Overview

---

What You'll Learn

Prerequisites

Know your Datadog site. This guide uses placeholder values. Replace them with your site-specific values (US1, US3, US5, EU1, AP1). Your site determines the IP ranges to whitelist and the Datadog URLs.

1. Enable Postgres Logging

A Quick Primer on Postgres Logging

Production vs. development trade-off: log_statement=all generates a lot of log data and is generally not recommended for production workloads. For production, ddl combined with log_min_duration_statement for slow queries gives you the important details without the volume. For this guide, we use all so every test query is visible in Datadog.

Snowflake Postgres log line prefix

[%p][%b][%v][%x] %q[user=%u,db=%d,app=%a] [%h]

Configure Logging on Your Snowflake Postgres Instance

ALTER SYSTEM SET log_statement = 'all';

2. Confirm Logs in the Snowflake Event Table

CREATE TABLE cookie_monster (
    id SERIAL PRIMARY KEY,
    cookie_type VARCHAR(100),
    flavor VARCHAR(50),
    crunchiness INT CHECK (crunchiness BETWEEN 1 AND 10),
    nom_rating DECIMAL(3,1),
    eaten_at TIMESTAMP DEFAULT NOW()
);

INSERT INTO cookie_monster (cookie_type, flavor, crunchiness, nom_rating)
VALUES
    ('Chocolate Chip', 'chocolate', 8, 9.5),
    ('Snickerdoodle', 'cinnamon', 6, 8.7),
    ('Oatmeal Raisin', 'oat', 7, 7.2),
    ('Double Chocolate', 'dark chocolate', 9, 9.8),
    ('Peanut Butter', 'peanut', 5, 8.1);

SELECT * FROM cookie_monster WHERE crunchiness > 7;
SELECT cookie_type, nom_rating FROM cookie_monster ORDER BY nom_rating DESC;
SELECT AVG(crunchiness) AS avg_crunch, MAX(nom_rating) AS best_nom FROM cookie_monster;

-- Replace the instance ID with your Postgres instance's ID
-- Find it with: SHOW POSTGRES INSTANCES;  (look at the "id" column)
SELECT
    TIMESTAMP,
    RESOURCE_ATTRIBUTES['instance.id']::STRING AS instance_id,
    VALUE['MESSAGE']::STRING AS message
FROM SNOWFLAKE.TELEMETRY.EVENTS
WHERE TIMESTAMP > DATEADD('hour', -1, CURRENT_TIMESTAMP())
  AND RECORD_TYPE = 'LOG'
  AND RESOURCE_ATTRIBUTES['instance.id']::STRING = '<YOUR_INSTANCE_ID>'
ORDER BY TIMESTAMP DESC
LIMIT 20;

Tip: To find your Postgres instance ID, run SHOW POSTGRES INSTANCES; and look at the id column. It's a string like 4jypgsndvzd5ta6ufaryx6owja.

3. Create the Snowflake Role and Grants

-- Use ACCOUNTADMIN to create the role and assign grants
USE ROLE ACCOUNTADMIN;

-- Create the Datadog role
CREATE ROLE IF NOT EXISTS DATADOG;
GRANT ROLE DATADOG TO ROLE ACCOUNTADMIN;

-- CRITICAL: Grant IMPORTED PRIVILEGES on the SNOWFLAKE database
-- This is required for Datadog to read the event table and account usage views.
-- Using just USAGE is NOT sufficient -- you must use IMPORTED PRIVILEGES.
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE DATADOG;

-- Grant monitoring access
GRANT MONITOR USAGE ON ACCOUNT TO ROLE DATADOG;

-- Grant warehouse usage (replace with your warehouse name)
GRANT USAGE ON WAREHOUSE MY_WAREHOUSE TO ROLE DATADOG;

SHOW GRANTS TO ROLE DATADOG;

4. Generate RSA Key Pair

Generate the Keys

# Create a directory for the keys
mkdir -p ~/.snowflake/datadog_keys

# Generate an unencrypted RSA private key (PKCS#8 format)
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out ~/.snowflake/datadog_keys/datadog_rsa_key.p8 -nocrypt

# Extract the public key
openssl rsa -in ~/.snowflake/datadog_keys/datadog_rsa_key.p8 -pubout -out ~/.snowflake/datadog_keys/datadog_rsa_key.pub

Get the Public Key Value (for Snowflake)

# Print the public key without the header/footer lines (this is what Snowflake expects)
grep -v "BEGIN\|END" ~/.snowflake/datadog_keys/datadog_rsa_key.pub | tr -d '\n'

5. Create the Snowflake Service User

Key distinction: DATADOG is the role. DATADOG_USER is the user. When configuring Datadog, you'll enter DATADOG_USER as the username and DATADOG as the role. Mixing these up is a common source of "integration broken" errors.

USE ROLE ACCOUNTADMIN;

-- Create the service user
CREATE USER IF NOT EXISTS DATADOG_USER
  TYPE = SERVICE
  DEFAULT_ROLE = DATADOG
  DEFAULT_WAREHOUSE = MY_WAREHOUSE
  DEFAULT_NAMESPACE = SNOWFLAKE.TELEMETRY;

-- Assign the RSA public key (paste the key value from Step 4)
ALTER USER DATADOG_USER SET RSA_PUBLIC_KEY = '<paste_public_key_here>';

-- Grant the DATADOG role to the user
GRANT ROLE DATADOG TO USER DATADOG_USER;

6. Add Network Permissions for Datadog

Find Your Datadog Site's IP Ranges

Check this URL regularly. Datadog may add new IP ranges over time. If your integration stops working, check for updated IPs.

Create the Network Rules

USE ROLE ACCOUNTADMIN;

-- Ingress rule: allows Datadog to connect to Snowflake
CREATE OR REPLACE NETWORK RULE DATADOG_INGRESS
  TYPE = IPV4
  MODE = INGRESS
  VALUE_LIST = (
    '34.149.66.128/26',
    '34.160.40.115/32',
    '35.244.255.175/32'
  );

-- Egress rule: allows Snowflake to respond to Datadog
CREATE OR REPLACE NETWORK RULE DATADOG_EGRESS
  TYPE = IPV4
  MODE = EGRESS
  VALUE_LIST = (
    '34.149.66.128/26',
    '34.160.40.115/32',
    '35.244.255.175/32'
  );

-- Create a network policy using both rules
CREATE OR REPLACE NETWORK POLICY DATADOG_NETWORK_POLICY
  ALLOWED_NETWORK_RULE_LIST = ('DATADOG_INGRESS', 'DATADOG_EGRESS');

-- Assign the policy to the Datadog user
ALTER USER DATADOG_USER SET NETWORK_POLICY = 'DATADOG_NETWORK_POLICY';

Scope the policy to the user, not the account. Applying a network policy at the account level could lock out other users. Apply it only to DATADOG_USER.

Note: Datadog may add or change IP ranges over time. When this happens, update your existing network rules rather than recreating the policy.

7. Configure the Datadog Snowflake Integration

Account URL Format

If your account name contains underscores (e.g., MY_ACCOUNT), Datadog may convert it to MY-ACCOUNT in the URL, causing authentication to fail. Use a connection alias or the legacy locator format to work around this.

-- Via Snowsight: Admin > Accounts > select account > Create Connection
-- Or via SQL:
CREATE CONNECTION MY_ALIAS;
ALTER CONNECTION MY_ALIAS SET COMMENT = 'Alias for Datadog integration';

8. Generate Test Logs and Verify

Verify in Datadog

Timing: Datadog polls the event table at the interval you configured. If you set it to 1 hour, it may take up to an hour for new logs to appear. For testing, consider temporarily reducing the interval.

Conclusion and Resources

What You Learned

Resources