Connect Snowflake to Athena

​

Security & Privacy

• Per-user connection: Each user connects their own Snowflake account individually. Athena does not access any user’s data unless that specific user has explicitly authorized the connection. No blanket access is granted across an organization.
• Role-based access control: Connections are scoped to a specific Snowflake role, ensuring users can only access data permitted by their assigned role within Snowflake. Workspace administrators can pin a default role and configure which additional roles are available for user connections.
• Credential security: Athena encrypts all stored credentials (passwords, OAuth tokens) at rest. For OAuth-based connections, Athena uses industry-standard OAuth 2.0 flows and never sees or stores your Snowflake password.
• No bulk data extraction: Athena does not copy or permanently store the contents of your Snowflake warehouse. Queries are executed on demand when you interact with Athena, and results are scoped to the requesting user’s session.
• Network security: Athena supports SSL/TLS encrypted connections to your Snowflake account. Organizations can configure IP allowlisting to restrict Athena’s access to specific network ranges.
• Revocable at any time: Users can disconnect their Snowflake account from Athena at any time, immediately revoking access. For OAuth connections, tokens can also be revoked from the Snowflake side.

​

Workspace Owner Controls

• Restrict Snowflake integration: Workspace owners can disable the Snowflake integration for the entire workspace, preventing any member from connecting their Snowflake account.
• Control role scope: Administrators configure which Snowflake roles are available for workspace connections, including setting a pinned default role and restricting which additional roles users may select.
• Manage OAuth configuration: For OAuth-based connections, workspace owners manage the OAuth client configuration (account identifier, client ID, allowed roles) centrally for the workspace.
• Monitor connections: Administrators can view which users have active Snowflake connections within the workspace.
• Revoke access: Workspace owners can remove Snowflake connections, and organizations can revoke the OAuth app registration from the Snowflake side at any time.

​

Connection Methods

​

Workspace Connection Configuration

​

OAuth-Based Connection (Snowflake Direct)

​

Admin Setup for OAuth (once per workspace)

​

1. Create the OAuth security integration (Snowflake admin)

USE ROLE ACCOUNTADMIN;

CREATE OR REPLACE SECURITY INTEGRATION ATHENA_DIRECT_OAUTH
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://api.athenaintel.com/api/snowflake-direct/oauth/callback'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000  -- 90 days
  ENABLED = TRUE;

-- Copy OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET out of the JSON result.
SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('ATHENA_DIRECT_OAUTH');

• OAUTH_CLIENT_TYPE = 'CONFIDENTIAL' is required; Athena authenticates the token exchange with the client ID and secret.
• OAUTH_ISSUE_REFRESH_TOKENS = TRUE is required so short-lived access tokens refresh without re-prompting members.
• The redirect URI must match exactly: no trailing slash, and https matters.
• The integration itself doesn’t name a role. Athena requests the role at OAuth time as the session:role:<chosen_role> scope, and the default comes from the Pinned Role (default) field in step 2, so every role you expose must be GRANTed to the members who will connect.

​

2. Save the OAuth app in Athena (Olympus workspace admin)

​

Setup Instructions

1

Select your data source

Navigate to Integrations. Click on Snowflake.

2

Configure the connection

Click Connect Snowflake (Direct). If more than one app is configured, choose the app for your Snowflake account.Your workspace administrator has already configured the account identifier, client ID and allowed roles. Authorize Athena through Snowflake’s sign-in flow. If the app uses Pinned role, choose a role when prompted first; the connection uses that role for its lifetime, so connect separately for each role you need. If it uses Any granted role, there is no role prompt, and one connection can use any role Snowflake grants you.Athena uses OAuth for this flow. Enter your password only on Snowflake’s sign-in page. The Integrations dialog does not ask for a username, password or Test Connection step.

3

Select a warehouse (OAuth only)

For OAuth-based connections, after completing the authorization flow, select the default Snowflake warehouse for your queries from the available warehouses visible to your connected account, then click Connect.