Security & Privacy
Architectural boundaries, privilege scoping, data freshness, and estimation math
#Read-only by Design
Cost Monitor is architected with strict adherence to Snowflake Native App security boundaries:
- Cannot modify state: The application cannot create, alter, or drop anything in your Snowflake account.
- No data export: Zero telemetry, analytics, or usage statistics are exported externally. No third party ever sees your account usage data.
- Zero external network access: The application does not define or utilize external network access rules or stages.
- Consumer-owned compute: All queries and Streamlit rendering execute entirely inside your Snowflake account’s own virtual warehouse compute.
#3.2 Privilege Model
Cost Monitor requests a single privilege: IMPORTED PRIVILEGES ON SNOWFLAKE DB. This grants read access to the SNOWFLAKE database’s ACCOUNT_USAGE views. No other account-level grant is required, and the app cannot create, alter, or drop anything.
#3.3 Data Latency
Snowflake’s own system views are not real-time. Cost Monitor surfaces this honestly rather than implying a live feed:
| Data | Typical Latency |
|---|---|
| Warehouse credits | Up to ~3 hours |
| Cloud services credits | Up to ~6 hours |
| Per-query attribution | Up to ~8 hours |
The dashboard displays the latest available metering timestamp in its header so you always know how fresh the numbers are.
#6. Cost Estimation Methodology & Disclaimers
Every dollar figure in Cost Monitor is an estimate derived from the $/credit and $/TB rates you enter — it is not your Snowflake invoice. Actual billing depends on your specific contract, edition, cloud provider, and region.
#6.1 How Estimated Cost Is Calculated
- Compute & Cloud Services cost: billed credits × your $/credit rate.
- Storage cost (KPI card): current total storage (TB) × your $/TB/month rate.
- Storage cost (Cost-by-Type donut): storage cost prorated to the selected period’s length, so the donut’s total is internally consistent with the period it represents.
#6.2 The Cloud Services 10% Rule
Snowflake includes Cloud Services compute for free up to 10% of a day’s warehouse credit usage; only the amount exceeding that threshold is actually billed. Cost Monitor calculates this explicitly — using METERING_DAILY_HISTORY’s credit and adjustment columns (CREDITS_USED_CLOUD_SERVICES, CREDITS_ADJUSTMENT_CLOUD_SERVICES, CREDITS_BILLED) — rather than assuming all Cloud Services usage is billed, which would overstate cost.
#6.3 Idle-Time Calculation
Where available, idle credits = warehouse compute credits − credits attributed to actual query execution (CREDITS_ATTRIBUTED_COMPUTE_QUERIES). On accounts where this column is not yet available, the app falls back to totals only and clearly states that idle/utilization figures cannot be computed, rather than guessing.