Snowflake sync

A Snowflake Secret Sync pushes secrets from Infisical into a Snowflake schema, where your functions and procedures can reference them as Snowflake secrets. Each Infisical secret becomes a GENERIC_STRING secret in the schema, with the same name unless you customize key names to add a prefix or suffix.

The Snowflake Secret Sync requires a Snowflake app connection. This guide walks you through creating a project-scoped app connection.

Prerequisites

A project with secrets configured
A Snowflake account where you can create users, roles, and network policies, such as with the ACCOUNTADMIN role
A Snowflake database and schema for the synced secrets

Step 1: Create a Snowflake user and programmatic access token

Infisical needs a Snowflake user with a programmatic access token, a network policy, and a role that can create and own secrets in the schema. When you grant privileges, use the statements in the Secret syncs tab.

In Snowsight, open the sidebar and select Users & roles under Governance & Security. Users and roles

Select Create user, then enter a Username for the user Infisical will authenticate as.

If a user authenticates with a programmatic access token, Snowflake requires the user to have a network policy. Attach one to the user:To run SQL in Snowflake, select Projects, then Workspaces, to open the query editor.

The following statements create a network policy and attach it to a user named INFISICAL. Replace INFISICAL with the username you entered.

CREATE NETWORK POLICY INFISICAL_SYNC_POLICY
    ALLOWED_IP_LIST = ('0.0.0.0/0')
    COMMENT = 'Allow access from any IP';

ALTER USER INFISICAL SET NETWORK_POLICY = 'INFISICAL_SYNC_POLICY';

0.0.0.0/0 lets the user authenticate from any IP address. In production, replace it with the IP addresses Infisical connects from.

Create a role for the user, grant the role the privileges for the integration you’ll set up, and make it the user’s default role, using the same query editor.

Infisical doesn’t choose a role when it signs in, so Snowflake runs every Infisical operation under the user’s default role. If you skip the ALTER USER statement, the default role stays PUBLIC, and syncs and rotations fail even though the grants exist.

A connection signs in with one role. If you want one connection for both a sync and a rotation, grant both sets of privileges to the same role and make that role the user’s default.

Secret syncs
Secret rotations

The role needs access to the database and schema the sync writes to, and ownership of every secret in that schema that the sync manages. The following statements grant those privileges on the PUBLIC schema of a database named SECRET_SYNC_TEST:

CREATE ROLE IF NOT EXISTS INFISICAL_ROLE;
GRANT ROLE INFISICAL_ROLE TO USER INFISICAL;

GRANT ALL PRIVILEGES ON DATABASE SECRET_SYNC_TEST TO ROLE INFISICAL_ROLE;
GRANT ALL PRIVILEGES ON SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE;
GRANT OWNERSHIP ON ALL SECRETS IN SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE REVOKE CURRENT GRANTS;
GRANT OWNERSHIP ON FUTURE SECRETS IN SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE REVOKE CURRENT GRANTS;

ALTER USER INFISICAL SET DEFAULT_ROLE = INFISICAL_ROLE;

Snowflake only lets the role that owns a secret replace or drop it. If a secret already exists in the schema, it stays owned by the role that created it, so the sync fails on that secret until you transfer ownership with the GRANT OWNERSHIP ON ALL SECRETS statement. The GRANT OWNERSHIP ON FUTURE SECRETS statement covers secrets created later.

For Snowflake user key pair rotation, the role needs to be able to change the key pair of the user you’re rotating. The following statements grant that to a role, assign the role to the INFISICAL user, and make it the user’s default role:

CREATE ROLE IF NOT EXISTS INFISICAL_ROTATION_ROLE;

GRANT OWNERSHIP ON USER MY_TARGET_USER TO ROLE INFISICAL_ROTATION_ROLE;

-- Only needed if Infisical should create the target user
GRANT CREATE USER ON ACCOUNT TO ROLE INFISICAL_ROTATION_ROLE;

GRANT ROLE INFISICAL_ROTATION_ROLE TO USER INFISICAL;
ALTER USER INFISICAL SET DEFAULT_ROLE = INFISICAL_ROTATION_ROLE;

If the target user already exists, OWNERSHIP on that user is enough. If you want Infisical to create the target user, the role also needs CREATE USER on the account. For more about roles and privileges, see Snowflake’s access control documentation.

Go back to Governance & Security > Users & roles and select the user. Open the Programmatic access tokens tab and select Generate new token. Give the token a name, such as infisical, restrict it to the role you made the user’s default, and set its expiration to match your security policy. Programmatic access tokens tab

Copy the token. Snowflake shows the token only once, so save it for the Infisical form.

Copy your account identifier, which has the form orgName-accountName. You can read both parts from your Snowsight URL: https://app.snowflake.com/orgName/accountName/.You can also select your username in the bottom-left corner, open Account details, and copy the Account value from the Config File tab. Account details menu

Step 2: Set up the sync in Infisical

To create the sync using the API, use the Create Snowflake Sync endpoint.

In your project, go to Integrations and open the Secret Syncs tab. Select + Add Sync. Secret Syncs Tab

Then, select the Snowflake sync. Select Snowflake

Under Source, choose which secrets to sync from Infisical:

Environment: The project environment to retrieve secrets from
Secret Path: The folder path to retrieve secrets from
Include secrets from all subfolders: When enabled, also syncs secrets from every folder under the secret path (secret names must be unique across those folders)

If you need to sync secrets from multiple folder locations, use secret imports.

Then select Continue.

Under Destination, create or select the Snowflake app connection the sync will use, then choose where secrets go in Snowflake.

Create a new app connection
Use an existing connection

Under Snowflake Connection, select Create Connection in the dropdown, then fill in:

Name: A descriptive name for the connection
Description (optional): A note for future reference
Account: Your Snowflake account identifier, such as orgName-accountName
Username: The Snowflake user you created for Infisical
Programmatic Access Token: The token you generated for that user

Select Connect to Snowflake. Infisical returns you to the sync form with the new connection selected.

This creates a connection scoped to the current project. To share the connection across other projects, create it at the organization level first, then select it here.

Database: The Snowflake database that contains the schema
Schema: The schema the sync writes secrets to

Before the sync writes any secrets, Infisical checks that the database and schema exist and that the connection’s role can access them. If either check fails, the sync fails without writing anything. Configure Destination

Then select Continue.

Under Initial Sync Behavior, select Overwrite Snowflake, then select Continue.

Snowflake doesn’t return a secret’s value after the secret is created, so this sync can’t import existing Snowflake secrets into Infisical. Overwrite Snowflake is the only option.

Under Sync Options, choose how secrets are synced:

Prevent secret deletion: When enabled, Infisical adds and updates secrets in Snowflake but never deletes them; enable this if you manage some Snowflake secrets outside of Infisical
Auto-sync on changes: When enabled, secrets sync to Snowflake automatically as the source changes; turn it off to sync manually only
Customize key names: Adds a prefix or suffix to every synced name, using {{secretKey}} for the original name and {{environment}} for the environment slug

A Snowflake schema can hold secrets that other tools created, so a sync can change secrets that were created outside Infisical. If you don’t customize key names, the sync treats every secret in the schema that its role owns as one it manages:

If a Snowflake secret has the same name as an Infisical secret, the sync overwrites the Snowflake secret’s value
If Prevent secret deletion is off, every Snowflake secret that isn’t in Infisical is deleted

With customized key names, the sync writes only names with your prefix or suffix, and deletes only Snowflake secrets whose names match it.Before the first sync, customize key names or keep Prevent secret deletion on. Prevent secret deletion is on by default when you create the sync in the UI, but off unless you set disableSecretDeletion when you create it through the API.

Then select Continue.

Give the sync a Name and an optional Description. The name must be slug-friendly. Sync Details

Then select Continue.

Review your Snowflake Sync configuration, then select Create Sync. Review and Create

The sync is created. If Auto-sync on changes is enabled, it begins syncing secrets to the schema right away.

Get started

Manage secrets

Integrations

Secret rotation

Dynamic secrets

Honey tokens

Agent proxy

Prerequisites

Step 1: Create a Snowflake user and programmatic access token

Step 2: Set up the sync in Infisical

Next steps

Secret syncs overview

Snowflake user key pair rotation

​Prerequisites

​Step 1: Create a Snowflake user and programmatic access token

​Step 2: Set up the sync in Infisical

​Next steps

Secret syncs overview

Snowflake user key pair rotation

Prerequisites

Step 1: Create a Snowflake user and programmatic access token

Step 2: Set up the sync in Infisical

Next steps