Metabase (self-hosted) x Snowflake connection issues

[kirill_dovetail]

Hi Team,

We have a self-hosted Metabase (v.0.55.2.2) instance that runs on ECS Fargate. It’s connected to our RDS (Postgres) database. I’m trying to set up a connection to Snowflake, but I am getting an error: “Permission Denied” (logs attached below).

From the actual error code (Failed to connect to Database,java.io.IOException: Permission denied, at java.base/java.io.UnixFileSystem.createFileExclusively0(Native Method)), it looks to me like Metabase is failing to create a temp file with connection credentials, which makes sense, given our AWS policies don’t allow writes to storage from ECS. Still, I wanted to check if anyone else encountered this issue before and if there’s a way to bypass it somehow?

Thank you.

Logs

[845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:50+11:00 INFO metabase.driver.impl Initializing driver :snowflake... [845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:50+11:00 INFO metabase.classloader.impl Added URL file:/plugins/snowflake.metabase-driver.jar to classpath [845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:50+11:00 DEBUG metabase.plugins.init-steps Loading plugin namespace metabase.driver.snowflake... [5c8d5e84-3dfe-4c0f-b144-8aad567cf352] 2025-10-22T10:52:50+11:00 DEBUG metabase.server.middleware.log GET /api/health 200 0ms (0 DB calls) App DB connections: 0/15 Jetty threads: 4/50 (2 idle, 0 queued) (115 total active threads) Queries in flight: 0 (0 queued) {:metabase-user-id nil} [845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:51+11:00 INFO metabase.driver.impl Registered abstract driver :metabase.driver.sql-jdbc.execute.legacy-impl/use-legacy-classes-for-read-and-set [845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:51+11:00 INFO metabase.driver.impl Registered driver :snowflake (parents: [:sql-jdbc :metabase.driver.sql-jdbc.execute.legacy-impl/use-legacy-classes-for-read-and-set]) [5c8d5e84-3dfe-4c0f-b144-8aad567cf352] 2025-10-22T10:52:51+11:00 DEBUG metabase.server.middleware.log GET /api/health 200 0ms (0 DB calls) App DB connections: 0/15 Jetty threads: 4/50 (2 idle, 0 queued) (115 total active threads) Queries in flight: 0 (0 queued) {:metabase-user-id nil} [845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:51+11:00 DEBUG metabase.plugins.jdbc-proxy Registering JDBC proxy driver for net.snowflake.client.jdbc.SnowflakeDriver... [845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:51+11:00 INFO metabase.util Load lazy loading driver :snowflake took 452.3 ms [845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:51+11:00 ERROR metabase.driver.util Failed to connect to Database,java.io.IOException: Permission denied, at java.base/java.io.UnixFileSystem.createFileExclusively0(Native Method), at java.base/java.io.UnixFileSystem.createFileExclusively(Unknown Source), at java.base/java.io.File.createTempFile(Unknown Source), at java.base/java.io.File.createTempFile(Unknown Source), at metabase.secrets.models.secret$value_as_file_STAR_.invokeStatic(secret.clj:251), at metabase.secrets.models.secret$value_as_file_STAR_.doInvoke(secret.clj:236), at clojure.lang.RestFn.invoke(RestFn.java:448), at clojure.lang.AFn.applyToHelper(AFn.java:160), at clojure.lang.RestFn.applyTo(RestFn.java:135), at clojure.core$apply.invokeStatic(core.clj:667), at clojure.core$apply.invoke(core.clj:662), at clojure.core.memoize$through_STAR_$fn__6811.invoke(memoize.clj:110), at clojure.core.cache$through$fn__6533.invoke(cache.clj:55), at clojure.core.memoize$through_STAR_$fn__6807$fn__6808.invoke(memoize.clj:109), at clojure.core.memoize.RetryingDelay.deref(memoize.clj:47), at clojure.core$deref.invokeStatic(core.clj:2337), at clojure.core$deref.invoke(core.clj:2323), at clojure.core.memoize$cached_function$fn__6875.doInvoke(memoize.clj:234), at clojure.lang.RestFn.applyTo(RestFn.java:140) [845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:51+11:00 ERROR metabase.driver.snowflake (type message) => java.lang.String [845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:51+11:00 ERROR metabase.warehouses.api Cannot connect to Database,clojure.lang.ExceptionInfo: Permission denied {:message "Permission denied"}, at metabase.driver.util$can_connect_with_details_QMARK_.invokeStatic(util.clj:151), at metabase.driver.util$can_connect_with_details_QMARK_.doInvoke(util.clj:122), at clojure.lang.RestFn.invoke(RestFn.java:445), at metabase.warehouses.api$test_database_connection.invokeStatic(api.clj:754), at metabase.warehouses.api$test_database_connection.doInvoke(api.clj:744), at clojure.lang.RestFn.invoke(RestFn.java:428), at metabase.warehouses.api$test_connection_details124069__124070.invokeStatic(api.clj:808), at metabase.warehouses.api$test_connection_details124069__124070.invoke(api.clj:788), at metabase.warehouses.api$fn__124077$fn__124083.invoke(api.clj:832), at metabase.api.macros$_core_fn93064__93065$core_fn__93066.invoke(macros.clj:415), at metabase.api.macros$endpoint_handler_STAR_93108__93110$handler__93114.invoke(macros.clj:611), at metabase.api.macros$build_ns_handler93141__93142$ns_handler_STAR___93143.invoke(macros.clj:675), at metabase.api.open_api.HandlerWithOpenAPISpec.invoke(open_api.clj:42), at metabase.api.routes.common$enforce_authentication$fn__115038.invoke(common.clj:91), at metabase.api.open_api.HandlerWithOpenAPISpec.invoke(open_api.clj:42), at metabase.api.util.handlers$_route_map_handler$fn__99775.invoke(handlers.clj:23), at metabase.api.open_api.HandlerWithOpenAPISpec.invoke(open_api.clj:42), at compojure.core$routes$fn__99712$f__99713.invoke(core.clj:198), at compojure.core$routes$fn__99712$f__99713$respond_SINGLEQUOTE___99714.invoke(core.clj:197) [845dce34-e581-43f9-bca7-7d55306d3967] 2025-10-22T10:52:51+11:00 DEBUG metabase.server.middleware.log POST /api/database 400 480ms (0 DB calls) {:metabase-user-id 172} {:message "Permission denied"}

[dwhitemv]

If you disallow writes to the image, you can’t use the ‘upload file’ option for the Snowflake RSA key.

Do one of:

• add the Snowflake RSA key to your image and reference it in the database connection definition
• use password authentication, at least until such time as Snowflake removes the option entirely
• Mount a writable /tmp for Metabase to use. It doesn’t have to be persistent storage (i.e., can use memfs).

A completely read-only image is will require setting an extra environment variable for Metabase 56.10 or later, or notifications that use large queries may not send.

[kirill_dovetail]

Hi Doug,

Thank you for the response. I switched to password authentication and can successfully set up Snowflake database now. However, I get Timed out after 10.0 s error whenever I try to update the connection details, and can’t preview any data neither in the UI or in SQL editor - it keeps loading until it times out.

I couldn’t find anything useful in the logs, except for the error when updating database connection settings:

Logs

[5c8d5e84-3dfe-4c0f-b144-8aad567cf352] 2025-10-24T13:18:05+11:00 ERROR metabase.driver.util Failed to connect to Database,java.util.concurrent.TimeoutException: Timed out after 10.0 s, at metabase.util.jvm$deref_with_timeout.invokeStatic(jvm.clj:291), at metabase.util.jvm$deref_with_timeout.invoke(jvm.clj:283), at metabase.util.jvm$do_with_timeout.invokeStatic(jvm.clj:298), at metabase.util.jvm$do_with_timeout.invoke(jvm.clj:294), at metabase.driver.util$can_connect_with_details_QMARK_.invokeStatic(util.clj:133), at metabase.driver.util$can_connect_with_details_QMARK_.doInvoke(util.clj:122), at clojure.lang.RestFn.invoke(RestFn.java:445), at metabase.warehouses.api$test_database_connection.invokeStatic(api.clj:754), at metabase.warehouses.api$test_database_connection.doInvoke(api.clj:744), at clojure.lang.RestFn.invoke(RestFn.java:428), at metabase.warehouses.api$fn__124419$fn__124425.invoke(api.clj:1248), at metabase.api.macros$_core_fn93064__93065$core_fn__93066.invoke(macros.clj:415), at metabase.api.macros$endpoint_handler_STAR_93108__93110$handler__93114.invoke(macros.clj:611), at metabase.api.macros$build_ns_handler93141__93142$ns_handler_STAR___93143.invoke(macros.clj:675), at metabase.api.open_api.HandlerWithOpenAPISpec.invoke(open_api.clj:42), at metabase.api.routes.common$enforce_authentication$fn__115038.invoke(common.clj:91), at metabase.api.open_api.HandlerWithOpenAPISpec.invoke(open_api.clj:42), at metabase.api.util.handlers$_route_map_handler$fn__99775.invoke(handlers.clj:23), at metabase.api.open_api.HandlerWithOpenAPISpec.invoke(open_api.clj:42) [5c8d5e84-3dfe-4c0f-b144-8aad567cf352] 2025-10-24T13:18:05+11:00 ERROR metabase.driver.snowflake (type message) => java.lang.String [5c8d5e84-3dfe-4c0f-b144-8aad567cf352] 2025-10-24T13:18:05+11:00 ERROR metabase.warehouses.api Cannot connect to Database,clojure.lang.ExceptionInfo: Timed out after 10.0 s {:message "Timed out after 10.0 s"}, at metabase.driver.util$can_connect_with_details_QMARK_.invokeStatic(util.clj:151), at metabase.driver.util$can_connect_with_details_QMARK_.doInvoke(util.clj:122), at clojure.lang.RestFn.invoke(RestFn.java:445), at metabase.warehouses.api$test_database_connection.invokeStatic(api.clj:754), at metabase.warehouses.api$test_database_connection.doInvoke(api.clj:744), at clojure.lang.RestFn.invoke(RestFn.java:428), at metabase.warehouses.api$fn__124419$fn__124425.invoke(api.clj:1248), at metabase.api.macros$_core_fn93064__93065$core_fn__93066.invoke(macros.clj:415), at metabase.api.macros$endpoint_handler_STAR_93108__93110$handler__93114.invoke(macros.clj:611), at metabase.api.macros$build_ns_handler93141__93142$ns_handler_STAR___93143.invoke(macros.clj:675), at metabase.api.open_api.HandlerWithOpenAPISpec.invoke(open_api.clj:42), at metabase.api.routes.common$enforce_authentication$fn__115038.invoke(common.clj:91), at metabase.api.open_api.HandlerWithOpenAPISpec.invoke(open_api.clj:42), at metabase.api.util.handlers$_route_map_handler$fn__99775.invoke(handlers.clj:23), at metabase.api.open_api.HandlerWithOpenAPISpec.invoke(open_api.clj:42), at compojure.core$routes$fn__99712$f__99713.invoke(core.clj:198), at compojure.core$routes$fn__99712$f__99713$respond_SINGLEQUOTE___99714.invoke(core.clj:197), at metabase.api_routes.routes$fn__124474.invokeStatic(routes.clj:97), at metabase.api_routes.routes$fn__124474.invoke(routes.clj:96)

It looks like something is wrong with our instance setup, but I just wanted to confirm if maybe somebody else encountered it?

Thank you!

[dwhitemv]

Now you need to allow the task to connect to the RDS servers. Check your security groups.

[Stefano]

Hello @dwhitemv ! @kirill_dovetail ‘s teammate here – subscribing to this thread. Regarding this point:

A completely read-only image is will require setting an extra environment variable for Metabase 56.10 or later, or notifications that use large queries may not send.

We are on 0.55.2.2, but just for clarity could you explain this a bit more? What environment variable are you referring to?

[Luiggi]

HEADS UP: 56.10 new size limit on notification queries

Thanks for the heads up @dwhitemv! One minor correction - to keep the old behavior, you should set MB_NOTIFICATION_TEMP_FILE_SIZE_MAX_BYTES to 0. The variable MB_ENFORCE_NOTIFICATION_TEMP_FILE_SIZE_LIMIT briefly existed in the PR that shipped this feature, but it did not make it to the release. We strongly recommend against this though, since it can easily make Metabase go into a crash loop if it has a particularly expensive query that makes it run out of memory. Returning less data or a summar…

[kirill_dovetail]

Hi @dwhitemv and @Luiggi, thank you.

I should have clarified that Metabase can query from Snowflake, just very slowly. It can query tables that are less than a few hundred rows, but times out for anything larger than that. For example, if a query returns 100 rows and takes ~300ms directly in Snowflake, it takes around ~30s in Metabase. I can see that the actual query sent from Metabase to Snowflake completes normally within Snowflake, and the extra 30s come from Metabase processing the response.

That makes me think it’s not the networking issue. Attached is the screenshot of a query Metabase generates when I click to preview a table in its UI - Snowflake returns the results in 1.6s but Metabase processes them for over 3 mins, after which it times out.

At the same time, Metabase can query the RDS Postgres database just fine without any noticeable delay.

Have you encountered anything like that before? We’re trying to work it out with our infrastructure team, but so far without success.

[dwhitemv]

What are the compute requirements you listed in in the task definition?

You might be under-resourcing Metabase and its going into OOM hell trying to do basic things.

[kirill_dovetail]

We’re running 2 ECS tasks, each with 4 CPUs and 16GBs of memory.

We upgraded Metabase to v0.56.11.3 with the new env variables as described above, but it didn’t change anything.

Still searching for possible root causes for this.

[dwhitemv]

By the way, does that timing from Snowflake count the time it takes to spin up the compute node(s)? Snowflake can shut down your compute if there’s 10 minutes of idle time and I’ve heard it can take a while for it to start up on the next query. No personal experience here, but something to think about. This seems more likely if you reload the question/dashboard and the query completes in reasonable/expected time.

[kirill_dovetail]

It doesn’t include the time to start the compute node, but both Snowflake and Metabase timings are calculated for a pre-started node. Both calculations use the same warehouse and overall Metabase uses the same compute resources as our control environment. Unfortunately, reloading the questions or dashboards doesn’t change anything either

[dwhitemv]

Hm, well at this stage we need to know what Metabase is doing between when the query is completed and the data is sent to your browser.

Do you have any performance statistics from the container? Can you exec into the task and run top and see if the CPU is pegging during that time?

Any log output from Metabase?