Reader accounts for non-Snowflake users - Deep Dive

Overview - Reader accounts for non-Snowflake users

What is it?

Reader accounts in Snowflake let people who don't have their own Snowflake account access shared data securely. Instead of creating full accounts for every user, Snowflake creates a special limited account called a reader account. This account only allows access to the shared data and nothing else. It helps organizations share data easily with partners or customers who don't use Snowflake.

Why it matters

Without reader accounts, sharing data with people outside your organization who don't have Snowflake would be hard or require them to sign up and pay for a full account. Reader accounts solve this by giving controlled, read-only access without extra cost or setup for the other party. This makes data sharing faster, safer, and more cost-effective, enabling better collaboration and business decisions.

Where it fits

Before learning about reader accounts, you should understand basic Snowflake concepts like accounts, databases, and data sharing. After this, you can explore advanced data sharing features, security controls, and multi-cloud data collaboration.

Mental Model

Core Idea

A reader account is a special, limited Snowflake account created automatically to let non-Snowflake users securely access shared data without needing a full account.

Think of it like...

Imagine you have a locked library with valuable books. Instead of giving everyone a library card, you create a guest pass that only lets visitors read certain books inside the library but not borrow or access other areas.

┌─────────────────────────────┐
│       Snowflake Account      │
│  (Data Owner / Provider)     │
└─────────────┬───────────────┘
              │ Shares data
              ▼
┌─────────────────────────────┐
│      Reader Account          │
│ (Limited access, read-only) │
│  For non-Snowflake users    │
└─────────────────────────────┘

Build-Up - 7 Steps

1

Foundation

What is a Snowflake account

Concept: Introduce the basic idea of a Snowflake account as a user or organization identity in Snowflake.

A Snowflake account is like your personal space in Snowflake where you store data, run queries, and manage users. Each account has its own databases and security settings. To use Snowflake, you normally need an account.

Result

You understand that Snowflake accounts are the starting point for using Snowflake services.

Knowing what an account is helps you see why sharing data with people without accounts needs a special solution.

2

Foundation

Basics of data sharing in Snowflake

Concept: Explain how Snowflake lets accounts share data securely with other accounts.

Snowflake allows one account to share data with another by creating a share object. The receiving account can then access the shared data without copying it. This sharing is secure and controlled by the data owner.

Result

You see how data sharing works between Snowflake accounts.

Understanding sharing between accounts sets the stage for why reader accounts are needed for non-account users.

3

Intermediate

Introducing reader accounts concept

🤔Before reading on: do you think non-Snowflake users can access shared data without a Snowflake account? Commit to yes or no.

Concept: Reader accounts let people without Snowflake accounts access shared data safely.

Reader accounts are special accounts Snowflake creates automatically when you share data with someone who doesn't have a Snowflake account. These accounts have limited permissions and only allow read access to the shared data. The data owner controls and pays for these accounts.

Result

You understand that reader accounts bridge the gap for non-Snowflake users to access data.

Knowing reader accounts exist helps you share data widely without forcing everyone to create full accounts.

4

Intermediate

How reader accounts are created and managed

🤔Before reading on: do you think the data recipient manages the reader account or the data provider? Commit to your answer.

Concept: Reader accounts are created and controlled by the data provider, not the recipient.

When you share data with a non-Snowflake user, Snowflake creates a reader account owned by your organization. You manage its permissions, monitor usage, and pay for it. The recipient just uses the credentials you provide to access the shared data.

Result

You see that reader accounts give control and responsibility to the data provider.

Understanding who manages reader accounts clarifies security and billing responsibilities.

5

Intermediate

Access and security controls for reader accounts

🤔Before reading on: do you think reader accounts can modify or delete shared data? Commit to yes or no.

Concept: Reader accounts have strict read-only access to protect shared data.

Reader accounts only allow reading the shared data. They cannot write, modify, or delete anything. This ensures the data stays safe and unchanged. You can also set network policies and monitor usage to keep access secure.

Result

You understand the security boundaries of reader accounts.

Knowing the strict access limits helps prevent accidental data changes and builds trust in sharing.

6

Advanced

Billing and cost implications of reader accounts

🤔Before reading on: do you think reader accounts are free for the data provider? Commit to yes or no.

Concept: Reader accounts incur costs billed to the data provider, not the recipient.

Since reader accounts are full Snowflake accounts under the hood, they consume compute and storage resources. The data provider pays for these costs. This means you should manage reader accounts carefully to avoid unexpected charges.

Result

You realize the financial responsibility of using reader accounts.

Understanding billing helps you plan and control costs when sharing data externally.

7

Expert

Advanced use cases and limitations of reader accounts

🤔Before reading on: do you think reader accounts support all Snowflake features like stored procedures or external functions? Commit to yes or no.

Concept: Reader accounts have limitations and are best for simple read-only data sharing scenarios.

Reader accounts do not support all Snowflake features such as creating objects, running stored procedures, or using external functions. They are designed for straightforward data consumption. For complex interactions, full Snowflake accounts are needed. Also, managing many reader accounts requires automation and monitoring.

Result

You know when reader accounts are suitable and when they are not.

Recognizing limitations prevents misuse and guides choosing the right sharing method.

Under the Hood

Underneath, a reader account is a full Snowflake account with restricted permissions. When a share is created for a non-Snowflake user, Snowflake provisions this account automatically, linking it to the shared data. The reader account uses Snowflake's role-based access control to enforce read-only access. Billing tracks usage under the provider's account. Authentication is managed via credentials given to the recipient.

Why designed this way?

Snowflake designed reader accounts to enable seamless data sharing without forcing recipients to create accounts or manage billing. This approach balances security, control, and ease of use. Alternatives like public data sharing or manual account creation were less secure or more complex. The design ensures providers retain control and responsibility.

┌───────────────────────────────┐
│       Data Provider Account    │
│  ┌─────────────────────────┐  │
│  │  Shared Data (Database)  │  │
│  └─────────────┬───────────┘  │
│                │ Creates share│
│                ▼             │
│  ┌─────────────────────────┐  │
│  │    Reader Account        │  │
│  │ (Auto-created, limited) │  │
│  └─────────────┬───────────┘  │
│                │ Access data  │
│                ▼             │
│       Non-Snowflake User      │
└───────────────────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: do you think reader accounts allow users to write or change shared data? Commit to yes or no.

Common Belief: Reader accounts let users modify shared data just like normal accounts.

Reality: Reader accounts have read-only access and cannot modify or delete any data.

Why it matters: Believing otherwise risks data corruption or security breaches if users expect write access.

Quick: do you think the recipient of shared data manages the reader account billing? Commit to yes or no.

Common Belief: The non-Snowflake user receiving data pays for the reader account usage.

Reality: The data provider owns and pays for the reader account and its usage costs.

Why it matters: Misunderstanding billing can cause unexpected charges and budgeting issues for providers.

Quick: do you think reader accounts support all Snowflake features like running procedures? Commit to yes or no.

Common Belief: Reader accounts have full Snowflake capabilities just like regular accounts.

Reality: Reader accounts are limited to read-only data access and do not support advanced features.

Why it matters: Expecting full features can lead to failed implementations and confusion.

Quick: do you think reader accounts require manual setup by the data provider? Commit to yes or no.

Common Belief: Data providers must manually create and configure reader accounts for each user.

Reality: Snowflake automatically creates reader accounts when sharing data with non-users.

Why it matters: Thinking manual setup is needed can delay sharing and increase administrative overhead.

Expert Zone

1

Reader accounts share the same underlying Snowflake infrastructure but are isolated logically to enforce strict access controls.

2

Managing many reader accounts at scale requires automation tools and monitoring to avoid cost overruns and security risks.

3

Reader accounts can be revoked or rotated easily, giving providers fine-grained control over external data access.

When NOT to use

Avoid reader accounts when recipients need to write data, run complex queries, or use advanced Snowflake features. Instead, provision full Snowflake accounts or use other data sharing methods like external tables or APIs.

Production Patterns

In production, reader accounts are used for sharing data with partners, customers, or vendors who need read-only access without Snowflake subscriptions. Providers automate account lifecycle management and monitor usage to control costs and security.

Connections

Role-Based Access Control (RBAC)

Reader accounts rely on RBAC to enforce strict read-only permissions.

Understanding RBAC helps grasp how reader accounts limit what users can do, ensuring data safety.

Cloud Multi-Tenancy

Reader accounts are isolated tenants within Snowflake's multi-tenant cloud architecture.

Knowing multi-tenancy explains how multiple reader accounts coexist securely on shared infrastructure.

Digital Rights Management (DRM)

Reader accounts implement a form of DRM by controlling who can access and how data is used.

Seeing reader accounts as DRM helps appreciate their role in protecting data ownership and usage rights.

Common Pitfalls

#1 Assuming reader accounts allow data modification.

Wrong approach:

GRANT ALL PRIVILEGES ON DATABASE shared_db TO READER_ACCOUNT;

Correct approach:

GRANT USAGE ON DATABASE shared_db TO READER_ACCOUNT; -- read-only access

Root cause:

Misunderstanding that reader accounts are read-only leads to incorrect permission grants.

#2 Expecting recipients to manage reader account billing.

Wrong approach:

Telling recipients to pay for their reader account usage.

Correct approach:

Provider manages and pays for reader account usage; recipients only use credentials.

Root cause:

Confusing account ownership with user access causes billing misunderstandings.

#3 Manually creating reader accounts for each user.

Wrong approach:

CREATE ACCOUNT reader_account FOR USER external_user;

Correct approach:

Use Snowflake's automatic reader account creation via data sharing features.

Root cause:

Not knowing Snowflake automates reader account provisioning leads to unnecessary manual work.

Key Takeaways

Reader accounts let non-Snowflake users securely access shared data without needing full accounts.

They are automatically created and managed by the data provider, who controls permissions and billing.

Reader accounts have strict read-only access to protect data integrity and security.

They are best for simple data sharing scenarios and have limitations on advanced Snowflake features.

Understanding reader accounts helps organizations share data widely while maintaining control and cost efficiency.