Overview
Integrating Snowflake with Axiom allows you to provide just-in-time access to built-in and custom Snowflake roles. In the Axiom access request form, users will select the integrated Snowflake account as the Target, and the built-in or custom Snowflake role as the Permission. Once the request is approved, Axiom will automatically grant the selected role to the access request Principal; once the duration defined on the request ends, Axiom will automatically revoke that role from the Principal.
In Q3/Q4 2025 we will be adding support for more Snowflake use cases: just in time role creation for granular resources (database>schema>table/view), and to Warehouses.
Prerequisites
For Snowflake part of the integration:
A Snowflake user with a ACCOUNTADMIN or ORGADMIN role.
For Axiom part of integration:
An Axiom Account Admin.
Integration details
NOTE!
In August 2025, we will be switching to service-level authentication using key-pair authentication. Any integrations done during the Preview stage, using username and password, as described below, will need to be updated once the change is released (without any loss of data).
Snowflake
Acting as a user with ACCOUNTADMIN or ORGADMIN role:
Create a user for the Axiom integration:
CREATE USER axiom-service {some secure password}You can name the user whatever you want.
Save the password - you will need it in the Axiom part of the integration.
Provide the Axiom integration user with the required privileges:
GRANT ROLE ACCOUNTADMIN to axiom-service
Once we release the key-pair authentication method we will also publish a list of minimal required privileges for the Axiom integration, allowing you to use lesser privileges than ACCOUNTADMIN.
Provide the Axiom integration user with access to a Snowflake warehouse.
ALTER USER axiom-service SET DEFAULT_WAREHOUSE = {the-warehouse-name-you-want-axiom-service-to-use}
GRANT USAGE ON WAREHOUSE {same-warehouse-name} TO USER {axiom-service};
Axiom
Sign in to the Axiom user console as an Axiom Admin, and go to Integrations from the left-side main navigation.
Press on the "+ Add integration" button on top right, and select Snowflake
Give the integration a name (the alias for the Snowflake account, as it will appear in Axiom), and the Snowflake Account Identifier
To find your Snowflake Account Identifier, open your user menu by pressing on your user name in the bottom left side of the Snowflake web console, then press on "Connect a tool to Snowflake"
Press "Next" (bottom right), and enter the username and password for the user you created in Snowflake for this integration, or select "Use self-hosted Axiom Runner" - learn more about Axiom Runners here ↗
