> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://docs.ampdb.io/api/mcp` to find what you need.

# Snowflake Configuration

Status: Unstable.

Every field of the configuration that registers a Snowflake database as an export destination, a provider of kind `adbc-snowflake`, from its JSON schema. To learn how to register one and how its secrets reach the worker, see [Destinations](/managing-amp/pipelines/destinations).

## Example

A provider named `warehouse`, whose alias is `WAREHOUSE`:

```toml
kind = "adbc-snowflake"
account = "${AMP_ADBC_WAREHOUSE_ACCOUNT}"
user = "${AMP_ADBC_WAREHOUSE_USER}"
warehouse = "${AMP_ADBC_WAREHOUSE_WAREHOUSE}"
database = "${AMP_ADBC_WAREHOUSE_DATABASE}"
role = { default = true }
auth_type = "${AMP_ADBC_WAREHOUSE_AUTH_TYPE}"
password = { default = true }
private_key = "${AMP_ADBC_WAREHOUSE_PRIVATE_KEY}"
private_key_passphrase = { default = true }
token = { default = true }
data_schema = "ANALYTICS"
export_state_mode = "append"
```

## Provider

### `kind`

The provider kind, must be `"adbc-snowflake"`.

* **Type**: string
* **Required**

```toml
kind = "adbc-snowflake"
```

### `alias`

The provider's alias, which names its environment variables: `AMP_ADBC_<ALIAS>_<FIELD>`. Amp derives it from the provider's name, in uppercase, so leave it out: a provider named `warehouse` has the alias `WAREHOUSE`. If you set it, set it to that alias: registration fails with `ADBC_ALIAS_MISMATCH` otherwise.

* **Type**: string
* **Allowed**: at most 32 characters
* **Default**: the provider's name, in uppercase

```toml
alias = "WAREHOUSE"
```

## Connection

Each of these fields is a secret: give it as a reference to its environment variable, which the worker resolves when it connects, or as a decoration table. A plain value is rejected.

A decoration table sets how the value resolves:

* `{ default = true }` uses the field's default when the variable isn't set.
* `{ required = false }` leaves the field unset when the variable isn't set.
* `{ using = "OTHER" }` reads the variable of the provider whose alias is `OTHER`, as in `AMP_ADBC_OTHER_HOST`, to share credentials between providers. `{ using = { alias = "OTHER", version = "^1" } }` also requires that provider's version to match.

### `account`

The Snowflake account identifier, in `orgname-accountname` form or as a legacy `locator.region.cloud` locator.

The environment variable's value must be at most 255 characters and contain no control characters; an empty value means unset, and Snowflake rejects a login without an account.

* **Type**: environment variable reference or decoration table
* **Required**
* **Environment variable**: `AMP_ADBC_<ALIAS>_ACCOUNT`
* **Default**, with `{ default = true }`: empty (unset)

```toml
account = "${AMP_ADBC_WAREHOUSE_ACCOUNT}"
```

### `user`

The login name.

The environment variable's value must be at most 255 characters and contain no control characters; an empty value means unset, and Snowflake rejects a login without a user.

* **Type**: environment variable reference or decoration table
* **Required**
* **Environment variable**: `AMP_ADBC_<ALIAS>_USER`
* **Default**, with `{ default = true }`: empty (unset)

```toml
user = "${AMP_ADBC_WAREHOUSE_USER}"
```

### `warehouse`

The warehouse running the export's statements. Snowflake resolves it as an identifier: an unquoted value folds to uppercase, a double-quoted one keeps its case, exactly as typed at a prompt.

The environment variable's value must be at most 255 characters and contain no control characters; an empty value means unset, deferring to the user's default warehouse.

* **Type**: environment variable reference or decoration table
* **Required**
* **Environment variable**: `AMP_ADBC_<ALIAS>_WAREHOUSE`
* **Default**, with `{ default = true }`: empty (unset)

```toml
warehouse = "${AMP_ADBC_WAREHOUSE_WAREHOUSE}"
```

### `database`

The session database holding the data and state schemas. Snowflake resolves it as an identifier: an unquoted value folds to uppercase, a double-quoted one keeps its case.

The environment variable's value must be at most 255 characters and contain no control characters; an empty value means unset, deferring to the user's default database.

* **Type**: environment variable reference or decoration table
* **Required**
* **Environment variable**: `AMP_ADBC_<ALIAS>_DATABASE`
* **Default**, with `{ default = true }`: empty (unset)

```toml
database = "${AMP_ADBC_WAREHOUSE_DATABASE}"
```

### `role`

The role assumed for the session. Snowflake resolves it as an identifier: an unquoted value folds to uppercase, a double-quoted one keeps its case.

The environment variable's value must be at most 255 characters and contain no control characters; an empty value means unset, deferring to the user's default role.

* **Type**: environment variable reference or decoration table
* **Required**
* **Environment variable**: `AMP_ADBC_<ALIAS>_ROLE`
* **Default**, with `{ default = true }`: empty (unset)

```toml
role = "${AMP_ADBC_WAREHOUSE_ROLE}"
```

### `auth_type`

Which credential the session logs in with: `snowflake` consumes `password`, `jwt` consumes `private_key` (plus `private_key_passphrase` when the key is encrypted), and `oauth` and `pat` consume `token`. A credential declared as its variable is required whichever type you choose: when the variable is unset, the export fails as it starts, naming it. One declared with `{ default = true }` and left unset, or set to an empty value, isn't sent, so if it's the one this type uses, Snowflake's driver refuses to log in when the export connects, and the job retries, with an error like `IO: [Snowflake] 260002: password is empty`.

The environment variable's value must be one of `snowflake`, `jwt`, `oauth`, or `pat`.

* **Type**: environment variable reference or decoration table
* **Required**
* **Environment variable**: `AMP_ADBC_<ALIAS>_AUTH_TYPE`
* **Default**, with `{ default = true }`: `snowflake` (password authentication)

```toml
auth_type = "${AMP_ADBC_WAREHOUSE_AUTH_TYPE}"
```

### `password`

The login password, consumed by the `snowflake` auth type.

The environment variable's value is used verbatim; an empty value means unset.

* **Type**: environment variable reference or decoration table
* **Required**
* **Environment variable**: `AMP_ADBC_<ALIAS>_PASSWORD`
* **Default**, with `{ default = true }`: empty (unset)

```toml
password = "${AMP_ADBC_WAREHOUSE_PASSWORD}"
```

### `private_key`

The RSA private key for key-pair authentication, consumed by the `jwt` auth type.

The environment variable's value must be a PKCS#8 PEM, beginning with `-----BEGIN PRIVATE KEY-----` or `-----BEGIN ENCRYPTED PRIVATE KEY-----` after any leading whitespace; a PKCS#1 (`-----BEGIN RSA PRIVATE KEY-----`) block or a file path is rejected.

* **Type**: environment variable reference or decoration table
* **Required**
* **Environment variable**: `AMP_ADBC_<ALIAS>_PRIVATE_KEY`
* **Default**, with `{ default = true }`: empty (unset)

```toml
private_key = "${AMP_ADBC_WAREHOUSE_PRIVATE_KEY}"
```

### `private_key_passphrase`

The passphrase of an encrypted `private_key`, consumed by the `jwt` auth type.

The environment variable's value is used verbatim; an empty value means unset (an unencrypted key needs no passphrase).

* **Type**: environment variable reference or decoration table
* **Required**
* **Environment variable**: `AMP_ADBC_<ALIAS>_PRIVATE_KEY_PASSPHRASE`
* **Default**, with `{ default = true }`: empty (unset)

```toml
private_key_passphrase = "${AMP_ADBC_WAREHOUSE_PRIVATE_KEY_PASSPHRASE}"
```

### `token`

The OAuth access token or programmatic access token, consumed by the `oauth` and `pat` auth types.

The environment variable's value is used verbatim; an empty value means unset.

* **Type**: environment variable reference or decoration table
* **Required**
* **Environment variable**: `AMP_ADBC_<ALIAS>_TOKEN`
* **Default**, with `{ default = true }`: empty (unset)

```toml
token = "${AMP_ADBC_WAREHOUSE_TOKEN}"
```

## Export settings

### `data_schema`

The schema receiving the exported data tables, also the session schema where the driver's bulk ingest resolves its target table. Defaults to `PUBLIC`.

A Snowflake identifier of at most 255 characters, made of letters, digits, `_`, and `$`. Unquoted, it starts with a letter or underscore, and is stored in uppercase (`events` becomes `EVENTS`). Double-quoted, it's stored as written, so `"events"` names a different object from `EVENTS`, and still can't contain spaces, quotes, or punctuation like `-` or `.`.

* **Type**: string
* **Default**: `"PUBLIC"`

```toml
data_schema = "PUBLIC"
```

### `export_state_mode`

How the destination `amp_export_state` table records each materialization event.

Fixed per provider over its lifetime: a mid-life switch would leave the state table in a shape the new mode's SQL can't read.

* **Type**: string
* **Default**: `"upsert"`

What each value does:

* `upsert`: One row per `(target_schema, target_table)`; each event overwrites it in place. Compact, no audit trail.
* `append`: Append-only audit trail: one new `commit_id`-keyed row per event. At-least-once, so a retried microbatch appends a duplicate row; use `upsert_retry` to dedupe in place.
* `upsert_retry`: `append`'s table shape, but the same transaction deletes prior rows for the same logical event. DDL is identical to `append`, so switching between the two needs no migration.

```toml
export_state_mode = "upsert"
```

### `timeout_secs`

The per-operation timeout applied to connection and statement calls, in whole seconds, defaulting to 30.

Zero is rejected: engines commonly treat a zero timeout as "wait forever" (libpq's `connect_timeout=0`, for one), which would hang a worker on an unreachable destination instead of failing it.

* **Type**: integer
* **Allowed**: at least 1
* **Default**: `30`

```toml
timeout_secs = 30
```

### `pool`

Connection-pool sizing and patience applied to one export target, configured as the `[pool]` table of its provider config.

One provider serves many concurrent export jobs, each holding an exclusive connection for its whole transactional lifecycle; these knobs bound that fan-out per target. Both fields (and the table itself) default when omitted.

* **Type**: table
* **Default**: each field's default

### `pool.max_connections`

Maximum concurrently checked-out connections, defaulting to 4. The default is conservative against a destination's own connection budget. Zero is rejected.

* **Type**: integer
* **Allowed**: at least 1
* **Default**: `4`

```toml
[pool]
max_connections = 4
```

### `pool.acquire_timeout_secs`

How long a checkout waits for a free connection slot before failing, in whole seconds, defaulting to 30. Zero is rejected.

* **Type**: integer
* **Allowed**: at least 1
* **Default**: `30`

```toml
[pool]
acquire_timeout_secs = 30
```

### `state_schema`

The schema holding the `amp_export_state` bookkeeping table. Defaults to `AMP`.

A Snowflake identifier of at most 255 characters, made of letters, digits, `_`, and `$`. Unquoted, it starts with a letter or underscore, and is stored in uppercase (`events` becomes `EVENTS`). Double-quoted, it's stored as written, so `"events"` names a different object from `EVENTS`, and still can't contain spaces, quotes, or punctuation like `-` or `.`.

* **Type**: string
* **Default**: `"AMP"`

```toml
state_schema = "AMP"
```