Connect Snowflake

CloudQuell reads your Snowflake spend through key-pair (RSA) authentication over a read-only service user that a short setup script creates in your account. Dollars come from Snowflake’s own SNOWFLAKE.ORGANIZATION_USAGE views — the authoritative billing record, so CloudQuell’s totals match your Snowflake invoice — and land in the same ledger and views as your other providers, treated as another spend source with warehouse-level attribution. Nothing is written back to your account, and CloudQuell never handles a private key. The whole flow takes about 10 minutes.

Does connecting cost anything?

CloudQuell runs lightweight read-only queries against Snowflake’s usage views on a capped XS warehouse — the Snowflake compute this uses is usually minimal, and nothing is written back to your account. CloudQuell doesn’t charge you to connect. Any Snowflake charges that apply are set by Snowflake, can change, and are yours; treat this as general guidance, not a guarantee, and check Snowflake’s current pricing.

Prerequisites

• A Snowflake account with ORGADMIN enabled — the organization account. CloudQuell reads the SNOWFLAKE.ORGANIZATION_USAGE views, which carry authoritative, organization-wide dollars. On a plain account those views are empty; if the wizard finds no dollar data it will ask you to connect the organization account instead.
• ACCOUNTADMIN access to run the one-time setup script (below). You run it; you never send CloudQuell any credential.
• A CloudQuell admin — creating integrations requires the super_admin or admin role. See roles.

How the connection works

CloudQuell generates the RSA key pair for you and keeps the private key in AWS Secrets Manager — you never see, paste, or store a private key. The setup script you run in Snowflake registers only the matching public key and creates a tightly scoped, read-only footprint:

• A read-only CLOUDQUELL user (TYPE = SERVICE, key-pair auth only — it has no password and can’t log in interactively) and a matching CLOUDQUELL role.
• A dedicated CLOUDQUELL_WH warehouse — XSMALL, auto-suspend after 60 seconds, initially suspended. Every CloudQuell query runs here and nowhere else, which caps our compute footprint in your account to pennies.
• A CLOUDQUELL database of owner’s-rights wrapper views over exactly the three usage views CloudQuell reads. Because the views run with the owner’s rights and expose only the listed columns, the CLOUDQUELL role can read usage metadata only — never any of your customer data, and only from these specific views.

Tip

Everything the integration can touch is created by the script and named CLOUDQUELL. To see exactly what CloudQuell can read, inspect the three view definitions — the column list in each is the complete scope.

The three steps

The connect wizard walks you through these and shows the script with your real public key already filled in.

1. Enter your account identifier

In the CloudQuell admin, go to Integrations, open the Snowflake tile, and click Connect. Enter your Snowflake account identifier (the organization account, e.g. ORGNAME-ACCOUNTNAME).

Not sure of your account identifier? It’s under Admin → Accounts in Snowsight, or run this in any Snowflake worksheet to get the exact value:

SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME();

2. Run the setup script as ACCOUNTADMIN

The wizard shows a copy-paste SQL script with the public key already interpolated where {{PUBLIC_KEY}} appears below. Open a Snowflake worksheet, make sure your role is ACCOUNTADMIN, and run it:

USE ROLE ACCOUNTADMIN;
CREATE ROLE IF NOT EXISTS CLOUDQUELL;
CREATE USER IF NOT EXISTS CLOUDQUELL TYPE = SERVICE DEFAULT_ROLE = CLOUDQUELL
  COMMENT = 'CloudQuell cost & usage sync (read-only)';
ALTER USER CLOUDQUELL SET RSA_PUBLIC_KEY = '{{PUBLIC_KEY}}';
GRANT ROLE CLOUDQUELL TO USER CLOUDQUELL;
GRANT ROLE CLOUDQUELL TO ROLE SYSADMIN;
CREATE WAREHOUSE IF NOT EXISTS CLOUDQUELL_WH
  WAREHOUSE_SIZE = XSMALL AUTO_SUSPEND = 60 AUTO_RESUME = TRUE INITIALLY_SUSPENDED = TRUE;
GRANT USAGE ON WAREHOUSE CLOUDQUELL_WH TO ROLE CLOUDQUELL;
ALTER USER CLOUDQUELL SET DEFAULT_WAREHOUSE = CLOUDQUELL_WH;
CREATE DATABASE IF NOT EXISTS CLOUDQUELL;
CREATE SCHEMA IF NOT EXISTS CLOUDQUELL.SYNC;
CREATE OR REPLACE VIEW CLOUDQUELL.SYNC.USAGE_IN_CURRENCY_DAILY AS
  SELECT organization_name, contract_number, account_name, account_locator, region,
         service_level, usage_date, service_type, usage_type, rating_type, billing_type,
         is_adjustment, currency, usage, usage_in_currency, balance_source
  FROM SNOWFLAKE.ORGANIZATION_USAGE.USAGE_IN_CURRENCY_DAILY;
CREATE OR REPLACE VIEW CLOUDQUELL.SYNC.WAREHOUSE_METERING_HISTORY AS
  SELECT organization_name, account_name, account_locator, region, service_type,
         start_time, end_time, warehouse_id, warehouse_name,
         credits_used, credits_used_compute, credits_used_cloud_services
  FROM SNOWFLAKE.ORGANIZATION_USAGE.WAREHOUSE_METERING_HISTORY;
CREATE OR REPLACE VIEW CLOUDQUELL.SYNC.RATE_SHEET_DAILY AS
  SELECT organization_name, contract_number, date, service_type, usage_type, rating_type,
         currency, effective_rate
  FROM SNOWFLAKE.ORGANIZATION_USAGE.RATE_SHEET_DAILY;
GRANT USAGE ON DATABASE CLOUDQUELL TO ROLE CLOUDQUELL;
GRANT USAGE ON SCHEMA CLOUDQUELL.SYNC TO ROLE CLOUDQUELL;
GRANT SELECT ON ALL VIEWS IN SCHEMA CLOUDQUELL.SYNC TO ROLE CLOUDQUELL;

Caution

Run the script exactly as the wizard shows it, with ACCOUNTADMIN active. The {{PUBLIC_KEY}} placeholder above is filled in for you in the wizard — don’t paste this verbatim copy, which still has the placeholder.

3. Verify the connection

Back in the wizard, click Verify connection. CloudQuell connects as the CLOUDQUELL user with the private key it generated, confirms the wrapper views are readable, and starts the first ingest. That’s it — you’re connected.

What data appears, and when

On connect, CloudQuell backfills up to 12 months of history so you have trend context from the start. After that, Snowflake spend syncs daily. Dollars finalize up to ~72 hours behind, which matches Snowflake’s own end-of-month adjustments (is_adjustment rows and rate-sheet trueups) — so the most recent couple of days may shift slightly before they settle.

Three views feed the ledger:

View	What it provides
USAGE_IN_CURRENCY_DAILY	Authoritative dollars by account, region, service type, and day — matches your invoice.
WAREHOUSE_METERING_HISTORY	Credits per warehouse (compute and cloud-services), for warehouse-level cost attribution.
RATE_SHEET_DAILY	Your effective credit rates, so credits reconcile to dollars.

The Snowflake dashboard tracks daily spend and credits, the blended $ / credit rate, credits by warehouse with estimated per-warehouse spend, and a stacked warehouse trend of daily credits. For custom pivots, scope Reports to your Snowflake integration and break spend down by account, service type (compute, storage, cloud services, serverless, and more), warehouse, usage type, and tag (rating type, billing type, balance source) — with credit quantities as a usage metric that unlocks on any dimension — using the same report builder you use for AWS. Saved reports and CSV/PDF export work the same way. Cost-center allocation covers Snowflake too: route the whole integration to a cost center, split it by service (Compute, Storage, …), or allocate per warehouse with warehouse tag rules — compute and cloud-services dollars are split across warehouses by daily credit share (an estimate, marked attribution: estimated; account totals stay invoice-exact), while storage, AI Services, and month-end adjustments stay account-level. Budgets on those cost centers then track the Snowflake spend they contain.

Snowflake object tags aren’t imported

Tags you define inside Snowflake (CREATE TAG / ALTER WAREHOUSE … SET TAG …) don’t appear in CloudQuell — the three billing views above don’t carry them. To attribute Snowflake spend, use the built-in warehouse tag or allocation rules instead. This also means Snowflake doesn’t participate in the Attribution Coverage (Tags) view, which measures tagging discipline on cloud resources — with only Snowflake connected, that view doesn’t appear in the sidebar. If native Snowflake tag import matters to you, let us know.

Troubleshooting

“Views do not exist” on Verify

The setup script hasn’t finished, or it ran under the wrong role. Re-open a worksheet, run USE ROLE ACCOUNTADMIN;, and run the whole script again — it’s idempotent (every statement is IF NOT EXISTS / OR REPLACE), so re-running is safe. Then click Verify again.

“Authentication failed”

The public key registered on the CLOUDQUELL user doesn’t match the private key CloudQuell holds. Re-run just the key line from the wizard (it has your current public key):

USE ROLE ACCOUNTADMIN;
ALTER USER CLOUDQUELL SET RSA_PUBLIC_KEY = '{{PUBLIC_KEY}}';

Then retry Verify.

No dollar data / everything is empty

The account you connected isn’t ORGADMIN-enabled, so SNOWFLAKE.ORGANIZATION_USAGE has no dollars to read. Connect the organization account (the one with the ORGADMIN role) instead — that’s where organization-wide billing lives.

A network policy is blocking us

If your Snowflake account enforces a network policy (IP allow-list), our sync will be refused until CloudQuell’s egress addresses are allow-listed. Contact us for the current egress IP list to add to your policy.

Remove the integration

Deleting the Snowflake integration in CloudQuell is a permanent hard delete: it purges all ingested Snowflake cost data on our side and the stored key from Secrets Manager. This can’t be undone — see manage your integrations.

To remove CloudQuell’s read-only objects from Snowflake afterward, run this as ACCOUNTADMIN:

USE ROLE ACCOUNTADMIN;
DROP DATABASE IF EXISTS CLOUDQUELL;
DROP WAREHOUSE IF EXISTS CLOUDQUELL_WH;
DROP USER IF EXISTS CLOUDQUELL;
DROP ROLE IF EXISTS CLOUDQUELL;

Query it from an agent

Snowflake spend lands in the same normalized ledger as everything else, so a connected agent can query it in plain language alongside your cloud costs — by warehouse, service type, account, or day.

Related

• Supported providers
• Manage your integrations
• Integration troubleshooting
• Connect an AI agent via the MCP server