Snowflake Integration with the Matters Platform

Last updated: May 18, 2026

This guide provides step-by-step instructions for integrating Snowflake with the Matters Platform. As part of this process, a Snowflake administrator has to create a read-only service user, generate a Programmatic Access Token through the script shared by Matters Team and use the generated details to complete the integration in Matters.

The integration enables Matters to discover Snowflake data stores and run classification scans to identify sensitive data.

Prerequisite

Before starting the setup, the Matters team will provide a Snowflake SQL script.

This script is designed to create the required Snowflake objects for a secure read-only integration, including:

Service role
Warehouse
Service user
Network policy
Read-only database access
Programmatic Access Token

The script must be executed by a Snowflake administrator using the ACCOUNTADMIN role.

Before running the script, confirm the list of Snowflake databases that should be integrated with Matters. The database names inside the script should be updated as needed.

Step 1: Retrieve the Snowflake Account Identifier

Log in to the Snowflake console and copy the Snowflake account identifier. This value will be required later while configuring the integration in the Matters Dashboard.

To retrieve it:

  1. Open the Snowflake console.

  2. Click the profile icon.

  3. Go to Account → View Account Details.

image.png

  1. Copy the Account Identifier and keep it available for the integration setup.

Step 2: Run the Snowflake Script and Generate the PAT Token

  1. The Matters team will provide a Snowflake SQL script for the integration setup.

  2. The Snowflake administrator should log in to Snowflake and open a new SQL worksheet.

image.png

  1. Paste the script provided by the Matters team into the worksheet.

image.png

Before running the script, review and update the object names properly. The script creates the following Snowflake objects:

Service Role
Warehouse
Service User
Network Policy
Read-only Database Access
Programmatic Access Token

  1. Use clear and environment-specific names for these objects.

Example:

Service Role: SVC_READER_ROLE_QA
Warehouse: SVC_READER_WH_QA
Service User: SVC_READER_QA
Network Policy: SVC_READER_NETPOL_QA
Programmatic Access Token: SVC_READER_PAT_QA

  1. Update the service user password in the script.

PASSWORD='CHANGE_ME_STRONG_PASSWORD'

Replace CHANGE_ME_STRONG_PASSWORD with a strong password that follows the organization’s password policy. (Do not use a simple, temporary, or weak password in a production setup.)

  1. Update the database list inside the script with the Snowflake databases that should be integrated with Matters.

dbsARRAYDEFAULT ARRAY_CONSTRUCT(
'CUSTOMER_DB',
'DISCOVERY_TEST_DB',
'EMPLOYEE_DETAILS',
'FINANCIAL_DB',
'HEALTHCARE_DB',
'IMPRINTS',
'SANITY',
'UTIL_DB'
);

Replace the sample database names with the actual database names from the customer’s Snowflake account.

  1. After confirming the object names, password, and database list, select the full script and click Run.

  2. The script will create the required Snowflake setup for Matters, including:

Service role
Warehouse
Service user
Network policy
Read-only access to selected databases
Programmatic Access Token

  1. Once the script runs successfully, Snowflake will display the generated PAT token.

  2. Copy the PAT token immediately and store it securely.

image.png

Note: The PAT token is displayed only once. If it is not copied at this stage, it cannot be viewed again and must be recreated.

  1. This PAT token will be used later in the Matters Dashboard to complete the Snowflake integration.

Step 3: Configure Snowflake Integration in Matters

  1. Log in to the Matters Admin Dashboard.

  2. Go to Integrations → Managed Databases.

  3. Locate the Snowflake integration card.

  4. Click Connect.

This will open the Snowflake configuration page.

image.png

Step 3: Enter Snowflake Configuration Details

On the Snowflake configuration page, provide the required details(Use the values created from the script executed):

  1. Enter a clear and recognizable Integration Name. Example: Snowflake_Prod

  2. Enter the copied Snowflake Account Name / Account Identifier.

  3. Enter the Service Username. Example: SNOWFLAKE_MATTERS_SERVICE

  4. Enter the Warehouse Name Example: SVC_READER_WH_QA

Once these details are entered, proceed to the network configuration section.

image.png

Step 4: Configure Network Settings

In the Network Configuration section, specify whether your Snowflake account is deployed within a private network.

If Snowflake is deployed in a private network

  1. Select Yes.

  2. Choose the required Export Assist.

  3. Choose the required Discovery Assist.

  4. Click Proceed to Connect.

image.png

If Snowflake is not deployed in a private network

  1. Select No.

  2. Choose the required Export Assist from the dropdown.

  3. Click Proceed to Connect.

image.png

Step 6: Confirm PAT Token Generation in Matters Dashboard

After generating the PAT token in Snowflake:

  1. Click I’ve Generated PAT Token.

image.png

  • Use the generated PAT token as the password for the Snowflake connection. Click on Connect.

image.png

Once the connection is successful, an Integration Successful message will appear. Click Go to Dashboard to continue.

Step 7: Discover Data Stores

After the Snowflake integration is completed, Matters automatically discovers the available data stores. The discovered data stores will be listed under Cloud Inventory.

image.png

To manually trigger discovery again:

  1. Go to the Snowflake integration.

  2. Click Actions.

  3. Select Discover Data Stores.

Once discovery is complete, the available Snowflake data stores will appear in the inventory list.

image.png

All the data stores will start listing down once the discovery completes.

Step 8: Run a Classification Scan

To run a classification scan:

  1. Open the Snowflake data store that you want to scan.

  2. Click Scan Data Store.

  3. Monitor the scan progress from the dashboard.

The scan checks the selected Snowflake data store for sensitive data.

image.png

Step 9 : Review Scan Results

  • After the scan is completed, navigate to the Overview page.

    • You will see detailed information on:

      • Account Properties

      • Sensitive Records Data

image.png

  • You can also view additional sensitivity details in the Entity View and Table View formats.

image.png

  • If any entities are found to be false positives, mark them by clicking on the False Positive button. This action allows you to manage the accuracy of the scan results.

image.png

  • You can view the false positives by toggling the button at the top of the page.

  • Additionally, the Scan History section provides a detailed log of all previous scans, allowing for easy reference.

Additional Features:

  1. Stop Scan:

    • At any stage of the scan, you can trigger the Stop Scan option if you wish to halt the process prematurely. This option can be useful for managing resources or stopping an incomplete scan.

image.png

  1. Export Sensitivity Data to CSV:

  • After the scan is completed, you can download the sensitivity details in CSV format under Actions button. This feature allows you to export valuable insights and share them for further analysis or auditing purposes.

image.png