Skip to content

Snowflake Cortex usage

Snowflake Cortex supplies AI Functions usage, query-history, and Cortex Search serving rows so Venturi can attribute Cortex charges to users, roles, and warehouses.

Onboarding scope

This guide covers the read-only snowflake_cortex connector in the Venturi platform connector package. It reads SNOWFLAKE.ACCOUNT_USAGE views and never changes warehouses, data, or grants.

Required access

The connector reads these Account Usage views. They are vendor object names; grant access to them exactly as shown in the grant block below:

View Purpose Snowflake database role
SNOWFLAKE.ACCOUNT_USAGE.CORTEX_AI_FUNCTIONS_USAGE_HISTORY Read Cortex AI Functions credits and tokens by function, model, query ID, user ID, and warehouse ID. SNOWFLAKE.USAGE_VIEWER
SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY Correlate usage to users, roles, and warehouses. SNOWFLAKE.GOVERNANCE_VIEWER
SNOWFLAKE.ACCOUNT_USAGE.CORTEX_SEARCH_SERVING_USAGE_HISTORY Read Cortex Search continuous-serving charges. SNOWFLAKE.USAGE_VIEWER

Grant the two SNOWFLAKE database roles to a dedicated Venturi role, create a service user for Venturi, and grant the role to that user. Run the statements as a role that can grant them, such as ACCOUNTADMIN:

SQL
CREATE ROLE IF NOT EXISTS VENTURI_READER;
GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER TO ROLE VENTURI_READER;
GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE VENTURI_READER;
GRANT USAGE ON WAREHOUSE <reader_warehouse> TO ROLE VENTURI_READER;

CREATE USER IF NOT EXISTS <venturi_service_user>
  TYPE = SERVICE
  DEFAULT_ROLE = VENTURI_READER
  DEFAULT_WAREHOUSE = <reader_warehouse>
  RSA_PUBLIC_KEY = '<venturi_public_key>';
GRANT ROLE VENTURI_READER TO USER <venturi_service_user>;

Setting DEFAULT_ROLE does not grant the role, so the GRANT ROLE statement is required. The warehouse grant lets the role run its read queries; use a small warehouse dedicated to monitoring. GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE also works but exposes every ACCOUNT_USAGE view, so prefer the two database roles. Do not grant warehouse modification, role administration, or data-write privileges. QUERY_HISTORY includes each query’s SQL text, which can contain prompt literals passed to Cortex functions; the connector selects only query IDs, user, role, warehouse, and timing columns and never reads or stores the SQL text.

Account Usage views are not real time. Snowflake documents a latency of up to 45 minutes for QUERY_HISTORY and up to 1 hour for CORTEX_SEARCH_SERVING_USAGE_HISTORY. CORTEX_AI_FUNCTIONS_USAGE_HISTORY aggregates usage into one-hour windows and includes calls that are still running, which Snowflake updates every 2 minutes on a best-effort basis with a 5-minute SLA. The connector labels its source window and the latest upstream timestamp it read. See Snowflake’s CORTEX_AI_FUNCTIONS_USAGE_HISTORY, CORTEX_SEARCH_SERVING_USAGE_HISTORY, Account Usage latency table, SNOWFLAKE database roles, and CREATE USER.

Setup

  1. Generate a key pair for Venturi and run the statements above: they create the VENTURI_READER role, create the service user with that default role and your public key, and grant the role to the user.
  2. Store the private key as an encrypted credential reference in Settings / Admin / Credentials.
  3. The default lookback is 24 hours; set VENTURI_SNOWFLAKE_CORTEX_LOOKBACK_HOURS to change it. See sync windows and failure behavior.
  4. In Venturi, go to Integrations / Snowflake Cortex and run Test connection.

Verification

  • Test connection passes the read-only boundary check: reads succeed under VENTURI_READER, and the check fails if that role can modify warehouses, data, or grants.
  • Cortex AI Functions and Cortex Search rows appear in the latest sync.
  • Query-history correlation resolves user, role, or warehouse fields where available.
  • Cortex Search serving charges are labeled as continuous-serving idle cost.

Rotation and offboarding

Rotate the service user’s key pair through your normal privileged-access process, then update the credential reference in Settings / Admin / Credentials. Removing the connector stops new Cortex usage syncs; drop VENTURI_READER to revoke access.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: Snowflake Cortex usage
Page: https://docs.venturi.systems/connectors/snowflake-cortex/