Who can query your Snowflake account, and with which roles

Snowflake users, service accounts and roles, with users created, disabled, re-enabled, removed and granted roles from Ploy.

TYPE · INFRAAUTH · KEY PAIRDOMAIN · SNOWFLAKE.COM

Snowflake connectorHOURLY SYNCCAPABILITIES

WHAT PLOY DOES

Sync users and service accountsEvery Snowflake user arrives in Ploy, with people and service users told apart.

READ

Read rolesEach user carries the roles granted to them directly, and their last sign-in.

READ

Create a userPloy creates the Snowflake user once a request is approved.

WRITE

Grant a rolePloy grants the role the request approved.

WRITE

Disable, enable and removePloy disables a user on offboarding, enables them when access comes back, or removes them.

WRITE

2.1WHAT IT UNLOCKS

Three jobs this connector does on day one

REQUESTS

An approved request grants the Snowflake role it names, picked from the roles in your account.

REVIEWS

People and service users sit side by side with their roles, so a reviewer sees every login that can reach your data.

LEAVERS

Offboarding disables the Snowflake user, and the change is tracked until it is confirmed.

2.3

TYPICALLY 10 MINUTES

STEP 01

Create a service user with an RSA public key, and give its default role MANAGE GRANTS on the account.

STEP 02

Enter the account identifier, the username and the private key. One connection covers one Snowflake account.

STEP 03

Ploy signs in, then users and roles land in the graph. The scan uses no warehouse, so it costs no credits.

2.4OFTEN CONNECTED TOGETHER