Connect to Snowflake

Connect Finout to your Snowflake account to gain detailed insights into your Snowflake costs. Choose from two secure authentication methods—key-pair authentication or password-based—to integrate your data seamlessly. This setup allows you to visualize and analyze your expenses precisely, offering a clear view of cost trends and allocations within your Snowflake environment.

What you will do for the Snowflake configuration: 1. Create permissions in Snowflake 2. Authenticate Snowflake into Finout

1. Create Permissions in Snowflake

1. Log into your Snowflake account using your login credentials.

2. Create a Finout Permissions in Snowflake:

   1. Open a new worksheet in your Snowflake console.

   2. To set up a dedicated warehouse, role, and user for Finout, paste the following query, ensure secure access by restricting the connection to specific IP addresses used by Finout, and then run the following command:

      Note: If you choose to use Key-pair authentication, you do not need to set a password when creating the user.

use role accountadmin;
CREATE WAREHOUSE if not exists finout_warehouse WITH WAREHOUSE_SIZE = 'XSMALL' AUTO_SUSPEND=30 INITIALLY_SUSPENDED=TRUE;
create role finout_role;
create user finout_user password = '<YOUR_PASSWORD_HERE>' default_role = finout_role;
grant USAGE ON WAREHOUSE finout_warehouse to role finout_role;
grant role finout_role to user finout_user;
grant imported privileges on database snowflake to role finout_role;
CREATE OR REPLACE NETWORK POLICY FINOUT_NETWORK_POLICY ALLOWED_IP_LIST = ('34.196.241.137', '212.59.64.84', '54.163.113.82', '44.196.75.137');
alter user finout_user SET NETWORK_POLICY = FINOUT_NETWORK_POLICY;

2. Integrate Snowflake in Finout

1. Navigate to Settings > Cost Centers and click Add Cost Center. The Connect Accounts window appears. ​

   
2. In Snowflake, click Connect Now. The Connect Snowflake wizard appears.

   
3. Enter the following details:

   • Cost Center Name: Enter the name of the cost center associated with this Snowflake account.

   • Username: Provide the username of the dedicated Finout user created in Snowflake.

   • Snowflake URL: Enter your Snowflake account URL.

   • Warehouse: Specify the warehouse (finout_warehouse) that was created for Finout.

   • Credits Cost: Enter the Snowflake credits per the compute and storage services.

   • Role: Enter the role (finout_role) created for Finout in Snowflake.

   • Database: Specify the Snowflake database where your cost data resides.

   • Add the price per TB of storage and the price of compute credit.

     Note: This is only for multiple organization accounts. Single organization accounts are automatically created when credit cost data is provided

4. Click Next. You are brought to the Authentication Method step.

5. To connect Finout to Snowflake, you can use either key-pair authentication or password-based authentication. When using key-pair authentication, Finout must securely store the private key because it initiates the connection to Snowflake. That’s why both keys need to be generated: the private key is securely stored by Finout, and you set the public key on your Snowflake user. This ensures secure access without requiring you to manage private credentials directly.

   • Key-Pair Generation: Finout will generate the key pair for you. We will securely store the private key, and you will receive the public key.

     

     1.Update Your Snowflake User Table: - Open a worksheet in your Snowflake console. - Use the public key provided by Finout to update your Snowflake user permissions/authentication method: ALTER USER <your_username> SET RSA_PUBLIC_KEY='<public_key>'; - Replace <your_username> with your Snowflake username. - Replace <public_key> with the public key provided by Finout.

     2.Complete the Setup in Finout: Return to the Finout console, mark I have completed the ALTER USER command in Snowflake, and click Next. Snowflake is onboarded and you will see Snowflake data in Finout within 24 hours.

   • Password Authentication: Connect Finout to Snowflake without leaving the Finout console.

     

     You might choose the password option if:

     • Your environment doesn’t require the advanced security of key-pair authentication.

     • You’re looking for a simpler, faster setup with minimal configuration.

     • You prefer not to manage private keys or want to avoid the additional steps involved in generating key pairs.

       1. Enter your password that was created in Snowflake (Step 1).

       2. Click Next. Snowflake is onboarded, you will see Snowflake data in Finout within 24 hours.

FAQs

Which Snowflake services are currently supported by Finout?

• Snowflake - Warehouse Reader Credits (Compute)

• Snowflake - Warehouse Credits (Compute)

• Snowflake - Warehouse Credits (Cloud Services)

• Snowflake - Storage

• Snowflake - Serverless Task Credits

• Snowflake - Search Optimization Credits

• Snowflake - Replication Credits

• Snowflake - Pipe Credits

• Snowflake - Materialization Credits

• Snowflake - Auto Clustering Credits

I already have a Snowflake Cost Center (CC) with password authentication. How can I change it to key-pair authentication?

Follow these steps to switch from password to key-pair authentication:

1. Request the public key: Contact Support to obtain the public key.

2. Update the Snowflake user: Insert the provided public key in your Snowflake console using the ALTER USER command. Finout generates the key pair for you—securely storing the private key while giving you the public key to complete the setup.

   

   1. Open a worksheet in your Snowflake console.

   2. Use the public key provided by Finout to update your Snowflake user permissions/authentication method: ALTER USER <your_username> SET RSA_PUBLIC_KEY='<public_key>';

   3. Replace <your_username> with your Snowflake username.

   4. Replace <public_key> with the public key provided by Finout.

3. Notify Support: Contact Support once you’ve added the public key so they can update the authentication method in Finout from password to key-pair.

4. Change or deactivate the password: Change or deactivate the password only after Support confirms that everything is working correctly.

Does Finout support granting nested roles in Snowflake?

No. Finout only supports roles with permissions directly assigned to them. Nested roles are not supported.

Can I connect custom cost centers via Snowflake?

Yes. You can connect custom cost centers by configuring your Snowflake integration. Use the following table structure in Snowflake to enable Finout to ingest custom data:

create or replace TABLE FINOUT_COST_EXPORT ( SOURCE VARCHAR(100), USAGE_DATE DATE, SERVICE_NAME VARCHAR(1000), COST FLOAT, METADATA OBJECT );

Where:

• SOURCE is an indication to the source cloud or system, i.e Datadog, Azure etc.

• USAGE_DATE is the date you would want to add the costs to.

• SERVICE_NAME is a sub-service within the source, COST is the cost in USD.

• METADATA is a custom key-value object for tags, optional.

How do Snowflake storage costs work?

To display daily costs, Finout calculates a derived daily rate by dividing the monthly storage cost per Table by the number of days in that month. Since months like February have fewer days, the daily rate appears higher, even though the total monthly cost remains unchanged. For a full breakdown of Snowflake’s storage pricing, refer to the official Snowflake documentation.

How is storage cost per table tracked?

Storage cost per table is tracked as a daily snapshot from TABLE_STORAGE_METRICS. Each snapshot captures the cost at a specific point in time.

Will storage cost values update retroactively if something changes?

No. Storage cost values are snapshot-based, so historical data is not retroactively updated or recalculated—once captured, those values remain fixed. If a snapshot isn’t captured for any reason, storage cost data for that day will be missing and cannot be recovered.