Skip to content
Fresco BIFresco BIFresco BI Docs

Search is only available in production builds. Try building and previewing the site to test it out locally.

Snowflake

Snowflake is a cloud data warehouse. Fresco BI signs in with a read-only user, lists your databases, schemas, tables and views, and imports the tables you pick into a Data Table.

Feature Supported
Import Yes
DirectQuery No
SSL/TLS Always on (verified)
SSH tunnel No
Cloud Yes
On-premises (via Gateway) No

Prerequisites

Section titled “Prerequisites”
  • A Snowflake account and its account URL, for example myorg-myaccount.snowflakecomputing.com. PrivateLink URLs are not accepted.
  • A user with the SECURITYADMIN role (or one that can create roles, users and grants).
  • A virtual warehouse the Fresco BI user may use. It runs only while data is imported: test connection and table listing do not start it.
  • OpenSSL on your computer if you use key pair sign-in (recommended).

Step 1: Create a read-only user

Section titled “Step 1: Create a read-only user”

Create a key pair. Fresco BI accepts an RSA private key of at least 2048 bits in PKCS#8 PEM format, plain or encrypted with a passphrase.

Terminal window
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

Then create a role with read-only grants and a user for it. Paste the body of rsa_key.pub (without the BEGIN/END lines) as RSA_PUBLIC_KEY.

USE ROLE SECURITYADMIN;
CREATE ROLE IF NOT EXISTS FRESCO_READER;


GRANT USAGE ON WAREHOUSE <warehouse> TO ROLE FRESCO_READER;
GRANT USAGE ON DATABASE <database> TO ROLE FRESCO_READER;
GRANT USAGE ON ALL SCHEMAS IN DATABASE <database> TO ROLE FRESCO_READER;
GRANT SELECT ON ALL TABLES IN DATABASE <database> TO ROLE FRESCO_READER;
GRANT SELECT ON ALL VIEWS IN DATABASE <database> TO ROLE FRESCO_READER;


-- Objects created later
GRANT USAGE ON FUTURE SCHEMAS IN DATABASE <database> TO ROLE FRESCO_READER;
GRANT SELECT ON FUTURE TABLES IN DATABASE <database> TO ROLE FRESCO_READER;
GRANT SELECT ON FUTURE VIEWS IN DATABASE <database> TO ROLE FRESCO_READER;


CREATE USER IF NOT EXISTS FRESCO_READER
  DEFAULT_ROLE = FRESCO_READER
  DEFAULT_WAREHOUSE = <warehouse>
  RSA_PUBLIC_KEY = '<public-key-body>';
GRANT ROLE FRESCO_READER TO USER FRESCO_READER;

To sign in with a password instead, replace the RSA_PUBLIC_KEY line with PASSWORD = '<strong-password>'. Key pair is the safer choice.

Repeat the database grants for every database Fresco BI should read.

Step 2: Allow network access

Section titled “Step 2: Allow network access”

Fresco BI connects to your account URL on port 443 over the internet. If your account or the user has a network policy, add Fresco BI’s outbound IPs: Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them).

CREATE NETWORK POLICY FRESCO_BI_POLICY
  ALLOWED_IP_LIST = ('<frescobi-ip-1>', '<frescobi-ip-2>');
ALTER USER FRESCO_READER SET NETWORK_POLICY = FRESCO_BI_POLICY;

Snowflake has no On-premises (via Gateway) or SSH tunnel option: the connection always goes straight to Snowflake.

Step 3: Fill in the form

Section titled “Step 3: Fill in the form”
Field What to enter
Server Account URL, <account>.snowflakecomputing.com
Warehouse Warehouse name from Step 1 (required)
Role FRESCO_READER, or empty for the user’s default role
Database One database to list, or empty to list every database the role can see
User FRESCO_READER
Sign-in method Key pair (default) or password
Private key Contents of rsa_key.p8, including the BEGIN/END lines
Key passphrase Only if the private key is encrypted
Password Only for password sign-in
Command timeout Minutes one statement may run, 1–60 (default 60)

Click Test connection. The test signs in, switches to the role and runs SELECT CURRENT_VERSION(); it does not resume the warehouse. Then click Save.

SSL modes

Section titled “SSL modes”

Snowflake connections are always encrypted and the server certificate is always verified. There is no SSL mode to choose.

Troubleshooting

Section titled “Troubleshooting”
  • The server rejected the user name or password. With key pair: the public key on the user does not match the private key, or the user is locked or disabled. Run DESC USER FRESCO_READER and check RSA_PUBLIC_KEY_FP.
  • The database user cannot read this object. A Snowflake network policy blocks Fresco BI’s IP (add Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them) as in Step 2), or the role lacks SELECT on that table or view.
  • The connection settings are not valid: check the marked fields. The role does not exist or is not granted to the user, the warehouse name is wrong or not granted, or the private key is not a PKCS#8 RSA key of 2048 bits or more.
  • The host name could not be resolved (DNS). Check the Host field. Check the account URL: it must be <account>.snowflakecomputing.com for your own account.
  • The server did not answer in time. Usually a firewall that drops packets, or a wrong host or port. The warehouse may be busy (queries queued for over 10 minutes) or a statement ran past the command timeout. Use a larger or less busy warehouse.
  • A size or concurrent-connection limit was exceeded. A resource monitor stopped the warehouse because its credit quota is used up.
  • The SSL connection could not be set up with the chosen mode. Check the SSL mode and the CA certificate. A proxy or firewall is intercepting TLS to snowflakecomputing.com, or certificate checks (OCSP) fail. Let Fresco BI reach Snowflake directly.
  • The source returned a data type this connector does not support. Leave that column out of the Data Table.

© 2026 Fresco BI. All rights reserved.