Skip to main content
Rotation Type: Dual-PhaseThis rotation maintains two active credential sets with overlapping validity, ensuring zero-downtime during rotation cycles. It uses Snowflake’s two public-key slots (RSA_PUBLIC_KEY and RSA_PUBLIC_KEY_2), alternating between them on each rotation so the retired key pair stays valid until the next cycle.
Infisical’s Snowflake User Key Pair rotation generates an RSA key pair (2048-bit or 4096-bit, defaulting to 2048) and assigns its public key to a target Snowflake user for key-pair authentication. On each rotation, Infisical generates a fresh key pair, writes the public key to the currently-inactive slot on the user, and maps the new private and public keys to the secrets of your choice.

​
Prerequisites

  1. Create a Snowflake Connection with the required Secret Rotation permissions.
  2. Decide on the target user whose key pair you want to rotate. New users are created as key-pair-only SERVICE users.
    Users created by Infisical are not deleted when their credentials are revoked.
    If the target user already has a key set in the RSA_PUBLIC_KEY slot, creating the rotation is blocked so an existing key is never overwritten. Remove that key (or choose a user without one) before creating the rotation.
  3. Ensure your network security policies allow incoming requests from Infisical to your Snowflake account, if network restrictions apply.
    Only the RSA public key is written to Snowflake. The generated private key is stored solely in the mapped Infisical secret and is never persisted to Snowflake.

​
Create a Snowflake User Key Pair Rotation in Infisical

  1. Navigate to your Secret Manager Project’s Dashboard and select Add Secret Rotation from the actions dropdown. Secret Manager Dashboard
  2. Select the Snowflake User Key Pair option. Select Snowflake User Key Pair
  3. Select the Snowflake Connection to use and configure the rotation behavior. Then click Next. Rotation Configuration
    • Snowflake Connection - the connection that will perform the rotation of the target user’s RSA key pair.
    • Rotation Interval - the interval, in days, that once elapsed will trigger a rotation.
    • Rotate At - the local time of day when rotation should occur once the interval has elapsed.
    • Auto-Rotation Enabled - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
  4. Select the Snowflake user whose key pair should be rotated (or enter a new username to create one) and choose the RSA Modulus Length. Then click Next. Rotation Parameters
    • User - the Snowflake user whose RSA key pair will be rotated. Select an existing user, or type a new username to create one. New users are created as key-pair-only SERVICE users.
    • RSA Modulus Length - the size in bits of the generated RSA key pairs (2048 or 4096). Defaults to 2048. Changing this on an existing rotation only affects keys generated on future rotations.
  5. Specify the secret names that the generated key pair should be mapped to. Then click Next. Rotation Secrets Mapping
    • Private Key - the name of the secret that the generated RSA private key (PKCS#8 PEM) will be mapped to.
    • Public Key - the name of the secret that the generated RSA public key (SPKI PEM) will be mapped to.
  6. Give your rotation a name and description (optional). Then click Next. Rotation Details
    • Name - the name of the secret rotation configuration. Must be slug-friendly.
    • Description (optional) - a description of this rotation configuration.
  7. Review your configuration, then click Create Secret Rotation. Rotation Review
  8. Your Snowflake User Key Pair is now available for use via the mapped secrets. Rotation Created