Snowflake Admin Commands cheat sheet

Warehouses, roles, resource monitors, ACCOUNT_USAGE queries, and the DDL every Snowflake admin runs weekly.

Cloud PlatformsAdvanced6 sections

Warehouses

create warehouse etl_wh with warehouse_size = 'SMALL' auto_suspend = 60 auto_resume = true initially_suspended = true: 60-second auto-suspend, not the 600-second default. This one setting is the most common source of wasted credits.
alter warehouse etl_wh set warehouse_size = 'MEDIUM': Resize takes effect on the next query. Each step doubles credits per hour, so test one size down before sizing up.
alter warehouse bi_wh set min_cluster_count = 1 max_cluster_count = 4 scaling_policy = 'ECONOMY': Multi-cluster for concurrency, not for single-query speed. ECONOMY delays new clusters and saves credits.
alter warehouse etl_wh set statement_timeout_in_seconds = 3600: A runaway query without a timeout can burn a weekend of credits. Set it on every warehouse.
show warehouses: Quick view of size, state, and cluster counts. Look for anything RUNNING with no queued work.

create role ar_analytics_gold_r; grant usage on database analytics to role ar_analytics_gold_r; grant usage on schema analytics.gold to role ar_analytics_gold_r; grant select on all tables in schema analytics.gold to role ar_analytics_gold_r;: Access role pattern. Usage on database and schema is required before SELECT does anything.
grant select on future tables in schema analytics.gold to role ar_analytics_gold_r: Future grants so new models are readable without a manual grant after every deploy.
grant role ar_analytics_gold_r to role fr_analyst: Access roles nest into functional roles. People get functional roles only — this keeps the hierarchy auditable.
show grants to role fr_analyst: The audit command. Run it before believing a reported permission problem.
grant ownership on schema analytics.silver to role fr_data_engineer revoke current grants: Ownership transfer during a migration. Without revoke current grants, stale privileges linger.

create resource monitor rm_etl with credit_quota = 500 frequency = monthly start_timestamp = immediately triggers on 75 percent do notify on 100 percent do suspend on 110 percent do suspend_immediate: Notify, suspend, then suspend_immediate. suspend lets running queries finish; immediate kills them.
alter warehouse etl_wh set resource_monitor = rm_etl: Monitors do nothing until attached. One per team or workload, plus one at account level as a backstop.
show resource monitors: Shows used credits against quota. Check it before month-end, not after.

select warehouse_name, sum(credits_used) as credits from snowflake.account_usage.warehouse_metering_history where start_time > dateadd(day, -30, current_timestamp()) group by 1 order by 2 desc: Credits by warehouse over 30 days. The starting point for every cost investigation.
select query_tag, count(*) as runs, sum(total_elapsed_time)/1000 as seconds from snowflake.account_usage.query_history where start_time > dateadd(day, -7, current_timestamp()) and query_tag <> '' group by 1 order by 3 desc: Requires teams to set QUERY_TAG. Without it, cost attribution by team is guesswork.
alter session set query_tag = 'dbt:prod:fct_orders': Set it in your orchestrator, not by hand. This is what makes the query above useful.
select table_schema, table_name, active_bytes/pow(1024,4) as active_tb, time_travel_bytes/pow(1024,4) as tt_tb from snowflake.account_usage.table_storage_metrics order by 3 desc: Finds tables whose Time Travel retention costs more than the data itself.
ACCOUNT_USAGE has up to 3 hours of latency: Use INFORMATION_SCHEMA table functions for near-real-time investigation of an active incident.

create masking policy pii_email as (val string) returns string -> case when current_role() in ('FR_PII_READER') then val else regexp_replace(val, '.+@', '***@') end: One policy applied to many columns via tags. Do not write a policy per column.
alter tag pii set masking policy pii_email: Tag-based governance. Tag a column once and the policy follows it, including into clones.
create row access policy region_filter as (region string) returns boolean -> exists (select 1 from admin.role_regions where role_name = current_role() and region = region): Table-driven row-level security so adding a region is a data change, not a DDL change.
select * from snowflake.account_usage.access_history: Column-level read audit. The answer to "who queried this PII column last quarter".

alter account set data_retention_time_in_days = 1: Account default. Raise it per table where recovery matters instead of paying for 90 days everywhere.
show parameters in account: Reveals inherited settings people assume are defaults, like TIMEZONE and WEEK_START.
alter user svc_dbt set rsa_public_key = '...': Key-pair auth for service accounts. Password auth for automation is an audit finding.
select name, disabled, last_success_login from snowflake.account_usage.users where last_success_login < dateadd(day, -90, current_timestamp()): Dormant accounts to disable. Run it quarterly.

From DataLane — tutorials at/blog, practice SQL live in theplayground.