Connect Your Data Warehouse

# Generate an unencrypted PKCS#8 RSA private key
openssl genrsa 2048 | openssl pkcs8 -topk8 -nocrypt -out platinur_rsa_key.p8

# Extract the matching public key
openssl rsa -in platinur_rsa_key.p8 -pubout -out platinur_rsa_key.pub

ALTER USER PLATINUR_SVC
  SET RSA_PUBLIC_KEY = '<contents of platinur_rsa_key.pub, without the BEGIN/END header lines>';

-- Virtual warehouse
CREATE WAREHOUSE IF NOT EXISTS PLATINUR_WH
  WAREHOUSE_SIZE = 'X-SMALL'
  AUTO_SUSPEND   = 60
  AUTO_RESUME    = TRUE
  INITIALLY_SUSPENDED = TRUE;

-- Target database
CREATE DATABASE IF NOT EXISTS PLATINUR;

-- Dedicated role
CREATE ROLE IF NOT EXISTS PLATINUR_ROLE;

-- Service user — key-pair only (no password). TYPE = SERVICE marks it a non-human
-- automation user that cannot use a password or MFA. Register its public key with the
-- `ALTER USER ... SET RSA_PUBLIC_KEY` statement from the "Key-pair auth" step above.
CREATE USER IF NOT EXISTS PLATINUR_SVC
  TYPE              = SERVICE
  DEFAULT_ROLE      = PLATINUR_ROLE
  DEFAULT_WAREHOUSE = PLATINUR_WH;

-- Warehouse usage
GRANT USAGE ON WAREHOUSE PLATINUR_WH TO ROLE PLATINUR_ROLE;

-- Full ownership of the target database so Platinur can manage schemas
GRANT OWNERSHIP ON DATABASE PLATINUR TO ROLE PLATINUR_ROLE COPY CURRENT GRANTS;

-- Read access to each source database Platinur should model from.
-- Repeat the three lines below for every source database.
-- GRANT USAGE ON DATABASE <your_source_db> TO ROLE PLATINUR_ROLE;
-- GRANT USAGE ON ALL SCHEMAS IN DATABASE <your_source_db> TO ROLE PLATINUR_ROLE;
-- GRANT SELECT ON ALL TABLES IN DATABASE <your_source_db> TO ROLE PLATINUR_ROLE;

-- Bind role to user
GRANT ROLE PLATINUR_ROLE TO USER PLATINUR_SVC;

PROJECT_ID="<project-id>"
SA_NAME="platinur-svc"
SA_EMAIL="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"
STAGING_BUCKET="gs://my-platinur-staging"

# Create the service account
gcloud iam service-accounts create "${SA_NAME}" \
  --display-name="Platinur service account" \
  --project="${PROJECT_ID}"

# BigQuery: create/update datasets and tables
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
  --member="serviceAccount:${SA_EMAIL}" \
  --role="roles/bigquery.dataEditor"

# BigQuery: run queries and load jobs
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
  --member="serviceAccount:${SA_EMAIL}" \
  --role="roles/bigquery.jobUser"

# GCS: read and write load-staging files
gcloud storage buckets add-iam-policy-binding "${STAGING_BUCKET}" \
  --member="serviceAccount:${SA_EMAIL}" \
  --role="roles/storage.objectAdmin"

# Download the JSON key — paste its contents into the form field
gcloud iam service-accounts keys create platinur-svc-key.json \
  --iam-account="${SA_EMAIL}" \
  --project="${PROJECT_ID}"

-- Create a dedicated catalog for Platinur
CREATE CATALOG IF NOT EXISTS platinur
  COMMENT 'Platinur analytics engineering output';

-- Grant the service principal (or the user whose PAT you use) access to the catalog.
-- Replace <principal> with the service principal application ID or user email.
GRANT USE CATALOG  ON CATALOG platinur TO `<principal>`;
GRANT CREATE SCHEMA ON CATALOG platinur TO `<principal>`;
GRANT USE SCHEMA   ON CATALOG platinur TO `<principal>`;
GRANT CREATE TABLE  ON CATALOG platinur TO `<principal>`;
GRANT MODIFY       ON CATALOG platinur TO `<principal>`;

-- Create a schema and managed volume for dlt staging (preferred)
CREATE SCHEMA IF NOT EXISTS platinur.staging;

CREATE VOLUME IF NOT EXISTS platinur.staging.dlt
  COMMENT 'dlt load-file staging for Platinur Integrations';

GRANT READ VOLUME  ON VOLUME platinur.staging.dlt TO `<principal>`;
GRANT WRITE VOLUME ON VOLUME platinur.staging.dlt TO `<principal>`;

-- Grant read access to source catalogs/schemas Platinur should model from.
-- Repeat for each source schema.
-- GRANT USE CATALOG ON CATALOG <source_catalog> TO `<principal>`;
-- GRANT USE SCHEMA  ON SCHEMA  <source_catalog>.<source_schema> TO `<principal>`;
-- GRANT SELECT ON ALL TABLES IN SCHEMA <source_catalog>.<source_schema> TO `<principal>`;

-- Create the Platinur service user
CREATE USER PLATINUR_SVC
  PASSWORD '<choose-a-strong-password>'
  CONNECTION LIMIT 10;

-- Allow the user to create schemas in the target database.
-- Platinur manages its own output schemas (stg_staging, stg_dw, stg_marts, etc.).
GRANT CREATE ON DATABASE analytics TO PLATINUR_SVC;

-- Grant read access to source schemas Platinur should model from.
-- Repeat for each schema containing raw source tables.
-- GRANT USAGE ON SCHEMA <source_schema> TO PLATINUR_SVC;
-- GRANT SELECT ON ALL TABLES IN SCHEMA <source_schema> TO PLATINUR_SVC;
-- ALTER DEFAULT PRIVILEGES IN SCHEMA <source_schema>
--   GRANT SELECT ON TABLES TO PLATINUR_SVC;

{
  "confirm": "RESET",
  "drop_warehouse_objects": false
}