Example Error Message

Resolution

The error message incorrectly identifies which account needs the grants. You need to grant privileges to the role you are using. For me this is not ACCOUNTADMIN.

Check your role by running SELECT CURRENT_ROLE(); in a SQL cell, or a provider call like below.

import relationalai as rai
provider = rai.Provider()
provider.sql("SELECT CURRENT_ROLE();")

For example, below I ran this in a SQL cell and my role is test_role:

Necessary Grants

To create a stream, you need the privileges:

• CREATE STREAM on the schema
• SELECT on the source table

For more information, see the Snowflake docs on CREATE STREAM

Grant the Privileges

Grant these privileges to your role identified above. For example my role is test_role. 

GRANT CREATE STREAM ON SCHEMA database.schema TO ROLE test_role;
GRANT SELECT ON database.schema.table to ROLE test_role;

Pro tip: if you have a lot of tables in the same schema and want to enable the privilege for all of them, then you can run the command below. This lets your role create streams on all tables in this schema.

GRANT SELECT ON ALL TABLES IN SCHEMA database.schema TO ROLE test_role;

Explanation

There is currently a Snowflake bug in how privileges are passed between primary and secondary roles. Even if your primary role has sufficient privileges to perform an action like creating a stream, your secondary role may not. One situation this arises is if you are running RelationalAI in a Snowflake notebook hosted on a container. Since you cannot use the ACCOUNTADMIN role to run notebooks in a container, you may be using a role with reduced privileges. 

If you try to create a stream with a secondary role that has insufficient permissions, then the stream may not function correctly. It may repeatedly recreate and retry but never be able to import data. Eventually after 2-3 minutes it exceeds the retry count and gets marked as quarantined. This can be seen in the column DATA_SYNC_STATUS if you run the command below. Be sure to replace the model name and the fully qualified table name.

CALL relationalai.api.get_data_stream('<db>.<schema>.<table_or_view>', 'MyModel');

To work around this issue, make sure the user's selected primary role has the correct privileges on the table/view to be imported, as well as the privilege to create streams from that schema. Alternatively change to using a role that already has these privileges.

Why am I seeing this when I run a query?

In RelationalAI, data is accessed just in time. This means that running cells that only create rules will not actually touch the data. Only queries actually touch or materialize the data into the model. If you are manually creating streams then you will see this error when you create the stream. Alternatively you may rely on the stream to be automatically created by simply identifying the source = "database.schema.table" when you create a Type. In that case the stream is not actually created until the first time you query any data that is sourced from it.