> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paradime.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake

> Connect Snowflake to Paradime to run dbt™ from the Code IDE, deploy production jobs with Bolt, and let DinoAI background agents work against your warehouse.

[Snowflake](https://www.snowflake.com/) is a cloud data platform for storing and querying your data. Connect it to Paradime to run dbt™ from the Code IDE, deploy production jobs with Bolt, and let the DinoAI background agent work against your warehouse.

<Warning>
  **IP restrictions**

  Allow traffic from one of the Paradime IPs in your firewall, depending on the data location selected.

  See also: [Paradime IP addresses](/developers/ip-restrictions).
</Warning>

## Connection environments

Paradime connects to Snowflake separately for each environment. You configure one connection per environment in **Workspace Settings > Environments**.

| Environment | Used by                                        | Typical target | Authentication methods                           |
| ----------- | ---------------------------------------------- | -------------- | ------------------------------------------------ |
| Code IDE    | Running dbt™ from the terminal in the Code IDE | `dev`          | Username and password, Snowflake OAuth, Key-pair |
| Bolt        | Production jobs run by Bolt                    | `prod`         | Username and password, Key-pair                  |
| Agent       | Background agent sessions                      | `dinoai`       | Username and password, Key-pair                  |

The connection fields are the same across environments. What differs is the **Snowflake permissions** you grant: the Code IDE connection typically reuses a developer's role, while the Bolt and Agent environments should each use a dedicated service user with the minimum permissions required.

## Suggested permissions

<Tabs>
  <Tab title="Code IDE">
    This set of permissions lets users read from source databases and create tables and views when running dbt™ from the Paradime terminal. Grant them to the role you connect in Paradime, for each database where your source data lives and where you want to materialize your models.

    ```sql theme={"system"}
    -- grant permission to allow role to read from your source database
    grant usage on database <your_database_name> to role <snowflake_role>;
    grant usage on future schemas in database <your_database_name> to role <snowflake_role>;
    grant select on future tables in database <your_database_name> to role <snowflake_role>;
    grant select on future views in database <your_database_name> to role <snowflake_role>;
    grant usage on all schemas in database <your_database_name> to role <snowflake_role>;
    grant select on all tables in database <your_database_name> to role <snowflake_role>;
    grant select on all views in database <your_database_name> to role <snowflake_role>;

    -- grant permission to allow role to write to your dev database
    grant all on database <your_database_name> to role <snowflake_role>;
    ```
  </Tab>

  <Tab title="Bolt">
    We recommend creating a dedicated Snowflake user for production jobs, with the access required to create tables and views in your production database. This set of permissions lets Paradime read from source databases and create tables and views when Bolt runs production jobs.

    ```sql theme={"system"}
    use role securityadmin;

    -- create warehouse if not exists
    create warehouse transforming
        warehouse_size = xsmall
        auto_suspend = 60
        auto_resume = true
        initially_suspended = true;

    -- create role and grant warehouse permission
    create role transformer;
    grant all on warehouse transforming to role transformer;

    -- create prod user
    create user paradime_prod_user
        password = '<generate_password>'
        default_warehouse = transforming
        default_role = transformer;

    -- grant this role to paradime_prod_user
    grant role transformer to user paradime_prod_user;

    -- grant permission to allow role to read from your source database
    grant usage on database <your_database_name> to role transformer;
    grant usage on future schemas in database <your_database_name> to role transformer;
    grant select on future tables in database <your_database_name> to role transformer;
    grant select on future views in database <your_database_name> to role transformer;
    grant usage on all schemas in database <your_database_name> to role transformer;
    grant select on all tables in database <your_database_name> to role transformer;
    grant select on all views in database <your_database_name> to role transformer;

    -- grant permission to allow role to write to your prod database
    grant all on database analytics to role transformer;
    ```
  </Tab>

  <Tab title="Agent">
    We recommend creating a dedicated Snowflake service user for the Agent environment, with the minimum permissions required to create tables and views. This set of permissions lets DinoAI read from source databases and create tables and views during background agent sessions.

    ```sql theme={"system"}
    use role securityadmin;

    -- create warehouse if not exists
    create warehouse transforming
        warehouse_size = xsmall
        auto_suspend = 60
        auto_resume = true
        initially_suspended = true;

    -- create role and grant warehouse permission
    create role transformer;
    grant all on warehouse transforming to role transformer;

    -- create Agent service user
    create user paradime_dinoai_user
        password = '<generate_password>'
        default_warehouse = transforming
        default_role = transformer;

    -- grant role to paradime_dinoai_user
    grant role transformer to user paradime_dinoai_user;

    -- grant permission to allow role to read from your source database
    grant usage on database <your_database_name> to role transformer;
    grant usage on future schemas in database <your_database_name> to role transformer;
    grant select on future tables in database <your_database_name> to role transformer;
    grant select on future views in database <your_database_name> to role transformer;
    grant usage on all schemas in database <your_database_name> to role transformer;
    grant select on all tables in database <your_database_name> to role transformer;
    grant select on all views in database <your_database_name> to role transformer;

    -- grant permission to allow role to write to your database
    grant all on database analytics to role transformer;
    ```
  </Tab>
</Tabs>

## Add a connection

1. Click **Settings** in the top menu bar of the Paradime interface to access **Workspace Settings**.
2. In the left sidebar, click **Environments**.
3. Click **Add New** next to the section for the environment you are configuring:
   * **Code IDE** for the Code IDE connection
   * **Bolt** for the Bolt connection
   * **Agent** for the Agent connection
4. Select **Snowflake** and choose an authentication method.

## Authentication methods

<CardGroup cols={3}>
  <Card title="Username and password" href="/integrations/snowflake/username-and-password" icon="key">
    Connect with a Snowflake username and password. Available in all environments.
  </Card>

  <Card title="Snowflake OAuth" href="/integrations/snowflake/oauth" icon="shield-check">
    Let each user authenticate through Snowflake OAuth. Code IDE only.
  </Card>

  <Card title="Key-pair authentication" href="/integrations/snowflake/key-pair" icon="fingerprint">
    Connect with a private key and optional passphrase. Available in all environments.
  </Card>
</CardGroup>

## Related

<CardGroup cols={2}>
  <Card title="Optional connection attributes" href="/guides/data-warehouse-essentials/optional-connection-attributes" icon="gear" horizontal>
    Set additional `profiles.yml` attributes for this connection.
  </Card>

  <Card title="AWS PrivateLink" href="/integrations/aws-privatelink/snowflake-privatelink" icon="aws" horizontal>
    Connect privately over an AWS VPC endpoint.
  </Card>
</CardGroup>


## Related topics

- [Snowflake Storage](/integrations/snowflake-storage.md)
- [Snowflake Tools](/products/dino-ai/tools-and-features/warehouse-tool/snowflake-tools.md)
- [Snowflake Alerts](/products/radar/real-time-alerting/snowflake-alerts.md)
- [Snowflake OAuth](/integrations/snowflake/oauth.md)
- [Snowflake cost connection](/integrations/snowflake/cost-connection.md)