Register a Snowflake provider

Register Snowflake storage and compute with Redis Feature Form.

Register a snowflake provider when Redis Feature Form should discover Snowflake tables, run structured query language (SQL) transformations, or materialize training sets and feature-view data in Snowflake.

The provider fills the offline-store and compute roles for one account, warehouse, database, and schema. It doesn't provide online serving. A serving feature view also needs a supported online-store provider.

Before you begin

Make sure you have:

• A Feature Form workspace.
• A Snowflake account identifier, warehouse, database, and schema.
• A Snowflake username with password or key-pair authentication.
• A secret provider for each password, private key, or passphrase reference.
• Network access from the Feature Form server and workers to Snowflake.

Set host on SnowflakeConfig, or use --snowflake-host with the CLI, for a PrivateLink or custom hostname. Without it, Feature Form derives the standard hostname from the account identifier.

The Python examples use this workspace-scoped provider client:

import featureform as ff

client = ff.Client.from_env()
providers = client.providers("<workspace-id>")

Choose authentication

Don't use skip_health_check=True or --skip-health-check to register OAuth. Skipping the check postpones the unsupported-authentication error until the provider is used.

Register with a password

from featureform.types import EnvSecretRef, ProviderType, SnowflakeConfig

providers.register(
    name="<snowflake-provider-name>",
    provider_type=ProviderType.SNOWFLAKE,
    config=SnowflakeConfig(
        account="<snowflake-account>",
        warehouse="<warehouse-name>",
        database="<database-name>",
        schema="<schema-name>",
        role="<role-name>",
        auth_type="password",
        username="<username>",
        password_secret=EnvSecretRef(name="SNOWFLAKE_PASSWORD"),
    ),
)

ff provider register <snowflake-provider-name> \
  --workspace <workspace-id> \
  --type snowflake \
  --snowflake-account <snowflake-account> \
  --snowflake-warehouse <warehouse-name> \
  --snowflake-database <database-name> \
  --snowflake-schema <schema-name> \
  --snowflake-role <role-name> \
  --snowflake-auth-type password \
  --snowflake-username <username> \
  --snowflake-password-secret env:SNOWFLAKE_PASSWORD

The environment reference is resolved by the Feature Form server. Replace it with a reference to another registered secret backend when appropriate.

Register with a key pair

from featureform.types import K8sSecretRef, ProviderType, SnowflakeConfig

providers.register(
    name="<snowflake-provider-name>",
    provider_type=ProviderType.SNOWFLAKE,
    config=SnowflakeConfig(
        account="<snowflake-account>",
        warehouse="<warehouse-name>",
        database="<database-name>",
        schema="<schema-name>",
        role="<role-name>",
        auth_type="key-pair",
        username="<username>",
        private_key_secret=K8sSecretRef(
            provider_name="<secret-provider-name>",
            name="<secret-name>",
            key="private-key",
        ),
        passphrase_secret=K8sSecretRef(
            provider_name="<secret-provider-name>",
            name="<secret-name>",
            key="private-key-passphrase",
        ),
    ),
)

ff provider register <snowflake-provider-name> \
  --workspace <workspace-id> \
  --type snowflake \
  --snowflake-account <snowflake-account> \
  --snowflake-warehouse <warehouse-name> \
  --snowflake-database <database-name> \
  --snowflake-schema <schema-name> \
  --snowflake-role <role-name> \
  --snowflake-auth-type key-pair \
  --snowflake-username <username> \
  --snowflake-private-key-secret k8s@<secret-provider-name>:<secret-name>#private-key \
  --snowflake-passphrase-secret k8s@<secret-provider-name>:<secret-name>#private-key-passphrase

Omit --snowflake-passphrase-secret when the private key isn't encrypted. The resolved value must be a Rivest-Shamir-Adleman (RSA) private key.

Configure sessions

In Python, set login_timeout, request_timeout, or session_params on SnowflakeConfig. With the CLI, use these optional flags:

--snowflake-login-timeout <seconds>
--snowflake-request-timeout <seconds>
--snowflake-session-param <key>=<value>

Repeat --snowflake-session-param for multiple values. Keys and values must be nonempty.

Grant health-check permissions

The default registration health check:

1. Opens a Snowflake session.
2. Selects the configured warehouse.
3. Creates a health-check table in the configured database and schema.
4. Drops the table.

The Snowflake role therefore needs USAGE on the warehouse, database, and schema, plus permission to create and drop a table in that schema. Read-only credentials can't pass the default check.

Workloads can require additional permissions:

A successful registration check doesn't test every source table, access policy, masking policy, or warehouse quota.

Understand supported workloads

Key-pair authentication works for direct Snowflake dataframe reads. A Spark-based Snowflake Java Database Connectivity (JDBC) plan currently requires password authentication.

Verify registration

ff provider get <snowflake-provider-name> --workspace <workspace-id>
ff provider list --workspace <workspace-id>

In Python, use providers.get("<snowflake-provider-name>") or providers.list().

Update safely

Before a forced update or deletion, review datasets, transformations, training sets, feature views, and other references to the provider. The usage check doesn't detect every indirect reference.

Troubleshoot registration