Connector guide
Connect Snowflake safely
Role-based, read-only warehouse access for organization administrators
1. Create a dedicated custom role and service user
Create a MAYA_READER custom role and a service user dedicated to Maya. Grant USAGE only on the approved warehouse, databases, and schemas, plus SELECT only on approved tables or secure views. Do not grant ACCOUNTADMIN, SECURITYADMIN, SYSADMIN, OWNERSHIP, CREATE, or write privileges.
2. Restrict network and authentication
- Prefer key-pair authentication with an encrypted private key over a reusable password.
- Apply a Snowflake network policy limited to Maya’s documented egress addresses.
- Use a small, dedicated warehouse with an automatic suspension timeout and resource monitor.
- Keep production and non-production roles, users, warehouses, and keys separate.
3. Expose only approved data
- Prefer secure views that expose only fields needed for Maya’s approved use cases.
- Apply masking or row-access policies before granting the Maya role access.
- Exclude secrets, authentication data, full payment details, health data, and regulated identifiers.
- Limit database and schema grants explicitly; avoid future broad grants.
4. Verify before connecting
- The role can run SELECT but cannot create, alter, insert, update, delete, unload, or administer objects.
- Only approved databases, schemas, views, and warehouses are visible.
- Query timeout, warehouse size, auto-suspend, and credit controls are active.
- Authentication material never enters prompts, evidence, or general audit logs.
5. Rotate and revoke
Rotate secrets or keys on a defined schedule and immediately after suspected exposure. Disconnect the integration in Maya before disabling the external identity, and retain only non-sensitive audit metadata.