Snowflake Trigger

The SQL query to run

The JDBC URL to connect to the database

Specifies whether a trigger is allowed to start a new execution even if a previous run is still in progress.

Maximum number of pooled connections

Maximum connections held in the pool for a given URL and credentials. Default 10. Increase for flows that run many concurrent queries against the same database to avoid waiting for an available connection. Ignored when connectionPooling is false or for embedded drivers.

Reuse database connections via a connection pool

When true (default), connections are pooled and reused across executions, keyed by URL and credentials, removing the connect and TLS-handshake cost on each run. Set to false if your SQL relies on session state persisting on the connection (for example SET search_path, session-scoped temp tables or variables), since pooled connections are reused. Embedded drivers (DuckDB, SQLite, MS Access) never pool regardless of this setting.

Specifies the default database to use once connected

The specified database should be an existing database for which the specified default role has privileges. If you need to use a different database after connecting, execute the USE DATABASE command.

Number of rows that should be fetched

Gives the JDBC driver a hint as to the number of rows that should be fetched from the database when more rows are needed for this ResultSet object. If the fetch size specified is zero, the JDBC driver ignores the value and is free to make its own best guess as to what the fetch size should be. Ignored if autoCommit is false.

The way you want to fetch the data

Triggers default to FETCH, which loads all rows into memory and exposes them as {{ trigger.rows }}. A trigger fires only when the query returns at least one row; setting NONE would cause the trigger to never fire. Use FETCH_ONE to expose a single row as {{ trigger.row }}, or STORE to write the rows to internal storage and expose the file URI as {{ trigger.uri }}.

Interval between polling.

The interval between 2 different polls of schedule, this can avoid to overload the remote system with too many calls. For most of the triggers that depend on external systems, a minimal interval must be at least PT30S. See ISO_8601 Durations for more information of available interval values.

Parameters

A map of parameters to bind to the SQL queries. The keys should match the parameter placeholders in the SQL string, e.g., : parameterName.

The database user's password

Private key used for Snowflake key-pair authentication

Kestra supports multiple private key formats for Snowflake key-pair authentication.

You can provide your key in any of the following formats:

1. PKCS8 DER (base64-encoded, single-line)

2. PEM PKCS8: -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY-----

3. PEM PKCS1 RSA: -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY-----

4. Multiline or single-line input (Kestra will normalize automatically)

5. Encrypted PKCS8 (requires providing privateKeyPassword)

Recommended format

Snowflake recommends PKCS8. If your key is in PKCS1 format, Kestra will automatically convert it.

Example: using a PEM PKCS8 key (recommended)

secret('SNOWFLAKE_PRIVATE_KEY') should contain:

-----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASC... ... -----END PRIVATE KEY-----

Example: encrypted private key

privateKey: "{{ secret('SNOWFLAKE_PRIVATE_KEY') }}" privateKeyPassword: "{{ secret('SNOWFLAKE_PRIVATE_KEY_PASSWORD') }}"

Converting a PEM key to unencrypted PKCS8 DER (optional)

openssl pkcs8 -topk8 -nocrypt -inform PEM -outform DER
-in private_key.pem
-out private_key.der

base64 -w 0 private_key.der > private_key.base64

You can then store the content of private_key.base64 as the Kestra secret.

Kestra automatically detects the format and performs the necessary conversions. No manual header stripping or reformatting is required.

Specifies the private key password for key pair authentication and key rotation

Query tag for Snowflake session tracking

Optional string to tag queries executed within the session for monitoring and cost allocation

Specifies the default access control role to use in the Snowflake session initiated by the driver

The specified role should be an existing role that has already been assigned to the specified user for the driver. If the specified role has not already been assigned to the user, the role is not used when the session is initiated by the driver. If you need to use a different role after connecting, execute the USE ROLE command.

Specifies the default schema to use for the specified database once connected

The specified schema should be an existing schema for which the specified default role has privileges. If you need to use a different schema after connecting, execute the USE SCHEMA command.

List of execution states after which a trigger should be stopped (a.k.a. disabled).

The time zone id to use for date/time manipulation. Default value is the worker's default time zone id

The database user

Specifies the virtual warehouse to use once connected

The specified warehouse should be an existing warehouse for which the specified default role has privileges. If you need to use a different warehouse after connecting, execute the USE WAREHOUSE command to set a different warehouse for the session.

A condition that determines whether the trigger should run.

A Pebble expression evaluated at trigger time. The trigger fires only when the expression evaluates to a truthy value (true, a non-empty string, a non-zero number). Use this to gate trigger execution on dynamic runtime values such as execution labels, flow variables, or environment conditions.