Prerequisites for App Installs

What must be in place in Snowflake and your SBT project before an app can install and run successfully.

New to SBT? Start with the SBT Overview.

Installing an app means giving one organization access to an app you published. Before an install succeeds and the app runs, a few things must be in place in Snowflake and in your SBT project. Most install and run failures trace back to a missing item on this list. Check it before installing, and again whenever a run fails with a permissions error. Everything here applies to both SBT Beta and SBT 1.0 apps.

Snowflake grants on source tables

A grant is a Snowflake permission that lets a role read an object. Every table or view your app reads (its sources) needs two grants:

  • SELECT for its per-table access role, named database__schema__table__role

  • SELECT for MTA_ADMIN_ROLE WITH GRANT OPTION. Plain SELECT is not enough. Insight Cloud re-grants access to app roles on your behalf and cannot do that without the grant option.

GRANT SELECT ON TABLE <DB>.<SCHEMA>.<TABLE> TO ROLE <db>__<schema>__<table>__role;GRANT SELECT ON TABLE <DB>.<SCHEMA>.<TABLE> TO ROLE MTA_ADMIN_ROLE WITH GRANT OPTION;

This applies to views as well as tables.

Keep grants alive in your pipelines

When a pipeline drops and recreates a source table, Snowflake silently removes all grants on it. Apps reading that table then fail with "Object does not exist or not authorized." Use TRUNCATE + INSERT patterns instead of drop/recreate so grants persist.

Declare every source

Any table your app reads must be declared in your project's sources/ YAML. Hardcoded references to undeclared tables are not covered by Insight Cloud's managed permissions and will fail. See Sources.

Pin your SBT version

SBT does not update itself. You install a specific version and stay on it until you choose to upgrade. Feature minimums: SBT 1.0.7+ for bundled sources and row-level security (RLS) parameters, SBT 1.0.10+ for model visibility. See Setting Up SBT.

Project configuration

Your sbtconf.toml needs a database connection block (dbcon) and a seek block (API host and key). Run sbt check-conn to validate before deploying. See Setting Up SBT.

Warehouse settings

A warehouse is Snowflake's unit of computing power. Bigger runs faster and costs more per minute. Publishers set a default warehouse size per app; subscribing organizations can override it. If a run fails with "no active warehouse defined," report it through Contact Us. This is a known issue our team resolves quickly.

FAQ

Do I need to wait after installing before running the app? No. Runs wait for Insight Cloud to finish provisioning permissions before executing.

Why does a newly installed app look empty or show an error at first? Output data exists only after the app's first successful run. Access to output tables is granted once that run completes, so an empty state right after install is expected. Run the app or wait for its schedule.

Related articles