Snowflake Reader Accounts

Secure data sharing works between two Snowflake accounts. A supplier, a customer, or a regulator often has no Snowflake account at all. Reader accounts solve that gap. A data provider creates and manages a small Snowflake account on behalf of the partner, and the partner queries shared data without buying anything.

The Idea in Simple Words

Picture a library that owns a rare book collection. Members with their own library cards borrow books freely. Visitors without cards still want to read. The library issues a guest pass and a reading room. The visitor reads inside the room, and the library pays for the electricity. A reader account acts as that guest pass and reading room.

SHARING WITH AND WITHOUT A SNOWFLAKE ACCOUNT
============================================

 PROVIDER ACCOUNT
 +------------------+
 |  SALES_DB        |
 |  (share)         |
 +--------+---------+
          |
    +-----+------------------------+
    |                              |
    v                              v
 CONSUMER WITH OWN ACCOUNT     READER ACCOUNT (created by provider)
 +-----------------------+     +-------------------------------+
 | Pays own compute      |     | Provider pays compute         |
 | Full Snowflake usage  |     | Query shared data only        |
 +-----------------------+     +-------------------------------+

Key Facts About Reader Accounts

  • The provider owns and administers the reader account.
  • The reader account sits in the same region and cloud as the provider.
  • Reader users query shared data and nothing else; they cannot load their own data into it for ongoing work.
  • The provider pays for the compute the reader account consumes.
  • One reader account can receive several shares.

Creating a Reader Account

CREATE MANAGED ACCOUNT partner_reader
  ADMIN_NAME     = 'partner_admin',
  ADMIN_PASSWORD = 'UseAStrongUniquePassword1!',
  TYPE           = READER,
  COMMENT        = 'Reader account for Acme Supplies';

-- List all reader accounts you manage
SHOW MANAGED ACCOUNTS;

The command returns an account locator and a login URL. Send those details to the partner through a secure channel, and ask the admin to change the password at first sign-in.

Sharing Data With the Reader Account

-- Create a share and add objects
CREATE SHARE acme_share;
GRANT USAGE ON DATABASE sales_db TO SHARE acme_share;
GRANT USAGE ON SCHEMA sales_db.public TO SHARE acme_share;
GRANT SELECT ON TABLE sales_db.public.acme_orders TO SHARE acme_share;

-- Attach the reader account to the share
ALTER SHARE acme_share ADD ACCOUNTS = ABC12345;

ABC12345 stands for the account locator returned when the reader account was created. The partner signs in, creates a database from the share, and runs queries.

Inside the Reader Account

The reader administrator creates users, roles, and a virtual warehouse. A resource monitor protects the provider from surprise bills.

-- Run inside the reader account
CREATE DATABASE acme_data FROM SHARE provider_org.provider_acct.acme_share;

CREATE WAREHOUSE reader_wh
  WAREHOUSE_SIZE = 'XSMALL'
  AUTO_SUSPEND   = 60
  AUTO_RESUME    = TRUE;

Controlling Cost as the Provider

-- Run in the provider account
CREATE RESOURCE MONITOR partner_cap
  CREDIT_QUOTA = 20
  FREQUENCY    = MONTHLY
  START_TIMESTAMP = IMMEDIATELY
  TRIGGERS ON 90 PERCENT DO NOTIFY
           ON 100 PERCENT DO SUSPEND;

ALTER ACCOUNT SET RESOURCE_MONITOR = partner_cap;

Apply a monitor to the reader account so a runaway query never drains the provider's budget. Snowflake allows monitors assigned inside the reader account by its administrator.

When to Choose a Reader Account

SITUATION                                      BEST CHOICE
---------------------------------------------  ----------------------
Partner already uses Snowflake                 Direct share
Partner has no account and needs live data     Reader account
Partner needs a one-time file                  Export to cloud storage
Partner wants to load and transform own data   Partner opens own account

Security Practices

  • Share secure views rather than raw tables to expose only needed columns and rows.
  • Create one reader account per partner to keep data and costs separate.
  • Review reader account usage in the provider's Account Usage views.
  • Drop reader accounts when the partnership ends.

A Practical Scenario

A manufacturer wants to give a small supplier live access to monthly demand forecasts. The supplier runs no Snowflake account and lacks the budget for one. The manufacturer creates a reader account, shares a secure view that holds only that supplier's products, and applies a monthly credit limit. The supplier signs in through a web link, opens a ready database, and runs queries whenever planning questions arise. The forecasts stay current without any file transfers or emails.

Frequently Asked Questions

Can a reader account share data onward?

Reader accounts consume shared data only. They cannot publish shares to other accounts.

What happens to the account when the partnership ends?

The provider drops the reader account, and all access ends immediately. The provider's own data stays untouched.

Key Points

  • Reader accounts give partners without Snowflake access to live shared data.
  • The provider creates, owns, and pays for the reader account compute.
  • Shares attach to the reader account through its account locator.
  • Resource monitors cap credit usage and protect the provider budget.
  • Secure views limit exactly what each partner sees.
Previous lesson
Back to course
Next lesson