Snowflake
Use this guide to connect Snowflake to Wren AI and enter the account and warehouse settings required for queries.
Included in all plans
Wren AI needs to access your Snowflake database via the outbound IP address of Wren AI Cloud. Please add the IP address of the Wren AI service to the firewall of your Snowflake database.
Scroll to the bottom of the data source connection page to find the IP address.
Required Permissions
Wren AI connects to Snowflake as a regular user and only issues read-only queries — SELECT against your tables/views and INFORMATION_SCHEMA. It will never write data or run DDL. A dedicated read-only role is sufficient — and recommended — for a secure connection.
Avoid using ACCOUNTADMIN or another broadly privileged role as the connecting role. Use a dedicated read-only role scoped to the warehouse, database, and schema you want to expose.
Privileges checklist
The role used by Wren AI needs:
| Category | Privilege | Notes |
|---|---|---|
| Compute | USAGE on the virtual warehouse | Required to run queries. |
| Database access | USAGE on the database and schema | Required to resolve objects. |
| Business data | SELECT on the tables/views you want Wren AI to read | Include FUTURE TABLES if you want new tables covered automatically. |
| Metadata discovery | INFORMATION_SCHEMA access | Granted implicitly with the USAGE and SELECT privileges above. |
Minimum account setup
Create a dedicated read-only role and user:
CREATE ROLE wren_ai_role;
GRANT USAGE ON WAREHOUSE compute_wh TO ROLE wren_ai_role;
GRANT USAGE ON DATABASE analytics TO ROLE wren_ai_role;
GRANT USAGE ON SCHEMA analytics.public TO ROLE wren_ai_role;
GRANT SELECT ON ALL TABLES IN SCHEMA analytics.public TO ROLE wren_ai_role;
GRANT SELECT ON FUTURE TABLES IN SCHEMA analytics.public TO ROLE wren_ai_role;
CREATE USER wren_ai DEFAULT_ROLE = wren_ai_role DEFAULT_WAREHOUSE = compute_wh;
GRANT ROLE wren_ai_role TO USER wren_ai;
To add a Snowflake connection, click on the Snowflake option in the Connect a data source section.
Connect
Fill in the connection settings:
Display name
The display name for the database in the Wren AI interface.
Account
The account name for the account that you want to use to connect to your Snowflake database. The format is organization_name-account_name.
You can find the account name in the Snowflake dashboard.
Database name
The name of the database you want to connect to.
Schema
The schema name for the schema that you want to use to connect to your Snowflake database.
Warehouse
Specifies the virtual warehouse for query execution. If blank, the account's default warehouse is used (if configured).
User
The database username for the account that you want to use to connect to your Snowflake database.
Authentication method
Snowflake has deprecated single-factor username and password authentication. We recommend using key pair authentication. Learn more
Choose between two authentication methods:
Password authentication
- Username: The database username for the account that you want to use to connect to your Snowflake database.
- Password: The password for the username that you use to connect to the database.
Key pair authentication
- Username: The database username for the account that you want to use to connect to your Snowflake database.
- Private key: Upload your unencrypted RSA private key file.
To configure key pair authentication, follow the Snowflake documentation to generate and configure your key pair. Make sure to use an unencrypted private key file for the connection.
Click Next to start the connection and go to the next step.
Troubleshooting
Encrypted Private Key Error
If you encounter the following error:
Data connection error
251008: Failed to load private key: Password was not given but private key is encrypted Please provide a valid unencrypted rsa private key in DER format as bytes object
This means your private key is encrypted and needs to be decrypted. Follow these steps to create an unencrypted version:
-
Run the decryption command (it will prompt for your password):
openssl pkcs8 -inform PEM -in rsa_key.p8 -out rsa_key_unencrypted.p8 -
When prompted with
Enter PEM pass phrase:, enter the password you set when generating the encrypted key. -
The output file will contain the unencrypted version:
-----BEGIN PRIVATE KEY-----MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...-----END PRIVATE KEY----- -
Use this unencrypted private key file in the connection form.
Select Tables
All tables of your connected Snowflake dataset will be listed in this step. Select which tables you want to use in Wren AI. Each selected table will be created as a data model. See the Modeling documentation to learn more about data models.
Define relationships
Define the relationships among selected tables in this step. If you have defined primary keys and foreign keys in your Snowflake dataset, we will list suggested relationships based on that information. If not, you can also add relationships by clicking the Add relationships button on the table blocks.
Define the following properties in a relationship:
- From: Select the left side table and column of this relationship.
- To: Select the right side table and column of this relationship.
- Relationship Type: Select the type of relationship.
Find more information about relationships in Modeling - Working with Relationships.
You can also skip this step and finish the connection.
Tested versions
Snowflake is a fully managed service with continuous releases, so there is no database version to pin. Wren AI works with current Snowflake accounts across cloud providers. If you hit an account-specific issue, please contact us.