Reader accounts for non-Snowflake users - Commands & Configuration

Introduction

Sometimes, you want to share your Snowflake data with people or systems that do not have their own Snowflake accounts. Reader accounts let you do this by creating a special account that can only read the shared data without needing a full Snowflake license.

When you want to share data securely with a partner who does not have a Snowflake account.

When you need to provide read-only access to your data for auditing purposes without giving full access.

When a client or vendor needs to query your data but you want to control and limit their access.

When you want to avoid the cost and complexity of creating full Snowflake accounts for external users.

When you want to track usage and billing separately for shared data access.

Config File - create_reader_account.sql

create_reader_account.sql

CREATE READER ACCOUNT my_reader_account
  ADMIN_NAME = 'reader_admin'
  ADMIN_PASSWORD = 'StrongPassw0rd!'
  DEFAULT_WAREHOUSE = 'COMPUTE_WH'
  DEFAULT_NAMESPACE = 'SHARED_DB.PUBLIC';

-- Grant usage on shared database
GRANT IMPORTED PRIVILEGES ON DATABASE SHARED_DB TO READER ACCOUNT my_reader_account;

This SQL script creates a reader account named my_reader_account with an admin user and password. It sets a default warehouse and namespace for queries. The last command grants the reader account permission to use the shared database SHARED_DB. This setup allows the reader account to access shared data securely without full Snowflake user privileges.

Commands

This command runs the SQL script to create the reader account and grant it access to the shared database. It uses the SnowSQL CLI connected as the admin user.

Terminal

snowsql -a myaccount -u admin -f create_reader_account.sql

Expected Output

Connecting to Snowflake...

SQL execution successful. 2 statements executed.

→

-a - Specifies the Snowflake account to connect to.

→

-u - Specifies the username to connect as.

→

-f - Runs the SQL commands from the specified file.

This command logs into the newly created reader account using its admin user. It sets the default warehouse, database, and schema to query the shared data.

Terminal

snowsql -a myaccount -u reader_admin -w COMPUTE_WH -d SHARED_DB -s PUBLIC

Expected Output

Connecting to Snowflake...

Welcome to Snowflake.

You are now connected as reader_admin to database SHARED_DB, schema PUBLIC.

→

-w - Sets the default warehouse for queries.

→

-d - Sets the default database.

→

-s - Sets the default schema.

This command queries the first 5 rows from a shared table using the reader account to verify access.

Terminal

SELECT * FROM shared_table LIMIT 5;

Expected Output

ID | NAME    | VALUE

---+---------+-------

1  | Alice   | 100

2  | Bob     | 200

3  | Charlie | 300

4  | Diana   | 400

5  | Evan    | 500

Key Concept

If you remember nothing else from this pattern, remember: Reader accounts let you share Snowflake data securely with users who do not have their own Snowflake accounts by giving them read-only access through a special managed account.

Common Mistakes

Trying to create a reader account without specifying an admin user and password.

Snowflake requires an admin user for the reader account to manage access and authentication.

Always specify ADMIN_NAME and ADMIN_PASSWORD when creating a reader account.

Not granting usage privileges on the shared database to the reader account.

Without these privileges, the reader account cannot access the shared data.

Use GRANT IMPORTED PRIVILEGES ON DATABASE to give the reader account access.

Trying to run queries on the reader account without setting the default warehouse or database.

Queries will fail because the reader account does not know where to run or what data to access.

Set default warehouse, database, and schema when connecting with the reader account.

Summary

Create a reader account with an admin user and password to enable secure data sharing.

Grant the reader account usage privileges on the shared database to allow data access.

Connect to the reader account with proper defaults and run queries to verify access.

Practice

1. What is the main purpose of a Reader Account in Snowflake?

easy

A. To monitor Snowflake account usage and billing

B. To allow non-Snowflake users to access shared data securely

C. To manage user permissions within a Snowflake account

D. To create a backup of Snowflake data

Solution

1. Step 1: Understand the role of Reader Accounts

   Reader accounts are designed to let users without Snowflake accounts access shared data safely.

2. Step 2: Compare options with this purpose

   The options for monitoring usage, creating backups, and managing user permissions describe other Snowflake features unrelated to Reader Accounts.

3. Final Answer:

   To allow non-Snowflake users to access shared data securely -> Option B

4. Quick Check:

   Reader Account purpose = secure data access for non-users [OK]

Hint: Reader accounts = access for users without Snowflake [OK]

Common Mistakes:

• Confusing Reader accounts with user management
• Thinking Reader accounts are for backups
• Assuming Reader accounts monitor billing

2. Which SQL command is used to create a Reader Account from an existing share in Snowflake?

easy

A. CREATE READER ACCOUNT

B. CREATE ACCOUNT READER

C. CREATE READER ACCOUNT FROM SHARE

D. CREATE SHARE READER ACCOUNT

Solution

1. Step 1: Recall the correct syntax for creating Reader Accounts

   The correct command is CREATE READER ACCOUNT ... FROM SHARE ... followed by parameters.

2. Step 2: Eliminate incorrect syntax options

   Only CREATE READER ACCOUNT FROM SHARE matches the correct syntax including the FROM SHARE clause.

3. Final Answer:

   CREATE READER ACCOUNT FROM SHARE -> Option C

4. Quick Check:

   Command to create Reader Account from share = CREATE READER ACCOUNT FROM SHARE [OK]

Hint: Remember exact phrase: CREATE READER ACCOUNT FROM SHARE [OK]

Common Mistakes:

• Omitting FROM SHARE clause
• Swapping word order
• Combining CREATE and SHARE incorrectly

3. Given the SQL snippet:

CREATE READER ACCOUNT partner_reader FROM SHARE partner_share;

What is the expected result of this command?

medium

A. Grants partner_share access to the partner_reader account

B. Creates a new share named partner_reader from the account partner_share

C. Deletes the share named partner_share

D. Creates a new Snowflake account named partner_reader with access to partner_share data

Solution

1. Step 1: Analyze the CREATE READER ACCOUNT command

   This command creates a new reader account named partner_reader that can access data shared via partner_share.

2. Step 2: Understand the relationship between reader account and share

   The reader account is a new Snowflake account for external users, linked to the existing share.

3. Final Answer:

   Creates a new Snowflake account named partner_reader with access to partner_share data -> Option D

4. Quick Check:

   CREATE READER ACCOUNT creates account with share access [OK]

Hint: Reader account = new account accessing existing share [OK]

Common Mistakes:

• Confusing share creation with reader account creation
• Thinking the share is deleted
• Mixing up grant and create commands

4. You run this command:

CREATE READER ACCOUNT my_reader FROM SHARE;

But get an error. What is the likely cause?

medium

A. Missing share name after FROM SHARE

B. Reader accounts cannot be created from shares

C. Syntax requires USING keyword before share name

D. Reader account name cannot contain underscores

Solution

1. Step 1: Check the command syntax

   The command must specify the share name after FROM SHARE. Here, it is missing.

2. Step 2: Verify other options

   Reader accounts can be created from shares, no USING keyword is needed, and underscores are allowed in names.

3. Final Answer:

   Missing share name after FROM SHARE -> Option A

4. Quick Check:

   FROM SHARE must be followed by share name [OK]

Hint: Always specify share name after FROM SHARE [OK]

Common Mistakes:

• Omitting share name
• Adding unnecessary keywords
• Assuming naming restrictions that don't exist

5. A company wants to share data with a partner who does not have a Snowflake account. Which steps correctly describe how to enable this using Reader Accounts?

hard

A. Create a share with the data, then create a Reader Account from that share for the partner

B. Create a Reader Account first, then create a share inside that account

C. Ask the partner to create a Snowflake account, then grant access

D. Export data to CSV and send it manually

Solution

1. Step 1: Understand Reader Account workflow

   First, create a share containing the data to share.

2. Step 2: Create a Reader Account from the share

   This creates a Snowflake account for the partner to access the shared data without needing their own account.

3. Step 3: Evaluate other options

   Create a Reader Account first, then create a share inside that account reverses the order incorrectly; C requires partner to have an account; D is manual and not using Snowflake features.

4. Final Answer:

   Create a share with the data, then create a Reader Account from that share for the partner -> Option A

5. Quick Check:

   Share data first, then create Reader Account [OK]

Hint: Share data first, then create Reader Account [OK]

Common Mistakes:

• Creating Reader Account before share
• Assuming partner must have Snowflake account
• Using manual data export instead of Reader Account