# Snowflake Streaming Destination Config Reference


> Complete Rudder CLI reference for the Snowflake Streaming destination config keys, key pair authentication, Iceberg tables, source types, and secrets.



[Snowflake Streaming](https://www.rudderstack.com/docs/destinations/warehouse-destinations/snowflake-streaming/) is a warehouse destination. RudderStack streams events as rows into tables in a Snowflake database through the Snowpipe Streaming API, in near real time, without staging files or a sync schedule.

In a Snowflake Streaming destination spec:

- `type: snowpipe_streaming`
- `definition_version: 1`

## Sample configuration

```yaml
version: rudder/v1
kind: destination
metadata:
  name: snowflake-streaming-prod
spec:
  id: snowflake-streaming-prod
  display_name: Snowflake Streaming Production
  type: snowpipe_streaming
  definition_version: 1
  enabled: true
  config:
    account: xy12345.us-east-2.aws
    database: RUDDER_EVENTS
    warehouse: RUDDER_WAREHOUSE
    user: "{{ .SNOWFLAKE_USER }}"
    role: RUDDER_ROLE
    namespace: rudder_events

    private_key: "{{ .SNOWFLAKE_PRIVATE_KEY }}"
    private_key_passphrase: "{{ .SNOWFLAKE_PRIVATE_KEY_PASSPHRASE }}"

    enable_iceberg: false

    skip_tracks_table: false
    json_paths: track.properties.metadata,identify.traits.address

    underscore_divide_numbers: false
    allow_users_context_traits: false

    connection_mode:
      web: cloud
      cloud: cloud
    consent_management:
      web:
        - provider: oneTrust
          consents:
            - analytics
```

The above example authenticates with an encrypted key pair and writes standard Snowflake tables. Iceberg tables are a choice you make when you create the destination — see [Iceberg tables](#iceberg-tables).

## Config keys

`config` accepts only the keys listed below. The [shared config key rules](https://www.rudderstack.com/docs/rudder-cli/destination-types/#config-key-rules) cover unknown keys, defaults, and immutability.

### Connection

<div class="rs-ckeys">
<div class="rs-ckey" id="account">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">account</p>Required</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Your Snowflake account identifier — the part of your Snowflake URL before <code>.snowflakecomputing.com</code>.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>At most 100 characters, and must not contain line breaks.</li>
<li>A <code>{{ path || fallback }}</code> template is accepted in place of a literal.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  See <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/snowflake-streaming/#snowflake-account-id-examples" >Snowflake account ID examples</a> for the format per cloud and region.
</div>

</div>

<div class="rs-ckey" id="database">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">database</p>Required</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Name of the Snowflake database RudderStack streams data into.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>At most 100 characters, and must not contain line breaks.</li>
<li>A <code>{{ path || fallback }}</code> template is accepted in place of a literal.</li>
</ul>

</div>

</div>

<div class="rs-ckey" id="warehouse">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">warehouse</p>Required</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Name of the Snowflake virtual warehouse RudderStack runs its connection checks and schema changes on. Rows are streamed without it, so a small warehouse is enough.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>At most 100 characters, and must not contain line breaks.</li>
<li>A <code>{{ path || fallback }}</code> template is accepted in place of a literal.</li>
</ul>

</div>

</div>

<div class="rs-ckey" id="user">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">user</p>RequiredSecret</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Snowflake user RudderStack connects as. The user authenticates with <code>private_key</code> — Snowflake Streaming doesn&rsquo;t support password authentication.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>At most 100 characters, and must not contain line breaks.</li>
<li>A <code>{{ path || fallback }}</code> template is accepted in place of a literal.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  <p>Supply it as a <code>{{ .VAR }}</code> reference rather than a literal — see <a href="#secrets" >Secrets</a>.</p>
<p>See <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/snowflake-streaming/#4-create-a-user" >Create a user</a>.</p>

</div>

</div>

<div class="rs-ckey" id="role">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">role</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Role RudderStack assumes. When omitted, the user&rsquo;s default role is used. The role needs permission to create schemas and tables in <code>database</code>.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>At most 100 characters, and must not contain line breaks.</li>
<li>A <code>{{ path || fallback }}</code> template is accepted in place of a literal.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  See <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/snowflake-streaming/#3-create-a-role-for-rudderstack" >Create a role for RudderStack</a>.
</div>

</div>

<div class="rs-ckey" id="namespace">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">namespace</p>RequiredImmutable</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Schema RudderStack creates its tables in.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>At most 64 characters, and must not start with <code>pg_</code> in any capitalization.</li>
<li>A <code>{{ path || fallback }}</code> template is accepted in place of a literal.</li>
<li>Unlike <a href="https://www.rudderstack.com/docs/rudder-cli/destination-types/snowflake/" >Snowflake</a>, there&rsquo;s no fallback to the source name. A spec that omits this key fails validation with <code>'namespace' is required</code>.</li>
<li>Can&rsquo;t be changed once the destination exists — the API rejects the update. Create a new destination instead.</li>
</ul>

</div>

</div>

</div>

### Authentication

Snowflake Streaming authenticates with a key pair only.

<div class="rs-ckeys">
<div class="rs-ckey" id="private_key">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">private_key</p>RequiredSecret</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  PEM-encoded private key whose public half is assigned to <code>user</code> in Snowflake.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Must be a whole PEM block, from its <code>BEGIN PRIVATE KEY</code> line to its <code>END PRIVATE KEY</code> line, or the <code>ENCRYPTED PRIVATE KEY</code> equivalents. A bare base64 key body is rejected, and so is a PKCS#1 <code>RSA PRIVATE KEY</code>.</li>
<li>Templates aren&rsquo;t accepted. <code>{{ .VAR }}</code> references are resolved before validation, so the resolved value is what must be PEM-shaped.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  <p>Supply it as a <code>{{ .VAR }}</code> reference rather than a literal — see <a href="#secrets" >Secrets</a>. An environment variable can carry the key directly:</p>
<div class="rs-code">
  <div class="rs-code__head">bash<button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-bash" data-lang="bash">export RUDDER_SNOWFLAKE_PRIVATE_KEY=&#34;$(cat rsa_key.p8)&#34;</code></pre></div>
</div><p>In a var file, use a YAML literal block:</p>
<div class="rs-code">
  <div class="rs-code__head">yaml<button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-yaml" data-lang="yaml">SNOWFLAKE_PRIVATE_KEY: |
  -----BEGIN PRIVATE KEY-----
  ...
  -----END PRIVATE KEY-----  </code></pre></div>
</div><p>A reference that is the whole quoted value, such as <code>'{{ .SNOWFLAKE_PRIVATE_KEY }}'</code>, keeps the line breaks in either quote style, including the single-quoted references <code>rudder-cli import</code> writes.</p>

</div>

</div>

<div class="rs-ckey" id="private_key_passphrase">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">private_key_passphrase</p>Secret</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Passphrase you set when encrypting <code>private_key</code>. Leave it out for an unencrypted key.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>At most 100 characters, and must not contain line breaks.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  <p>Supply it as a <code>{{ .VAR }}</code> reference rather than a literal — see <a href="#secrets" >Secrets</a>.</p>
<p><strong>Warning:</strong> Authentication fails if the key is encrypted and this passphrase is missing. Rudder CLI doesn't check that an <code>ENCRYPTED PRIVATE KEY</code> comes with a passphrase, so <code>validate</code> doesn't catch it.</p>

</div>

</div>

</div>

### Iceberg tables

By default, RudderStack creates standard Snowflake tables. With `enable_iceberg`, it creates Snowflake-managed Iceberg tables instead, which store their data as Parquet files in your own cloud storage. In Iceberg tables, JSON values are stored as `VARCHAR` strings and timestamps as `TIMESTAMP_NTZ`, without a time zone.

<div class="rs-ckeys">
<div class="rs-ckey" id="enable_iceberg">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">enable_iceberg</p>Immutable</div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>false</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Create Snowflake-managed Iceberg tables instead of standard tables.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Requires <code>external_volume</code>.</li>
<li>Can&rsquo;t be changed once the destination exists — the API rejects the update. Create a new destination instead.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  See <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/snowflake-streaming/iceberg-tables/" >Snowflake Streaming with Iceberg Tables</a>.
</div>

</div>

<div class="rs-ckey" id="external_volume">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">external_volume</p>Required</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Name of the Snowflake external volume Iceberg tables keep their data and metadata files on. The volume must already exist.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Required when <code>enable_iceberg</code> is <code>true</code>. Leave it unset otherwise — the dashboard shows it only when Iceberg is on, and RudderStack ignores it without Iceberg.</li>
<li>At most 100 characters, and must not contain line breaks.</li>
<li>RudderStack reads it only when it creates a table, so changing it later leaves existing tables on the old volume. To move to another volume, create a new destination.</li>
<li>A spec that sets <code>enable_iceberg: true</code> without it fails validation with <code>'external_volume' is required when 'enable_iceberg' is true</code>.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  <div class="rs-code">
  <div class="rs-code__head">yaml<button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-yaml" data-lang="yaml">enable_iceberg: true
external_volume: RUDDER_ICEBERG_VOLUME</code></pre></div>
</div><p>See <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/snowflake-streaming/iceberg-tables/configuration/#1-create-an-external-volume-for-iceberg-data" >Create an external volume for Iceberg data</a>.</p>
</div>

</div>

</div>

### Table behavior

Snowflake Streaming only appends rows. It never writes a `users` table — `identify` events go to the `identifies` table only — and doesn't merge, so it has no keys for either.

<div class="rs-ckeys">
<div class="rs-ckey" id="skip_tracks_table">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">skip_tracks_table</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>false</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Skip sending events to the <code>tracks</code> table. Per-event tables are unaffected.
</p>

</div>

<div class="rs-ckey" id="json_paths">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">json_paths</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Comma-separated dot-notation paths whose values are stored as JSON columns instead of being flattened. Start each path with the event type it applies to, such as <code>track.properties.metadata</code>. A path without one applies to <code>track</code> events only.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Not validated locally.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  <div class="rs-code">
  <div class="rs-code__head">yaml<button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-yaml" data-lang="yaml">json_paths: track.properties.metadata,identify.traits.address</code></pre></div>
</div><p>See <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/json-column-support/" >JSON Column Support</a>.</p>
</div>

</div>

</div>

### Legacy column naming

Both keys below preserve the column naming of destinations created before the behavior changed. Leave them at their defaults on a new destination. Neither can be changed once the destination exists — the API rejects the update.

<div class="rs-ckeys">
<div class="rs-ckey" id="underscore_divide_numbers">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">underscore_divide_numbers</p>ImmutableInternal</div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>false</code>
  </p>
<p class="rs-ckey__field">
  Description:
  When <code>false</code>, numeric suffixes in column names are preserved: <code>v3</code> stays <code>v3</code> rather than being split into <code>v_3</code>.
</p>

</div>

<div class="rs-ckey" id="allow_users_context_traits">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">allow_users_context_traits</p>ImmutableInternal</div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>false</code>
  </p>
<p class="rs-ckey__field">
  Description:
  When <code>false</code>, <code>context.traits.*</code> fields aren&rsquo;t promoted to top-level traits and are stored only as <code>context_traits_*</code> columns.
</p>

</div>

</div>

### Per-source keys

Both keys are objects keyed by the local source type — the tokens listed under [Source types](#source-types). A key naming a source type this destination doesn't support fails validation.

<div class="rs-ckeys">
<div class="rs-ckey" id="connection_mode">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">connection_mode</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>object</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Maps each source type you connect to the mode its events reach Snowflake Streaming in, using the modes in <a href="#source-types" >Source types</a>.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>An entry is required for each source type you connect — see <a href="#connect-a-source" >Connect a source</a>.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  <div class="rs-code">
  <div class="rs-code__head">yaml<button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-yaml" data-lang="yaml">connection_mode:
  web: cloud
  cloud: cloud</code></pre></div>
</div>
</div>

</div>

<div class="rs-ckey" id="consent_management">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">consent_management</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>object</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Consent provider configuration per source type. The entry shape, accepted providers, and the rules on <code>resolution_strategy</code> and <code>consents</code> are shared across all destination types — see <a href="https://www.rudderstack.com/docs/rudder-cli/destination-types/#consent-management" >Consent management</a>.
</p>

</div>

</div>

## Source types

Snowflake Streaming accepts events from these source types in the mentioned connection modes:

| Source type | Connection mode |
| :-----| :-----|
| `android` | `cloud` |
| `android_kotlin` | `cloud` |
| `ios` | `cloud` |
| `ios_swift` | `cloud` |
| `web` | `cloud` |
| `unity` | `cloud` |
| `react_native` | `cloud` |
| `flutter` | `cloud` |
| `cordova` | `cloud` |
| `cloud` | `cloud` |

Every source type is `cloud` only — events reach Snowflake from RudderStack's servers, never in device mode.

**Info:** The dashboard additionally offers Snowflake Streaming to AMP, Shopify, and cloud app sources. Rudder CLI doesn&#39;t manage those connections, so `amp`, `shopify`, and `cloud_source` are invalid here.

## Connect a source

An event stream connection to this destination is checked against two rules at `validate` time.

**The source's type must be supported.** A source's type resolves to one of the tokens above before the check — a JavaScript source resolves to `web`, and webhook and server-side SDK sources resolve to `cloud`. Every type an event stream source can resolve to is supported here, so this check always passes.

**The destination config must carry a `connection_mode` entry for that source type.** This lives on the destination spec, not on the [connection spec](https://www.rudderstack.com/docs/rudder-cli/yaml-connections/). Without it:

```text
destination 'snowflake-streaming-prod' config has no 'connection_mode' entry for source type 'web'
```

Snowflake Streaming needs no additional config keys to connect a source of any type.

## Secrets

`user`, `private_key`, and `private_key_passphrase` are the secret keys. Write each one you use as a `{{ .VAR }}` reference and supply the value at apply time:

```yaml
config:
  user: "{{ .SNOWFLAKE_USER }}"
  private_key: "{{ .SNOWFLAKE_PRIVATE_KEY }}"
  private_key_passphrase: "{{ .SNOWFLAKE_PRIVATE_KEY_PASSPHRASE }}"
```

```bash
export RUDDER_SNOWFLAKE_USER="RUDDER_USER"
export RUDDER_SNOWFLAKE_PRIVATE_KEY="$(cat rsa_key.p8)"
export RUDDER_SNOWFLAKE_PRIVATE_KEY_PASSPHRASE="..."
rudder-cli apply

# or
rudder-cli apply --var-file secrets.vars.yaml
```

Note that:

- `rudder-cli import` writes only the secrets the API returns, as `{{ .VAR }}` references, and leaves the others out. Add any secret key it leaves out, then supply the variables before you apply — see [Secrets](https://www.rudderstack.com/docs/rudder-cli/destination-types/#secrets).
- `private_key` spans several lines. Use a YAML literal block in a var file, or an environment variable that carries the key file's contents — see [`private_key`](#private_key).

See [How to Use Variable Substitution in Rudder CLI](https://www.rudderstack.com/docs/rudder-cli/variable-substitution/).

## Changes by release

<p>No changes since this type became available.</p>

For changes across every destination type, see [Destination Type Changes by Release](https://www.rudderstack.com/docs/rudder-cli/destination-types/changes/).

## See more

- [Snowflake Streaming Destination](https://www.rudderstack.com/docs/destinations/warehouse-destinations/snowflake-streaming/) for the warehouse, database, role, and user setup
- [Snowflake Streaming with Iceberg Tables](https://www.rudderstack.com/docs/destinations/warehouse-destinations/snowflake-streaming/iceberg-tables/) for external volumes and Iceberg table behavior
- [Snowflake Destination Config Reference](https://www.rudderstack.com/docs/rudder-cli/destination-types/snowflake/) for the Snowflake destination, which loads data in batches on a schedule
- [Destination Type Reference for Rudder CLI](https://www.rudderstack.com/docs/rudder-cli/destination-types/) for the rules shared across destination types
- [Destination YAML Reference](https://www.rudderstack.com/docs/rudder-cli/yaml-destinations/) for the spec envelope