Skip to content
Saiku Cloud

Connecting a Snowflake warehouse

This guide walks you through connecting a Snowflake account to Saiku Cloud. Ten minutes if you’re comfortable in the Snowflake console; thirty if you also need to set up RSA key-pair auth (recommended for service accounts).

Tier impact: every Saiku Cloud tier supports Snowflake BYOC. Snowflake-shaped customers usually land on [Team] or [Business] (dedicated engine pod) but [Starter] works too.

Driver: Saiku Cloud ships Snowflake’s official JDBC driver (Apache 2.0). The driver is ~100 MB because Snowflake’s wire protocol is Apache Arrow-native; the Arrow bundling is non-negotiable.

What you’ll need

  • A Snowflake account (trial accounts at signup.snowflake.com — 30-day free, $400 of credits).
  • Admin access to create a role + user, OR an existing read-only role’s credentials.
  • The Snowflake account identifier — <orgname>-<accountname> or the legacy <accountname>.<region>.<cloud> shape.

Step 1 — Allowlist our egress IP (if your account has network policy enabled)

Saiku Cloud’s queries to your warehouse all originate from 87.99.153.244.

Snowflake accounts created in 2024+ have network policy enabled by default — an allowlist of IPs allowed to authenticate. If your account doesn’t have a policy, skip this step; Snowflake accepts connections from any IP by default.

To add Saiku Cloud’s IP:

-- As ACCOUNTADMIN:
CREATE NETWORK POLICY saiku_cloud_allow
    ALLOWED_IP_LIST = ('87.99.153.244');


-- Apply to your service user (or to the account, depending on shape):
ALTER USER saiku_read SET NETWORK_POLICY = saiku_cloud_allow;

If you have an existing network policy with other IPs in it, add 87.99.153.244 to the existing list rather than replacing it.

Step 2 — Create a read-only role + user

Snowflake’s role model: a user has a default role; the role has grants. Saiku Cloud needs SELECT on the tables it’ll read.

-- As ACCOUNTADMIN:
CREATE ROLE saiku_reader;
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE saiku_reader;
GRANT USAGE ON DATABASE ANALYTICS TO ROLE saiku_reader;
GRANT USAGE ON SCHEMA ANALYTICS.PUBLIC TO ROLE saiku_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA ANALYTICS.PUBLIC TO ROLE saiku_reader;
GRANT SELECT ON FUTURE TABLES IN SCHEMA ANALYTICS.PUBLIC TO ROLE saiku_reader;


CREATE USER saiku_read
    PASSWORD = 'pick-something-strong'
    DEFAULT_ROLE = saiku_reader
    DEFAULT_WAREHOUSE = COMPUTE_WH;


GRANT ROLE saiku_reader TO USER saiku_read;

Adjust ANALYTICS / PUBLIC / COMPUTE_WH to match your account.

For service accounts, password auth is being deprecated in some Snowflake regions. The replacement is RSA key-pair:

Terminal window
# Generate a 2048-bit RSA private key
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

Upload the public key to the user:

ALTER USER saiku_read SET RSA_PUBLIC_KEY = 'MIIBIjANBgkqhkiG9w0BAQEFA...';

In the JDBC URL, point at the private key file path (the engine container needs read access — for Saiku Cloud’s shared engine, paste the key contents inline via private_key_file_pwd).

Step 3 — Build the JDBC URL

The shape:

jdbc:snowflake://<account>.snowflakecomputing.com/?db=<DATABASE>&warehouse=<WAREHOUSE>&role=<ROLE>

Concrete:

jdbc:snowflake://abc12345.us-east-1.aws.snowflakecomputing.com/?db=ANALYTICS&warehouse=COMPUTE_WH&role=SAIKU_READER

Or with the newer <orgname>-<accountname> identifier:

jdbc:snowflake://yourorg-yourdb.snowflakecomputing.com/?db=ANALYTICS&warehouse=COMPUTE_WH&role=SAIKU_READER

Key parameters:

  • db= — the database name. Required (else Snowflake routes queries to the user’s default, which is usually wrong).
  • warehouse= — the compute warehouse. Required.
  • role= — the role to assume. Match what you granted in Step 2.
  • TLS is always on with Snowflake — no SSL parameter to set.

Step 4 — Connect via the Saiku Cloud wizard

  1. Sign in at https://cloud.saiku.bi/.

  2. Navigate to Connections in the left sidebar.

  3. Under 1. Pick warehouse type, click the Snowflake tile.

  4. Fill in:

    • JDBC URL — the URL from Step 3.
    • Username — saiku_read (or your service-account username).
    • Password — the password from Step 2.

  5. Click Test connection.

Expect a green outcome banner: ✓ Connection successful plus the detected Snowflake version. Snowflake’s first connection takes 5–15 seconds (auth + warehouse-spinup if it was paused); subsequent tests are faster.

Step 5 — Save the connection

Same shape as every other dialect — re-enter the password, give it a label, save.

Troubleshooting

✗ Connection failed (HOST_UNREACHABLE) or (TIMEOUT)

  • Wrong account identifier — the part before .snowflakecomputing.com is the entire identifier. abc12345.us-east-1.aws is one identifier; abc12345 alone won’t resolve. Snowflake’s docs are confusing here; copy the identifier from the Snowflake console’s account-details page.
  • Network policy — if your account has a network policy and Saiku Cloud’s IP isn’t on the allowlist, Snowflake silently times out the connection. Add 87.99.153.244 per Step 1.

✗ Connection failed (AUTH_FAILED)

Snowflake error 390100 / 390101 / 28000.

  • Username case — Snowflake usernames default to UPPERCASE in storage. Type saiku_read and it’s stored as SAIKU_READ. The JDBC layer is case-insensitive on lookup, so this usually doesn’t bite — but if you wrapped the username in double-quotes when creating the user, case is preserved + must match exactly.
  • MFA — if MFA is enabled on the user, password auth will fail. Either disable MFA for the service user or use RSA key-pair auth (Step 2 RSA section).
  • Role doesn’t exist — if role= in the URL names a role the user can’t assume, Snowflake returns auth-failed rather than a more specific error. Verify with SHOW GRANTS TO USER saiku_read; in the console.

✗ Connection failed (DATABASE_NOT_FOUND)

The database in the URL doesn’t exist OR the role doesn’t have USAGE on it. GRANT USAGE ON DATABASE ANALYTICS TO ROLE saiku_reader; fixes the latter; the former needs the database name corrected.

Connection works but cubes don’t render

USAGE on the database isn’t enough — Saiku also needs USAGE on the schema and SELECT on the tables. The full grant chain is in Step 2. A common mistake is granting database USAGE but forgetting schema USAGE.

Anything else

Take a screenshot of the wizard with the red outcome banner visible (Kind: ... line in particular) and send it to support@saiku.bi.

For Enterprise customers, Snowflake’s AWS PrivateLink endpoint can replace the public network path entirely. The JDBC URL changes to a <account>.privatelink.snowflakecomputing.com shape; the IP allowlist becomes irrelevant. Contact your account team to provision the peering.

Try with FoodMart

Want to test Saiku Cloud with this dialect before connecting your own data? Download the FoodMart sample dataset packaged for Snowflake:

FoodMart sample dataset for Snowflake