Connect a database

CREATE USER summand_reader WITH PASSWORD '<strong-password>';
GRANT CONNECT ON DATABASE your_db TO summand_reader;
GRANT USAGE ON SCHEMA public TO summand_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO summand_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO summand_reader;

CREATE ROLE summand_reader;
GRANT USAGE ON WAREHOUSE compute_wh TO ROLE summand_reader;
GRANT USAGE ON DATABASE your_db TO ROLE summand_reader;
GRANT USAGE ON SCHEMA your_db.public TO ROLE summand_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA your_db.public
  TO ROLE summand_reader;
GRANT SELECT ON FUTURE TABLES IN SCHEMA your_db.public
  TO ROLE summand_reader;
CREATE USER summand_user PASSWORD = '<strong-password>'
  DEFAULT_ROLE = summand_reader;
GRANT ROLE summand_reader TO USER summand_user;

​

Performance tips

• Limit row count for huge tables. A 100M-row table will take a long time to refresh. If you only need a representative sample, create a database view that samples or filters, and point Summand at the view.
• Pre-aggregate via Summand views. If multiple experiments target the same cohort, define the cohort once as a view and point experiments at the view rather than re-filtering in each component.
• Refresh during off-peak hours. A refresh is a single full table read. For warehouses with concurrent workloads, schedule analysis around your peak.

​

Security review checklist

• ✓ Read-only credentials, scoped to the schemas you grant
• ✓ Credentials stored encrypted in AWS Secrets Manager (KMS-backed)
• ✓ TLS required for all database connections; cert validation enforced
• ✓ Egress from a fixed IP range we publish
• ✓ No write paths exist in code — SELECT-only is a hard property of the connector, not a configuration
• ✓ Audit log entries for every connector create / update / delete (Enterprise tier)