Important Updates to Snowflake Authentication Policies and Access in Keboola

These changes align with Snowflake’s updated authentication requirements and policies, as outlined in Snowflake’s announcement. To ensure uninterrupted service and compliance with these new policies, Keboola will implement updates in several phases. Below, we outline what’s changing and how we will support you during this transition.

Changes to be implemented between February and March 2025

1. Updating Snowflake User Types (no action needed):

All Snowflake user objects without a defined TYPE will be updated to use LEGACY_SERVICE (and later to a newer SERVICE type) to prevent authentication issues. This will happen on the background without any interruption of the service.

2. Authentication for SQL Workspaces:

SAML Authentication for SQL Workspaces (no action needed): Starting in Q1 2025, we will introduce SAML-based authentication for Snowflake SQL user workspaces accessed via the Keboola platform (valid only to non-BYODB Snowflake accounts). This enhancement provides a more secure, single sign-on method for connecting to Snowsight and other SQL development tools. You don’t need to configure anything on your end—Keboola will handle all setup and provisioning so you can continue working uninterrupted.

Action Required for BYODB Customers: If you use your own Snowflake database as a backend (BYODB), we will send you a set of SQL queries to run in your environment. These queries will update user configurations and network settings to meet the new authentication requirements. Our support team will reach out individually to ensure you have the resources and instructions you need to complete this process smoothly. No action is required from you until you receive these instructions.

Implementation plan for April to August, 2025

1. Migration to Key-Pair Authentication:

In Q2-Q3 2025, we will migrate all Snowflake components to key-pair authentication. This more secure method eliminates the need for manual password management and enhances protection against unauthorized access. Users will need to reauthorize the components to use key-pair authentication instead of username/password. We will make every effort to ensure a seamless transition and will provide you with clear instructions on updating your credentials. We will publish details about readiness of each particular component for such change.

Additionally, we will switch the authentication method for our backend services, such as SQL transformations; however, no action will be required on your part.

2. Changes to SQL Workspace Access for Keboola-Managed Snowflake Projects:

Users of Keboola’s shared Snowflake database backend (not BYODB) will no longer have direct access to SQL workspaces, due to Snowflake’s updated policies prohibiting such access for shared accounts.

As a result, database credentials and Snowsight access would not be available for SQL development in these projects.

This change also impacts the schema and user provisioning features of the Snowflake writer within Keboola’s shared Snowflake database, which is frequently used to connect third-party BI tools.

As we understand that both SQL development and BI tool integration are crucial parts of the platform experience, we are taking the following steps to support this transition:

• Enhancing SQL Development Experience in Keboola UI: We are actively working on improving SQL development tools directly within the Keboola platform to ensure a seamless and efficient experience for users. The first version of the new SQL editor will be available at the beginning of Q2.
• Providing Options for Workspace Access:
  • Use Your Existing Cloud DWH (Snowflake or BigQuery). If you already have a data warehouse, our team will be happy to assist with transitioning Keboola to operate seamlessly on top of your current environment.
  • Dedicated Snowflake Account through our reseller program, offering full control over users, schemas, and security settings.
  • A Lightweight Version of a Dedicated Snowflake Account specifically for SQL development and BI tool integration (provided by Keboola) without direct access to Keboola’s shared database. This option is closest to the current experience of the users. It is currently in design, and we will share more details in March.
  • Transition to BigQuery, which we also offer directly through Keboola.

Next Steps

We are committed to ensuring a smooth transition and minimizing any disruption to your operations. Here’s how we’ll support you:

• Clear documentation and updates at every phase.
• Personalized support for BYODB customers with migration steps if needed.
• Continued development of native tools and features to improve your experience with Keboola.

If you have any questions or need assistance, please don’t hesitate to reach out to our support team.

Thank you for your understanding and cooperation as we implement these important changes. We’ll keep you informed with regular updates.