Snowflake

-- 1. Dedicated role for SegmentStream.
CREATE OR REPLACE ROLE SEGMENTSTREAM_ROLE;

-- 2. Service user, registering the public half of your RSA key pair.
--    Paste the key body between the quotes with no BEGIN/END lines
--    and no whitespace.
CREATE OR REPLACE USER SEGMENTSTREAM_SERVICE_USER
  TYPE = SERVICE
  RSA_PUBLIC_KEY = '<PUBLIC_KEY_BODY>'
  DEFAULT_ROLE = SEGMENTSTREAM_ROLE;

-- 3. (Optional) Proxy database + secure view so SegmentStream reads only
--    what you deliberately expose. Replace SOURCE_DB.SOURCE_SCHEMA.SOURCE_TABLE
--    with the table you want to import.
CREATE OR REPLACE DATABASE SEGMENTSTREAM_PROXY_DB;
CREATE OR REPLACE SCHEMA   SEGMENTSTREAM_PROXY_DB.ACCESS;

CREATE OR REPLACE SECURE VIEW SEGMENTSTREAM_PROXY_DB.ACCESS.MY_FEED AS
SELECT * FROM SOURCE_DB.SOURCE_SCHEMA.SOURCE_TABLE;

-- 4. Grant privileges. Replace COMPUTE_WH with the warehouse
--    SegmentStream should use.
GRANT USAGE  ON WAREHOUSE COMPUTE_WH                            TO ROLE SEGMENTSTREAM_ROLE;
GRANT USAGE  ON DATABASE  SEGMENTSTREAM_PROXY_DB                TO ROLE SEGMENTSTREAM_ROLE;
GRANT USAGE  ON SCHEMA    SEGMENTSTREAM_PROXY_DB.ACCESS         TO ROLE SEGMENTSTREAM_ROLE;
GRANT SELECT ON VIEW      SEGMENTSTREAM_PROXY_DB.ACCESS.MY_FEED TO ROLE SEGMENTSTREAM_ROLE;

-- 5. Assign the role to the service user.
GRANT ROLE SEGMENTSTREAM_ROLE TO USER SEGMENTSTREAM_SERVICE_USER;

SELECT
  order_id,
  customer_id,
  order_total,
  order_created_at
FROM analytics.crm.orders
WHERE order_created_at >= '{{date_from}}'
  AND order_created_at <  '{{date_to}}'