Snowflake Ingestion Requires USAGE Permission on All Target Databases for Schema and Semantic View Scanning – DataHub Customer Support Portal

Area: Ingestion Issues

Sub-Area: Snowflake Connector — Permissions and Semantic Views Configuration

Issue

When ingesting Snowflake metadata into DataHub, databases listed in a recipe's allow-list may be silently skipped if the configured Snowflake role lacks the USAGE privilege on those databases. Because the connector cannot enumerate a database it has no access to, the scan proceeds without error but simply omits the inaccessible databases — and any semantic views, schema aspects, or column metadata they contain. This silent omission causes downstream features that depend on ingested schema aspects — most notably AI-powered description generation — to fail with a generic runtime error, because the required metadata was never loaded into DataHub in the first place.

Error Messages

Failed to generate summary. java.lang.RuntimeException: The AI service encountered an error. Please try again in a few moments. If the issue persists, contact your DataHub administrator.

You Might Be Asking

Why are some databases in my Snowflake allow-list not being ingested even though they are spelled correctly in the recipe?
Why does AI description generation fail on my Snowflake semantic views but work on regular tables?
How can I tell which databases were actually scanned during a Snowflake ingestion run?
Why does my semantic view show no columns in DataHub after ingestion?
What permissions does the DataHub Snowflake role need to ingest semantic views?

Solution

Confirm which databases were actually scanned.
After an ingestion run completes, open the ingestion run log in the DataHub UI and look for the structured summary emitted by the Snowflake connector. The databases_scanned counter tells you how many databases the connector successfully enumerated. If this number is lower than the number of databases in your allow-list, one or more databases were silently skipped due to missing permissions.
```
{
  "databases_scanned": 6,
  "semantic_views_scanned": 0
}
```
A semantic_views_scanned value of 0 when you expect semantic views confirms that the target database was not reached.
Grant USAGE on all target databases to the DataHub role.
In Snowflake, run the following for each database that should be ingested. Replace <datahub_role> and <your_database> with your actual values.
```
GRANT USAGE ON DATABASE <your_database> TO ROLE <datahub_role>;
GRANT USAGE ON ALL SCHEMAS IN DATABASE <your_database> TO ROLE <datahub_role>;
GRANT REFERENCES ON ALL TABLES IN DATABASE <your_database> TO ROLE <datahub_role>;
GRANT REFERENCES ON ALL VIEWS IN DATABASE <your_database> TO ROLE <datahub_role>;
```
For semantic views specifically, the role also needs REFERENCES or SELECT on the semantic view objects. Refer to the Snowflake connector prerequisites documentation for the full privilege list.
Enable semantic view ingestion in your recipe.
Semantic view ingestion is opt-in. Add the following block under the config section of your Snowflake recipe. If you manage the recipe through the DataHub UI, switch to the YAML editor to add these fields.
```
source:
  type: snowflake
  config:
    # ... your existing configuration ...
    semantic_views:
      enabled: true
      emit_semantic_model_entities: true  # emits Metric entities alongside Semantic View datasets
    include_column_lineage: true          # required for column-level schema aspects
```
Note: include_column_lineage: true is important because it populates the schemaMetadata aspect on semantic view datasets. The DataHub AI description API requires this aspect to be present in order to generate documentation. Without it, the view will be ingested as a shell entity with no column information, and AI description generation will fail.
Re-run the ingestion pipeline.
After granting permissions and updating the recipe, trigger a new ingestion run. Verify in the run summary that:
- databases_scanned now reflects the expected number of databases.
- semantic_views_scanned is greater than 0.
Verify schema aspects and test AI description generation.
Navigate to a semantic view dataset in the DataHub UI and open the Columns tab. If columns are now visible, the schemaMetadata aspect has been successfully ingested. You can then retry Generate with AI on the Summary tab, which should now complete successfully.

Additional Notes

Silent skipping is expected Snowflake behavior. The Snowflake connector uses SHOW DATABASES under the configured role. Any database that the role cannot see is simply absent from the result set — no warning or error is emitted. This means misconfigured permissions will not cause ingestion to fail visibly; they will only reduce the scope of what is ingested.
The AI description API requires schemaMetadata. As of current DataHub versions, the AI description generation feature requires schema aspects (columns) to be present on the dataset entity. It is not possible to generate descriptions from view definitions alone. Ensuring include_column_lineage: true is set and permissions are correct is the prerequisite for this feature to work on semantic views.
Semantic Views and Metrics & Semantic Models are distinct features. The semantic_views: enabled: true recipe flag enables ingestion of Snowflake native Semantic View objects as DataHub datasets. The broader Metrics & Semantic Models feature set (which includes Metric entities and enhanced UX) may require an additional feature flag to be enabled in DataHub Cloud environments — contact DataHub support if you need that feature activated.
Snowflake Enterprise Edition or higher is required for Snowflake Semantic Views, as this is a Snowflake platform prerequisite.
Recipe allow-list patterns are applied after database enumeration. If a database is not visible to the role, it will never reach the allow-list filtering stage. Both correct permissions and a matching allow-list pattern are required.

Issue

Error Messages

You Might Be Asking

Solution

Additional Notes

Related Documentation