

How do I give AnomalyArmor access to future tables in Snowflake?

Do I need a separate warehouse for AnomalyArmor, or can it share my existing one?

Next Steps