Getting Started

Overview

This guide walks you through connecting a Snowflake account to Britive and granting your first just-in-time access session to a Snowflake role — with no standing role grants and full audit logging on every checkout.

What you’ll accomplish:

Create a Britive integration role and user in Snowflake
Onboard the Snowflake application in the Britive console
Create an access profile for a Snowflake role
Check out and verify JIT access end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
Snowflake ACCOUNTADMIN or SECURITYADMIN access to create roles and users
SnowSQL CLI or access to the Snowflake web console

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

Britive uses a dedicated Snowflake service user with key-pair authentication to manage role grants. At checkout, Britive grants the target Snowflake role to the requesting user. At checkin (or on expiry), the role grant is revoked — no standing role assignments remain.

User → Britive Console → Snowflake SQL API → GRANT ROLE (timed) → REVOKE ROLE

Onboarding the Application

Connect your Snowflake account to your Britive tenant. This is a one-time setup performed by an administrator.

For detailed onboarding reference, see the Britive documentation and the britive/onboarding GitHub repository.

Using the Britive Console

Create the Britive role and user in Snowflake

In SnowSQL or the Snowflake web console, create a custom role BRITIVEROLE with the required privileges and a service user BRITIVEUSER with key-pair authentication assigned that role.

Generate a key pair

openssl genrsa -out britive_rsa_key.pem 2048
openssl rsa -in britive_rsa_key.pem -pubout -out britive_rsa_key.pub

Add the application in Britive

In the Britive console, navigate to Applications → Add Application → Snowflake. Enter your Snowflake account identifier, the username (BRITIVEUSER), and upload the private key.

Verify the connection

The application status should show Connected. Britive will scan and import your Snowflake roles and databases.

Using Python / Shell

Set required environment variables:

export SNOWFLAKE_ACCOUNT=your-account.snowflakecomputing.com
export SNOWFLAKE_USER=BRITIVEUSER
export SNOWFLAKE_PRIVATE_KEY_PATH=./britive_rsa_key.pem
export BRITIVE_TENANT=your-tenant
export BRITIVE_API_TOKEN=your-token

BRITIVE_TENANT takes just the subdomain — see Finding Your Tenant Name.

Refer to the britive/onboarding repository for available automation scripts.

Using Terraform

Reference templates are in the britive/onboarding repository under terraform/snowflake/.

git clone https://github.com/britive/onboarding.git
cd onboarding/terraform/snowflake
cp variables.tfvars.example variables.tfvars
# Edit variables.tfvars: snowflake_account, snowflake_user, snowflake_password, britive_public_key_path
terraform init
terraform apply -var-file=variables.tfvars

Create Your First Access Profile

Using the Britive Console

Open the Snowflake application

Navigate to Applications → select your Snowflake application → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `Analytics-DataViewer`)
Environment	Select your Snowflake account
Expiration	Set a max session duration (e.g., `4h0m0s`)

Add permissions

Under Permissions, add the Snowflake roles to include in this profile.

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

data "britive_application" "snowflake" {
  name = "Snowflake"
}

resource "britive_profile" "analytics" {
  app_container_id    = data.britive_application.snowflake.id
  name                = "Analytics-DataViewer"
  expiration_duration = "4h0m0s"

  associations {
    type  = "Environment"
    value = "your-snowflake-account"
  }
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out.

Confirm Snowflake access

Connect to Snowflake and verify the role is active:

SHOW GRANTS TO USER your_username;

Check in

Return to My Access → click Check In. Run the query again and confirm the role grant no longer appears.

Troubleshoot

Symptom	Likely Cause	Fix
Application shows “Disconnected”	Private key mismatch or `BRITIVEUSER` disabled	Verify the key pair and that the user is active in Snowflake
Roles not visible	`BRITIVEROLE` lacks `MANAGE GRANTS` privilege	Grant `MANAGE GRANTS` to `BRITIVEROLE`
Checkout fails	User doesn’t exist in Snowflake	Ensure the Britive user email matches a Snowflake user login name

Next Steps

Britive documentation

Last updated on July 8, 2026