Skip to main content

Connecting to Hyperproof Snowflake (SSR) using RSA key-pair authentication

This article includes step-by-step instructions on how to connect to your Hyperproof Snowflake data warehouse using RSA key-pair authentication.

Mark Walker avatar
Written by Mark Walker
Updated over a week ago

Overview

Note

These instructions are for IT workers with experience and access to install software needed to generate RSA keys. Consult your IT team for help with generating the RSA keys and before installing any software on your computer.

Tip

The best practice for setting up authentication with third-party reporting tools is to use a service account with RSA key-pair authentication. Power BI is known not to support multi-factor authentication, making a service account with RSA key-pair authentication a requirement.

Snowflake supports multiple authentication methods:

  • Person accounts: username, password, and MFA

  • Service accounts: RSA key-pair authentication (recommended for BI tools)

RSA authentication enhances security by removing the need for stored passwords and using cryptographic keys instead.

Generate your RSA key pair

  1. Install OpenSSL or request IT support for installation.

  2. Run the following commands:

    1. Generate a private key :

      • openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

    2. Generate a public key :

      • openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
        ​

        generate public key

  3. File descriptions:

    1. "rsa_key.p8": Private key to be used in Power BI like tools

    2. "rsa_key.pub": Public key uploaded to Hyperproof
      ​

      file descriptions

  4. During Snowflake connection setup in Hyperproof, upload the "rsa_key.pub" file.
    ​

    create snowflake account

  5. Hyperproof will automatically register the key with your Snowflake account.

  6. Securely store your private key file and do not share or email it.

Test your RSA key with SnowSQL (optional)

Use the SnowSQL CLI to verify your configuration:

snowsql -a hyperproof-analytics -u "<your Snowflake username>" --private-key-path "C:\path\rsa_key.p8"

If this connection is established without prompting for a password, the key is correctly configured.

snowsql configuration test

Connect your BI/reporting tool to Snowflake (Optional)

  1. Use the 64-bit EXE version of Power BI Desktop (the Microsoft Store version does not support KeyPair) or any other tool.

  2. Navigate to "Get Data" and select "Snowflake."

  3. Input the following:

    • Server:

      • US : hyperproof-analytics.snowflakecomputing.com

      • EU : hyperproof-analytics_eu.snowflakecomputing.com

  4. Warehouse: Your assigned warehouse

  5. Authentication Method: KeyPair

  6. Username: Your Snowflake service account username

  7. Private Key: Paste the full content of the "rsa_key.p8" file

  8. Click "Connect" to establish a secure RSA connection.

Troubleshooting

  • "KeyPair" option missing: Ensure you are using the EXE version of Power BI Desktop.

  • "Invalid key" or "authentication failed": Re-upload the public key file in Hyperproof.

  • "Got unexpected extra arguments": Wrap usernames/path containing spaces in quotes.

  • "Snowsight login fails": KeyPair authentication is not supported in the browser; use SSO or a password instead.

Best practices

  • Keep your private key secure and backed up.

  • Rotate RSA keys every six months or according to your policy.

  • Use dedicated service accounts for BI tool access.

  • Coordinate with IT before replacing or regenerating RSA keys.

  • If you installed OpenSSL, uninstall it after you have generated your keys and configured your Snowflake login.

Related resources

REF: 000001657

Did this answer your question?