> ## Documentation Index
> Fetch the complete documentation index at: https://docs.growthbook.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting Up Snowflake as a Data Source

> Connect Snowflake to GrowthBook with an account identifier, warehouse, database, and a read-only role.

We support multiple [account identifier](https://docs.snowflake.com/en/user-guide/admin-account-identifier.html) formats when connecting to Snowflake. An example account identifier is `xy12345.us-east-2.aws`.

## Authentication Methods

GrowthBook supports three ways to authenticate with Snowflake:

* **Password** — the default. Username and password for a Snowflake user.
* **Key Pair** — [key-pair authentication](https://docs.snowflake.com/en/user-guide/key-pair-auth): upload the user's private key (and its password, if encrypted). Required if you use the Event Forwarder.
* **Workload Identity Federation** (self-hosted only) — secretless authentication using the ambient cloud identity of the server GrowthBook runs on (an AWS IAM role, Azure managed identity, or Google Cloud service account). No Snowflake credential is stored on the data source.

### Workload Identity Federation

[Workload Identity Federation](https://docs.snowflake.com/en/user-guide/workload-identity-federation) lets GrowthBook authenticate as the cloud identity it already runs under — for example, the IAM role of the ECS task or EC2 instance hosting your self-hosted GrowthBook.

On the Snowflake side, create a service user bound to that identity:

```sql theme={null}
create user growthbook_service type = service;
alter user growthbook_service set workload_identity = (
  type = aws
  arn = 'arn:aws:iam::<account-id>:role/<growthbook-task-role>'
);
```

(Azure and Google Cloud have equivalent `type = azure` / `type = gcp` forms — see the Snowflake docs above.)

Then in GrowthBook's connection settings, choose **Workload Identity Federation** as the Authentication Method, select the cloud provider GrowthBook runs on, and set the Username to the Snowflake service user.

Notes:

* Self-hosted deployments only — on GrowthBook Cloud there is no customer-controlled cloud identity to bind.
* The identity you bind is whatever the GrowthBook *server* runs as. If that role is shared with other services, they can all authenticate as this Snowflake user — prefer a dedicated role for GrowthBook.
* The Event Forwarder still requires key-pair authentication. Remove it before switching an existing data source to Workload Identity; the forwarder keeps its own copy of the private key until removed.

## Self-Hosting

If you are self-hosting GrowthBook, you can send queries to Snowflake through an Authenticated Proxy.

To enable this, set a `SNOWFLAKE_PROXY` environment variable in your GrowthBook container. Here is an example:

```
SNOWFLAKE_PROXY=http://username:password@proxyserver.company.com:80
```

## Enabling Data Pipeline Mode

Enterprise

**Pipeline Mode**
is available on Enterprise plans. Pipeline mode can reduce query costs if you grant the GrowthBook service account write permissions in your data warehouse.

[More details can be found here.](https://docs.growthbook.io/app/data-pipeline.md)