How do I install the Snowtower Admin skill?

Run npx skillmds@latest add tomevault-io/snowtower-admin in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Snowtower Admin safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Snowtower Admin?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Snowtower Admin free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Snowtower Admin?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Snowtower Admin by tomevault-io — Agent Skill

Name: Snowtower Admin
Author: tomevault-io

Snowtower Admin

Advanced skill for SnowTower infrastructure administrators. Use for SnowDDL operations, user provisioning, role management, CI/CD deployments, troubleshooting, and Snowflake administration. Triggers on mentions of snowddl, deploy, user creation, role grants, infrastructure changes, or admin operations. Use when this capability is needed.

tomevault-io 3c83ac6 2 files · 3.9 KB Updated Sep 17, 2026

File contents

SnowTower Administrator Guide

Assumes CLAUDE.md is loaded for project context, role hierarchy, and SnowDDL knowledge.

Deployment Checklist

# 1. Edit YAML files in snowddl/
# 2. ALWAYS preview first
uv run snowddl-plan
# 3. Review output for unexpected DROP/REVOKE statements
# 4. Apply using safe deployment (preserves schema grants)
uv run deploy-safe

Why deploy-safe? Raw snowddl-apply can revoke schema-level grants managed by dbt. The wrapper restores them automatically.

Plan output flags:

CREATE / ALTER - normally expected
DROP - verify this is intentional
Mass REVOKE - likely schema drift (see CLAUDE.md "Schema Drift Problem")
Changes to ACCOUNTADMIN/SECURITYADMIN - red flag

User Creation

Option 1: Interactive wizard (recommended)

uv run manage-users create

Option 2: Edit YAML directly in snowddl/user.yaml

Option 3: Non-interactive

uv run manage-users create --first-name Jane --last-name Smith --email jane@company.com --role ANALYST_ROLE

Encrypt passwords:

uv run snowddl-encrypt "MySecurePassword123!"
# Use output in YAML with !decrypt tag

For service accounts: See Service Account Pattern

Role Management

Business Role (snowddl/business_role.yaml):

ANALYST_ROLE:
  comment: "Business analysts with read access"
  tech_roles:
    - STRIPE_READER_ROLE
  warehouse_usage:
    - MAIN_WAREHOUSE
  schema_read:
    - PROJ_STRIPE.ANALYTICS

Technical Role (snowddl/tech_role.yaml): See grant format in CLAUDE.md "SnowDDL Object Type Reference".

Troubleshooting Quick Fixes

Problem	Fix
Schema grant drift (mass REVOKEs)	Use `uv run deploy-safe` instead of raw apply
"Object does not exist"	Ensure using `-r ACCOUNTADMIN`
"Insufficient privileges"	Check `SNOWFLAKE_ROLE=ACCOUNTADMIN` in `.env`
Exit code 8	Not an error - means changes were applied
User locked out	`ALTER USER USERNAME SET MINS_TO_UNLOCK = 0;`

Emergency Procedures

Rollback last deployment:

git checkout HEAD~1 -- snowddl/
uv run deploy-safe

Service account reset:

uv run generate-rsa-batch --users SNOWDDL --force
snow sql -q "ALTER USER SNOWDDL SET RSA_PUBLIC_KEY='...'"
gh secret set SNOWFLAKE_PRIVATE_KEY < new_key.p8

MFA compliance check:

uv run manage-security --check-mfa

CI/CD Workflows

Workflow	Trigger	Purpose
`ci.yml`	PRs, pushes	Lint + test validation
`release.yml`	Tags `v*`	Create GitHub release
`labeler.yml`	PRs	Auto-label by file type
`changelog.yml`	Push to main	Update changelog

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: snowtower-admindescription: Advanced skill for SnowTower infrastructure administrators. Use for SnowDDL operations, user provisioning, role management, CI/CD deployments, troubleshooting, and Snowflake administration. Triggers on mentions of snowddl, deploy, user creation, role grants, infrastructure changes, or admin operations. Use when this capability is needed.---# SnowTower Administrator GuideAssumes CLAUDE.md is loaded for project context, role hierarchy, and SnowDDL knowledge.## Deployment Checklist```bash# 1. Edit YAML files in snowddl/# 2. ALWAYS preview firstuv run snowddl-plan# 3. Review output for unexpected DROP/REVOKE statements# 4. Apply using safe deployment (preserves schema grants)uv run deploy-safe```**Why `deploy-safe`?** Raw `snowddl-apply` can revoke schema-level grants managed by dbt. The wrapper restores them automatically.**Plan output flags:**- `CREATE` / `ALTER` - normally expected- `DROP` - verify this is intentional- Mass `REVOKE` - likely schema drift (see CLAUDE.md "Schema Drift Problem")- Changes to ACCOUNTADMIN/SECURITYADMIN - red flag## User Creation**Option 1: Interactive wizard** (recommended)```bashuv run manage-users create```**Option 2: Edit YAML directly** in `snowddl/user.yaml`**Option 3: Non-interactive**```bashuv run manage-users create --first-name Jane --last-name Smith --email jane@company.com --role ANALYST_ROLE```**Encrypt passwords:**```bashuv run snowddl-encrypt "MySecurePassword123!"# Use output in YAML with !decrypt tag```**For service accounts:** See [Service Account Pattern](../../.claude/patterns/SERVICE_ACCOUNT_CREATION_PATTERN.md)## Role Management**Business Role** (`snowddl/business_role.yaml`):```yamlANALYST_ROLE: comment: "Business analysts with read access" tech_roles: - STRIPE_READER_ROLE warehouse_usage: - MAIN_WAREHOUSE schema_read: - PROJ_STRIPE.ANALYTICS```**Technical Role** (`snowddl/tech_role.yaml`): See grant format in CLAUDE.md "SnowDDL Object Type Reference".## Troubleshooting Quick Fixes| Problem | Fix ||---------|-----|| Schema grant drift (mass REVOKEs) | Use `uv run deploy-safe` instead of raw apply || "Object does not exist" | Ensure using `-r ACCOUNTADMIN` || "Insufficient privileges" | Check `SNOWFLAKE_ROLE=ACCOUNTADMIN` in `.env` || Exit code 8 | Not an error - means changes were applied || User locked out | `ALTER USER USERNAME SET MINS_TO_UNLOCK = 0;` |## Emergency Procedures**Rollback last deployment:**```bashgit checkout HEAD~1 -- snowddl/uv run deploy-safe```**Service account reset:**```bashuv run generate-rsa-batch --users SNOWDDL --forcesnow sql -q "ALTER USER SNOWDDL SET RSA_PUBLIC_KEY='...'"gh secret set SNOWFLAKE_PRIVATE_KEY < new_key.p8```**MFA compliance check:**```bashuv run manage-security --check-mfa```## CI/CD Workflows| Workflow | Trigger | Purpose ||----------|---------|---------|| `ci.yml` | PRs, pushes | Lint + test validation || `release.yml` | Tags `v*` | Create GitHub release || `labeler.yml` | PRs | Auto-label by file type || `changelog.yml` | Push to main | Update changelog |---> Converted and distributed by [TomeVault](https://tomevault.io/claim/database-tycoon) — claim your Tome and manage your conversions.

Frequently asked questions