Manage Snowflake reader account

This is for:

Business Analyst System Administrator

The Snowflake reader account is created for an individual Coveo organization, and therefore only contains UA data related to that organization. Access to the Snowflake reader account for user or service accounts is managed through the Coveo Administration Console. By default, this access is IP-restricted, therefore an administrator with the required privileges can manage access by creating user accounts and adding allowed IP addresses.

Note

The reader account feature is intended for clients who don’t have a Snowflake account. By creating a reader account through the Coveo Administration Console, you can access your data through the Snowflake portal.

Manage your reader account

To manage the reader account, go to the Raw Data page, under Snowflake Access > Reader Account (platform-ca | platform-eu | platform-au).

If you don’t yet have a reader account, click Create Snowflake Reader Account. The account is created automatically by using the data from your organization

Add or edit users

To add or edit users who can access the reader account:

  1. In the Snowflake Users section, click Add User.

  2. In the Add User panel that appears:

    Add User panel | Coveo

    1. Enter a user name and email.

    2. (Optional) If you’re granting temporary access to the user, select the Provide temporary access checkbox.

      1. In the list that appears, select the applicable duration.

      2. If you select Ends on specific date, select the date from the dropdown calendar that appears.

    3. Click Add.

      The user is added to the Snowflake Users list.

      Snowflake Users list | Coveo

  3. Snowflake account password setup: Once a user has been added, an email containing a temporary link to set the account password will be sent to the user. Once the password setup is complete, the user must use an allowed IP address to access the reader account.

  4. To edit an existing user, click the user name you want to edit, and then click the desired option in the Action bar.

    Reset Password | Coveo

    • Reset password: Resets the password of the selected user account. The user will receive an email with a temporary link to reset the account password.

    • Delete: Deletes the selected user account.

    • Reactivate user account: Reactivates an inactive user account. This option will only be displayed if the Status of the selected user account is Expired. During reactivation, the option to provide permanent or temporary access will also be provided.

Note

Snowflake users aren’t the same as members of your Coveo organization. They can either be user accounts or service accounts.
Important
Important

  • Following the user setup, we recommend enrolling in Snowflake’s Multi-Factor Authentication (MFA) for an additional level of security. This feature provides an additional form of authentication during login.

  • Users should take the expiry date of their account into consideration. When a user account expires, all Snowflake worksheets and all Snowsight dashboards from that account are lost. Therefore, we recommend that they create backups by copy-pasting them to a text editor and saving them in their local drive.

Add or block IP addresses

All IP addresses are blocked by default. Therefore, to ensure that the newly added user can access the reader account, you must add their IP address as well.

  1. In the Snowflake Network Policy section, click Edit policy.

  2. Under Allowed IP Addresses, enter the IP addresses that you want to allow.

  3. Under Blocked IP Addresses, enter the IP addresses you want to block.

  4. Click Save.

Notes

  • Only public IP addresses can be allowed in the Snowflake Network Policy.

  • All IP addresses are blocked by default. For this reason, adding addresses to Blocked IP Addresses lets you block specific addresses within an allowed range.

    For example, you add 127.0. 0.1/24 to Allowed IP Addresses . This allows every IP address that starts with "127.0. 0". However, you want to block 127.0. 0.100 and 127.0. 0.200 which fall within that range, therefore you must add them to Blocked IP Addresses.

Snowflake credits

In Reader Account (platform-ca | platform-eu | platform-au) subpage, the Snowflake Credits resource monitor displays the monthly credit consumption for the reader account. As an authenticated administrator, you can view the remaining credits based on your account’s consumption for the current month. Credit consumption is determined by the usage of the reader account’s warehouse.

Snowflake Credits consumption | Coveo

The default size for a warehouse assigned to a reader account is x-small. It contains 10 credits, equivalent to approximately 10 hours of data processing. For more information regarding warehouse sizes and how their respective credits are computed, see Understanding compute cost.

A reader account that’s linked to a Coveo organization is automatically assigned a customer_wh warehouse. The warehouse is required to execute SQL queries. The credits consumed by the warehouse count toward your monthly limit.

Actions Credit consumption

Viewing dashboards and reports, and generating CSV exports in the Administration Console.

x

Performing API calls to the UA Read API.

x

Connecting an external BI tool to the reader account.

check

Performing queries in the Snowflake console.

check

Performing queries against Snowflake with a user created on the Raw Data page.

check

Access the reader account

On the Raw Data page, under Snowflake Access > Reader Account (platform-ca | platform-eu | platform-au), click Access Snowflake.

The Sign in to Snowflake page will open in a new tab in your browser. You can then log in with your Snowflake credentials.

Enable key-pair authentication

A key-pair authentication for the Snowflake reader account is recommended if you’re using an external integration, such as Snowflake Connector for Python, or a driver, such as Snowflake JDBC.

To set up key-pair authentication

  1. Generate an RSA key-pair:

    1. On your device, open a terminal window.

    2. Verify whether your integration requires an encrypted or non-encrypted key, then run one of the following commands:

      • For an encrypted key:

        openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8

      • For a non-encrypted key:

        openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

    3. Retrieve and store the private key from the rsa_key.p8 file, which is automatically saved in the current working directory where you ran the command.

    4. Generate a public key from the private key:

      openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

    5. Retrieve and store the public key from the rsa_key.pub file, which is automatically saved in the current working directory where you ran the command.

  2. Register the public key with your Snowflake user:

    Note

    You must have the CUSTOMER_READWRITE role to register the key.

    1. In a Snowflake worksheet, run the following command:

      CALL CUSTOMER.PROCEDURES.set_rsa_key_on_current_user('<RSA KEY>');

      where you replace <RSA KEY> with the public key you retrieved from the rsa_key.pub file.

      Notes

      • The key must be in a single line and must not contain any line breaks.

      • -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- are delimiters and aren’t part of the key.

      The result will look like this:

      RSA Key Registration | Coveo

Now that the public key is registered, you can now use your username, your private key, and password (if you encrypted your key) to authenticate with Snowflake.

Delete the reader account

At a certain point, you may want to delete the reader account. For example, if you’re no longer using the reader account or if you’re switching to your own Snowflake account.

Important

Deleting a reader account is irreversible, therefore if you have worksheets that you want to keep, make sure to copy and save the them to your local drive beforehand.

To delete the reader account:

  1. Go to the Snowflake Reader Account Management section located at the bottom of the Reader Account (platform-ca | platform-eu | platform-au) subpage, and then click Delete Snowflake Reader Account.

  2. In the Delete Reader Account panel that appears, click Delete.

Security recommendations

To ensure the reader account remains secure, we recommend the following practices:

For increased security, we recommend setting a network policy.

  • For advanced features, security, and long-lived solutions, consider using your own Snowflake account for added flexibility and control.

  • Reader account passwords don’t expire. Therefore it’s important to encourage users to create strong and unique passwords. Since a password reset isn’t enforced, it’s equally important to manually reset them periodically.

Required privileges

The following privileges are required to view or manage the Snowflake reader account.

Action Service - Domain Required access level

View and export data

Analytics - Snowflake Management
Organization - Organization

View

Add or edit users

Organization - Organization

View

Analytics - Snowflake Management

Edit

Analytics - Administrate

Allowed

Add or block IP addresses

Organization - Organization

View

Analytics - Snowflake Management

Edit

Analytics - Administrate

Allowed