Manage reader accounts¶

Reader accounts (formerly known as “read-only accounts”) enable providers to share data with consumers who are not already Snowflake customers, without requiring the consumers to become Snowflake customers.

Overview¶

A reader account enables data consumers to access and query data shared by the provider of the account, with no setup or usage costs for the consumer, and no requirements for the consumer to sign a licensing agreement with Snowflake.

The reader account is created, owned, and managed by the provider account, which assumes all responsibility for credit charges incurred by users in the reader account. Similar to standard consumer accounts, the provider account uses shares to share databases with reader accounts; however, a reader account can only consume data from the provider account that created it.

What is restricted/allowed in a reader account?¶

A reader account is intended primarily for querying data shared by the provider of the account. You can work with data, for example, by creating materialized views.

You cannot perform the following tasks in a reader account:

• Set a data metric function on objects in the reader account.
• Upload new data.
• Modify existing data.
• Refresh dynamic tables. Refreshes fail with the error Operation is not supported in reader account, so CREATE DYNAMIC TABLE also fails with the default INITIALIZE = ON_CREATE setting. To build a dynamic table on shared data, use a standard consumer account. For more information, see Consumer workflow: build a pipeline on shared data.
• Unload data using a storage integration. However, you can use the COPY INTO <location> command with your connection credentials to unload data into a cloud storage location.

Additionally, you cannot execute the following commands in a reader account:

• INSERT
• UPDATE
• DELETE
• MERGE
• CREATE IMAGE REPOSITORY
• COPY INTO <table>
• CREATE MASKING POLICY
• CREATE MODEL
• CREATE PIPE
• CREATE ROW ACCESS POLICY
• CREATE SERVICE
• CREATE SHARE
• CREATE STAGE
• CREATE STREAMLIT
• SHOW PROCEDURES

All other operations are allowed.

Who provides support for a reader account?¶

Because a reader account does not have a licensing agreement with Snowflake, support services are not available to the general users in the account. Instead, as the provider of the account, you field questions and requests from users in the account and respond as appropriate.

If you are unable to directly answer their questions or resolve their requests/issues, you can open a Snowflake Support ticket through the normal channels (as outlined in your support agreement). Once a response has been provided by Snowflake Support, you then communicate the information back to the appropriate users in the reader account.

Managing and creating reader accounts using the web interface¶

If you have the ACCOUNTADMIN role (or have a role that has been granted the CREATE ACCOUNT privilege), you can use Snowsight to perform most tasks related to creating and managing reader accounts.

Using Snowsight¶

To create or manage reader accounts in Snowsight, do the following:

1. Sign in to Snowsight.
2. In the navigation menu, select Admin » Accounts.
3. Select the Accounts tab.
4. Select the Reader accounts sub-tab.

On this page, you can do the following:

• Create a reader account by selecting + New.
• Review existing reader accounts.
• Drop a reader account by selecting … » Drop.

DDL for reader accounts¶

To enable creating and managing reader accounts, Snowflake provides a first-class object, MANAGED ACCOUNT, that supports the following DDL commands:

• CREATE MANAGED ACCOUNT
• DROP MANAGED ACCOUNT
• SHOW MANAGED ACCOUNTS

Enabling other roles to create and manage reader accounts¶

By default, only users with the ACCOUNTADMIN role can create reader accounts and therefore, as the owner of the account, manage the accounts. To support delegating these tasks to other users, the CREATE ACCOUNT global privilege can be granted to other roles (system-defined or custom). Then, users with the role can create reader accounts and perform all tasks associated with managing the accounts created using the role.

For example, to grant the privilege to the SYSADMIN role:

Copy code

USE ROLE ACCOUNTADMIN;

GRANT CREATE ACCOUNT ON ACCOUNT TO ROLE SYSADMIN;

Creating and managing reader accounts using SQL¶

In addition to using the web interface to manage and create reader accounts, you can also use SQL.

Creating a reader account¶

To create a reader account, use the ACCOUNTADMIN role (or a role granted the CREATE ACCOUNT global privilege) and the CREATE MANAGED ACCOUNT command.

In the command, specify the identifier for the account and the user who will serve as the administrator for the account. For example, use the following syntax:

USE ROLE ACCOUNTADMIN;

CREATE MANAGED ACCOUNT <account_name>
    ADMIN_NAME = <username> , ADMIN_PASSWORD = '<password>' ,
    TYPE = READER;

After running the command, you see the account name and login URL for the account:

+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| status                                                                                                                                                                            |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| {"accountName":"READER_ACCT1","accountLocator":"IIB88126","url":"https://myorg-reader_acct1.snowflakecomputing.com","accountLocatorUrl":"https://iib88126.snowflakecomputing.com"}|
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

Note:

• By default, the total number of reader accounts a provider can create is 75. If you reach the limit and require creating additional accounts, please contact Snowflake Support.

  If you dropped a reader account in order to create a new account without exceeding this limit, you cannot create the new reader account for 7 days, which is the retention period for deleted reader accounts.

• The url is the preferred account URL for the new reader account. The account locator is a legacy identifier for the account.
• The reader account utilizes the same Snowflake Edition as the provider account and is created in the same region.

Renaming a reader account¶

You must use SQL commands to rename a reader account. For instructions, see Renaming an account.

Dropping a reader account¶

To drop a reader account, use the DROP MANAGED ACCOUNT command. For example:

Copy code

USE ROLE ACCOUNTADMIN;

DROP MANAGED ACCOUNT reader_acct1;

Viewing reader accounts¶

To view all the reader accounts that have been created for your account, use the SHOW MANAGED ACCOUNTS command. For example:

Copy code

USE ROLE ACCOUNTADMIN;

SHOW MANAGED ACCOUNTS;

This command can be used to monitor the total number of reader accounts for your account. If the total number reaches the limit (75), you may need to drop some accounts or contact Snowflake Support to request the limit be increased.

In addition, you can use the views in the READER_ACCOUNT_USAGE schema (in the SNOWFLAKE shared database) to query information about the reader accounts created for your account. For more details, see Account Usage.

Redirecting client connections in case of failover¶

In the event of an outage in a region, you can use Client Redirect to provide continued access to data consumers using reader accounts. Create two reader accounts in different regions and designate one to act as the primary connection. In the event of an outage in a region, you can redirect client connections to the reader account in another region. For more information, see Configuring Client Redirect and reader accounts.

FAQs¶

What is a reader account?

A reader account lets a provider share data with a consumer who isn’t a Snowflake customer. The provider creates, owns, and manages the reader account, and shares data with it by using shares. A reader account can consume data only from the provider account that created it.

How do I get started with reader accounts?

Using the ACCOUNTADMIN role or a role with the CREATE ACCOUNT global privilege, create a reader account in Snowsight or with CREATE MANAGED ACCOUNT. Wait up to five minutes for provisioning, then add the account to one or more shares and configure the account.

Who pays for usage in a reader account?

The provider account pays for all credits consumed by warehouses in the reader account. Reader account warehouses can consume an unlimited number of credits, so set up a resource monitor to limit usage.

What can users do in a reader account?

Users can query data shared by the provider and work with it, for example by creating materialized views. They can’t upload new data, modify existing data, or run commands such as INSERT, UPDATE, DELETE, MERGE, or CREATE SHARE, and they can’t load data into tables with COPY INTO. See What is restricted/allowed in a reader account? earlier in this topic.

How many reader accounts can I create?

By default, a provider can create up to 75 reader accounts. To request more, contact Snowflake Support. A dropped reader account counts against the limit for 7 days.

Who supports users in a reader account?

The provider does. Because a reader account doesn’t have a licensing agreement with Snowflake, users in the account can’t contact Snowflake Support directly. The provider fields their questions and opens Snowflake Support tickets if needed.

Which edition and region does a reader account use?

A reader account uses the same Snowflake edition as the provider account and is created in the same region.

When should I use a third-party account instead of a reader account?

Use a third-party (publisher–subscriber) account when the consumer needs a fully functional Snowflake account to load and combine their own data with the data you share.