Snowflake Destination

Prerequisites

• A Snowflake account (any edition: Standard, Enterprise, Business Critical)
• ACCOUNTADMIN or SECURITYADMIN role access to create users and grant privileges

Step 1: Create a Dedicated User and Role

Run the following SQL in a Snowflake worksheet as ACCOUNTADMIN:

-- Create a role for Landed
CREATE ROLE IF NOT EXISTS LANDED_ROLE;

-- Create a user for Landed
CREATE USER IF NOT EXISTS LANDED_USER
  PASSWORD = '<strong-password>'
  DEFAULT_WAREHOUSE = 'COMPUTE_WH'
  DEFAULT_ROLE = 'LANDED_ROLE'
  MUST_CHANGE_PASSWORD = FALSE;

-- Grant the role to the user
GRANT ROLE LANDED_ROLE TO USER LANDED_USER;

Step 2: Grant Required Privileges

-- Warehouse access (X-Small is sufficient for most workloads)
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE LANDED_ROLE;

-- Database access (create the database first if it doesn't exist)
CREATE DATABASE IF NOT EXISTS LANDED;
GRANT USAGE ON DATABASE LANDED TO ROLE LANDED_ROLE;
GRANT CREATE SCHEMA ON DATABASE LANDED TO ROLE LANDED_ROLE;

-- Schema access
GRANT USAGE ON SCHEMA LANDED.PUBLIC TO ROLE LANDED_ROLE;
GRANT CREATE TABLE ON SCHEMA LANDED.PUBLIC TO ROLE LANDED_ROLE;

-- If you want Landed to use a specific schema other than PUBLIC:
-- GRANT USAGE ON SCHEMA LANDED.<your_schema> TO ROLE LANDED_ROLE;
-- GRANT CREATE TABLE ON SCHEMA LANDED.<your_schema> TO ROLE LANDED_ROLE;

Step 3: Find Your Account Identifier

Your Snowflake account identifier includes the region. Examples:

Format	Example
Organization-based	myorg-account123
Legacy (with region)	xy12345.us-east-1
Legacy (AWS us-west-2)	xy12345 (no region suffix needed)

To find it:

1. Log into Snowflake
2. Click your name in the bottom-left corner
3. Hover over your account to see the full identifier
4. Or run: SELECT CURRENT_ACCOUNT(), CURRENT_REGION();

Do not include .snowflakecomputing.com in the account field.

Step 4: Configure in Landed

Field	Value
Account	Your Snowflake account identifier (e.g., xy12345.us-east-1)
User	LANDED_USER (or whatever you named it)
Password	The password you set in Step 1
Warehouse	COMPUTE_WH (or your preferred warehouse)
Database	LANDED (or your preferred database)
Schema	PUBLIC (or your preferred schema)

Step 5: Network Access

If your Snowflake account uses network policies, you must allow Landed's static egress IPs:

Environment	IPs
Production	34.170.185.84, 35.192.90.94
Staging	34.171.93.34

Add them to your network policy:

ALTER NETWORK POLICY my_policy SET
  ALLOWED_IP_LIST = ('34.170.185.84', '35.192.90.94', ...existing IPs...);

Common Errors

Error	Cause	Fix
Incorrect username or password	Wrong credentials	Double-check user and password. Snowflake usernames are case-sensitive.
Warehouse does not exist or not authorized	Missing USAGE grant	Run GRANT USAGE ON WAREHOUSE ... TO ROLE LANDED_ROLE;
Database does not exist or not authorized	Missing database grant	Verify database exists and role has USAGE privilege
IP not allowed	Network policy blocking	Add Landed's static IPs to your network policy
Account not found	Wrong account identifier	Verify the account identifier format. Try with and without region suffix.

Key-Pair Authentication (Optional)

For enhanced security, Snowflake supports key-pair authentication instead of passwords. Contact Landed support for setup instructions.

What Landed Creates

Landed creates tables in your specified database and schema with the naming pattern <CONNECTOR>__<STREAM> (e.g., STRIPE__CUSTOMERS). Snowflake uppercases all identifiers by default.