Skip to main content

Connect a Snowflake or BigQuery datasource

Goal​

You'll add a Snowflake account (or a BigQuery project) to Measured Cloud, confirm the connection, and add its tables. Both connectors are shipped end-to-end (FEATURE-1, FEATURE-2).

Other warehouses on the same code path: Redshift (FEATURE-3), Databricks SQL (FEATURE-4), Microsoft SQL Server (FEATURE-5), Trino / Presto (FEATURE-6) — all shipped, with the same test + add-tables UX.

Prereqs​

  • A running Measured Cloud.
  • For Snowflake: an account locator, a username, an auth method (password OR a key-pair private key in PEM form), a warehouse, a database, a schema, and a role.
  • For BigQuery: a project ID, a dataset name, and a service-account JSON file with at minimum the roles/bigquery.dataViewer role on the dataset and roles/bigquery.jobUser on the project.

Steps​

Snowflake​

  1. Data Assets → Add source → pick Snowflake.
  2. Fill in the form: account, user, auth method, warehouse, database, schema, role.
  3. For key-pair auth: paste the unencrypted private key PEM into the key field. Measured Cloud encrypts it before it touches the DB.
  4. Test connection → green check + latency.
  5. Add tables (step 2 of the same window) → Measured Cloud lists tables/views from INFORMATION_SCHEMA.TABLES for the configured database. Tick them and click Add N tables.

BigQuery​

  1. Data Assets → Add source → pick BigQuery.
  2. Project ID, dataset, location.
  3. Paste the service-account JSON (the full credential file content) into the secret field. Measured Cloud encrypts and never displays it again.
  4. Test connection → runs SELECT 1 against the region.
  5. Add tables (step 2 of the same window) → Measured Cloud lists tables from region-<region>.INFORMATION_SCHEMA.TABLES. Tick them and click Add N tables.

Verify​

The source appears on Data Assets as a group header with a green connection badge. The tables you added show up as data assets under it.

Caveats​

  • For Snowflake key-pair auth, the UI accepts an unencrypted PEM. If you have a passphrase-protected key, decrypt it before pasting (or wait for the encrypted-PEM follow-up ticket).
  • BigQuery service-account JSON contains a private key; treat it like a password. Measured Cloud applies the same AES-256-GCM-at-rest encryption as it does for SQL passwords.
  • The SSRF guard (HARDEN-12) needs explicit awareness of Snowflake / BigQuery API hosts so you don't have to allowlist them by CIDR.