Can't get Snowflake bulk uploder to work with new key-pair authentication to AWS

[pozzyal]

I'm trying to get the snowflake bulk uploader to work with snowflake key-pair authentication, and just can't make it work. Is anyone doing this? I can't find any decent documentation to describe how to do it, and no matter what I do within the interface, I can't get it to stick. I have no problem getting snowflake input and output connectors to work with the key-pair, but the output is far too slow for our needs and we need bulk uploading to work with key-pair.

The problem is when I get to the screen to pick my connections:

 

When I click the snowflake Bullk connection button, the only optoin it gives me is for username/password, but I need key-pair

 

Can anyone help? Does any step-by-step documentation exist for this? 

Thanks!

[pozzyal]

@dataguyW Are you using bulk upload too? We have no problem getting the key-pair connection to work on the Gallery, it's the bulk upload piece that's not working, as we can't create/save a connection which contains the snowflake key-pair credentials as well as the AWS bucket/secret/etc., as this screen in the DCM GUI isn't working - it only gives the option for username/password credentials, rather than key-pair.

 

[dataguyW]

We do use the bulk uploader, but are now using just simple "gallery" connections vs. DCM.   When I did key/value pair as a test I created the ODBC entry and set Authenticator=SNOWFLAKE_JWT.   Your results may vary whether you are on Simba drivers or DSII Snowflake drivers.  Don't quote me but I believe the JWT_TIMEOUT is also needed.  None of these show up on the configuration screen.  Also, after spending two weeks on all of this my DBA told me today they extended the date at Snowflake to October 2026 so don't fear, you have time :)

In my case my server, warehouse, database, role.etc. is in my ODBC conneciton settings.   From the Gallery connection string I pass in the new components.

odbc:DSN=[YOUR DSN NAME];UID=[YOUR USER];PRIV_KEY_FILE=[YOUR PATH TO KEY FILE];PRIV_KEY_FILE_PWD=[YOUR PASSPHRASE];JWT_TIMEOUT=120

Out of the box there is no place for the new required settings.  I believe you can add them as new registry entries and did a quick copilot search on how to find that and how to add new entries.   It isn't bad, but I didn't want all my users doing this which is why we opted for the PAT method.

🔑 Required Registry Entries

Add the following String Values under your DSN key:

1. PRIV_KEY_FILE

   • Value: Full path to your private key file (e.g., C:\Keys\rsa_key.p8)

2. PRIV_KEY_FILE_PWD

   • Value: Your passphrase (as plain text)

3. AUTHENTICATOR

   • Value: SNOWFLAKE_JWT (required for key pair authentication)

4. (Optional) LogLevel

   • Value: 6 (for debugging purposes)

I was also given these two  general links by a contact at Alteryx:

https://help.alteryx.com/current/en/designer/data-sources/snowflake.html#idp407338

https://community.alteryx.com/t5/Engine-Works/Impact-of-Snowflake-s-MFA-by-Default-for-New-Accounts-...

[pozzyal]

Are you also using Bulk Upload? That's the piece of the puzzle which is causing problems, as the Alteryx GUI doesn't offer a way to enter the AWS bucket/secret credentials or save the connection. We can make the functionality work if we don't use DCM, but then we have to either copy/paste the odbc string every time we need a new output tool, or we have to re-enter everything, since DCM can't save it. We want users to be able to just select the tool and then the connection and be off and running, rather than having to configure this every time.

[dataguyW]

It does also work with the Alteryx Output tool, connecting via a "Gallery" connection and having that tool set to Snowflake Bulk Loader in the ODBC options.  I just created a quick table and loaded using SNOWBL.   Are you using a specific Tool or just the Alteryx output tool?    If you are using DCM and the new key/pair is not saving with the tool, you may want to consider the Programmatic Access Token method (PAT).  It IS considered one of Snowflake's stronger authentication methods and whatever you could do before with a password+DCM would still continue to work since you replace what you woudl have entered as the password with the new token.    It gets saved into your DCM connection details and behaves exactly like a simple user/pass to Alteryx.    Snowflake understands when you login which method you are using automatically.

[dataguyW]

In my opinion, these types of issues are exactly why SnowFlake had to back down from the November 2025 deadline.   You can't expect (aka force) all companies to modify all of their code for your own security shortfalls and the PAT was born.

[pozzyal]

If anyone like @dataguyW is interesting or following this discussion, I had a long call today with Alteryx and they were able to see my dilema and are going back to the shop to work on it and will report back in 24 - 48 hours. The goal is to be able to use DCM to configure and save the connection so that end users have a simple way to use Snowflake Bulk upload. The functionality does exist, it can be manually configured without using DCM, but that is not a long-term solution.