Cloud and warehouses

Connect each data system with a dedicated read-only identity and select the smallest useful catalog scope. Catalog scope controls what Embrasure can see and query.

AWS

Connect AWS catalogs and warehouses with a dedicated read-only role. AWS Glue Data Catalog stores table metadata.

Catalogs and warehouses

Google Cloud

BigQuery

Embrasure creates a managed service account for each BigQuery connector. Grant it:

for role in roles/bigquery.jobUser roles/bigquery.dataViewer; do
  gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
    --member="serviceAccount:EMBRASURE_SERVICE_ACCOUNT" \
    --role="$role"
done

Prefer dataset-level Data Viewer grants.

Azure

Use the connector's supported read-only identity for Azure SQL, Azure PostgreSQL, Azure MySQL, or Cosmos DB. Select the smallest useful database and schema scope.

Snowflake

To copy Snowflake tables into the managed warehouse instead, follow Snowflake warehouse sync.

Use a dedicated service user, role, and quickly suspending warehouse. Generated key-pair setup is recommended: Embrasure creates an RSA key pair, keeps the private key encrypted, and gives an administrator one SQL block to install the public key and baseline grants. A role-restricted Snowflake programmatic access token is also supported.

Required read access

The generated setup block applies these grants. Replace the example names when managing the role yourself.

GRANT USAGE ON WAREHOUSE COMPUTE_XS TO ROLE EMBRASURE_RO;
GRANT USAGE ON DATABASE ANALYTICS TO ROLE EMBRASURE_RO;
GRANT USAGE ON ALL SCHEMAS IN DATABASE ANALYTICS TO ROLE EMBRASURE_RO;
GRANT USAGE ON FUTURE SCHEMAS IN DATABASE ANALYTICS TO ROLE EMBRASURE_RO;

GRANT SELECT ON ALL TABLES IN DATABASE ANALYTICS TO ROLE EMBRASURE_RO;
GRANT SELECT ON FUTURE TABLES IN DATABASE ANALYTICS TO ROLE EMBRASURE_RO;
GRANT SELECT ON ALL VIEWS IN DATABASE ANALYTICS TO ROLE EMBRASURE_RO;
GRANT SELECT ON FUTURE VIEWS IN DATABASE ANALYTICS TO ROLE EMBRASURE_RO;
GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE ANALYTICS TO ROLE EMBRASURE_RO;
GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE ANALYTICS TO ROLE EMBRASURE_RO;

For a smaller scope, grant USAGE and SELECT per schema instead of across the database. Snowflake documents the same container and object grants in its read-only role guidance.

Query history and warehouse usage

These grants are optional, but they unlock stronger observability. Use Snowflake's database roles instead of the broader IMPORTED PRIVILEGES grant.

GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE EMBRASURE_RO;
GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER TO ROLE EMBRASURE_RO;

GOVERNANCE_VIEWER covers QUERY_HISTORY, QUERY_ATTRIBUTION_HISTORY, and ACCESS_HISTORY; USAGE_VIEWER covers WAREHOUSE_METERING_HISTORY. See Snowflake's database-role mapping for Account Usage. Without these grants, catalog sync and approved read-only queries still work, but query history or cost analysis may be unavailable.

Databricks

Use a Databricks service principal with OAuth machine-to-machine authentication. Assign it to the workspace, grant the Databricks SQL access entitlement, and give it CAN USE on one SQL warehouse. Embrasure needs the workspace URL and that warehouse's HTTP path. Databricks documents these steps in its OAuth service-principal guide.

Unity Catalog read access

Grant access only to the catalogs and schemas Embrasure should understand and query. USE CATALOG and USE SCHEMA allow object access; SELECT on the schema is inherited by its current and future tables and views.

GRANT USE CATALOG ON CATALOG analytics TO `SERVICE_PRINCIPAL_APPLICATION_ID`;
GRANT USE SCHEMA ON SCHEMA analytics.production TO `SERVICE_PRINCIPAL_APPLICATION_ID`;
GRANT SELECT ON SCHEMA analytics.production TO `SERVICE_PRINCIPAL_APPLICATION_ID`;

Repeat the schema grants for each selected scope. If the connection is metadata-only, BROWSE on the catalog exposes object metadata without data access. For query execution, keep the explicit USE CATALOG, USE SCHEMA, and SELECT grants. See the Unity Catalog privileges reference.

SQL databases