Snowflake - Paradime

Snowflake is a cloud data platform for storing and querying your data. Connect it to Paradime to run dbt™ from the Code IDE, deploy production jobs with Bolt, and let the DinoAI background agent work against your warehouse.

IP restrictionsAllow traffic from one of the Paradime IPs in your firewall, depending on the data location selected.See also: Paradime IP addresses.

Connection environments

Paradime connects to Snowflake separately for each environment. You configure one connection per environment in Workspace Settings > Environments.

Environment	Used by	Typical target	Authentication methods
Code IDE	Running dbt™ from the terminal in the Code IDE	`dev`	Username and password, Snowflake OAuth, Key-pair
Bolt	Production jobs run by Bolt	`prod`	Username and password, Key-pair
Agent	Background agent sessions	`dinoai`	Username and password, Key-pair

The connection fields are the same across environments. What differs is the Snowflake permissions you grant: the Code IDE connection typically reuses a developer’s role, while the Bolt and Agent environments should each use a dedicated service user with the minimum permissions required.

Suggested permissions

Code IDE
Bolt
Agent

This set of permissions lets users read from source databases and create tables and views when running dbt™ from the Paradime terminal. Grant them to the role you connect in Paradime, for each database where your source data lives and where you want to materialize your models.

-- grant permission to allow role to read from your source database
grant usage on database <your_database_name> to role <snowflake_role>;
grant usage on future schemas in database <your_database_name> to role <snowflake_role>;
grant select on future tables in database <your_database_name> to role <snowflake_role>;
grant select on future views in database <your_database_name> to role <snowflake_role>;
grant usage on all schemas in database <your_database_name> to role <snowflake_role>;
grant select on all tables in database <your_database_name> to role <snowflake_role>;
grant select on all views in database <your_database_name> to role <snowflake_role>;

-- grant permission to allow role to write to your dev database
grant all on database <your_database_name> to role <snowflake_role>;

We recommend creating a dedicated Snowflake user for production jobs, with the access required to create tables and views in your production database. This set of permissions lets Paradime read from source databases and create tables and views when Bolt runs production jobs.

use role securityadmin;

-- create warehouse if not exists
create warehouse transforming
    warehouse_size = xsmall
    auto_suspend = 60
    auto_resume = true
    initially_suspended = true;

-- create role and grant warehouse permission
create role transformer;
grant all on warehouse transforming to role transformer;

-- create prod user
create user paradime_prod_user
    password = '<generate_password>'
    default_warehouse = transforming
    default_role = transformer;

-- grant this role to paradime_prod_user
grant role transformer to user paradime_prod_user;

-- grant permission to allow role to read from your source database
grant usage on database <your_database_name> to role transformer;
grant usage on future schemas in database <your_database_name> to role transformer;
grant select on future tables in database <your_database_name> to role transformer;
grant select on future views in database <your_database_name> to role transformer;
grant usage on all schemas in database <your_database_name> to role transformer;
grant select on all tables in database <your_database_name> to role transformer;
grant select on all views in database <your_database_name> to role transformer;

-- grant permission to allow role to write to your prod database
grant all on database analytics to role transformer;

We recommend creating a dedicated Snowflake service user for the Agent environment, with the minimum permissions required to create tables and views. This set of permissions lets DinoAI read from source databases and create tables and views during background agent sessions.

use role securityadmin;

-- create warehouse if not exists
create warehouse transforming
    warehouse_size = xsmall
    auto_suspend = 60
    auto_resume = true
    initially_suspended = true;

-- create role and grant warehouse permission
create role transformer;
grant all on warehouse transforming to role transformer;

-- create Agent service user
create user paradime_dinoai_user
    password = '<generate_password>'
    default_warehouse = transforming
    default_role = transformer;

-- grant role to paradime_dinoai_user
grant role transformer to user paradime_dinoai_user;

-- grant permission to allow role to read from your source database
grant usage on database <your_database_name> to role transformer;
grant usage on future schemas in database <your_database_name> to role transformer;
grant select on future tables in database <your_database_name> to role transformer;
grant select on future views in database <your_database_name> to role transformer;
grant usage on all schemas in database <your_database_name> to role transformer;
grant select on all tables in database <your_database_name> to role transformer;
grant select on all views in database <your_database_name> to role transformer;

-- grant permission to allow role to write to your database
grant all on database analytics to role transformer;

Add a connection

Click Settings in the top menu bar of the Paradime interface to access Workspace Settings.
In the left sidebar, click Environments.
Click Add New next to the section for the environment you are configuring:
- Code IDE for the Code IDE connection
- Bolt for the Bolt connection
- Agent for the Agent connection
Select Snowflake and choose an authentication method.

Authentication methods

Username and password

Connect with a Snowflake username and password. Available in all environments.

Snowflake OAuth

Let each user authenticate through Snowflake OAuth. Code IDE only.

Key-pair authentication

Connect with a private key and optional passphrase. Available in all environments.

Optional connection attributes

Set additional profiles.yml attributes for this connection.

AWS PrivateLink

Connect privately over an AWS VPC endpoint.

​Connection environments

​Suggested permissions

​Add a connection

​Authentication methods

Username and password

Snowflake OAuth

Key-pair authentication

​Related

Optional connection attributes

AWS PrivateLink

Connection environments

Suggested permissions

Add a connection

Authentication methods

Related