Daily Snowflake Cost Monitor: FinOps Alerts in Slack

Every weekday at 8am in my local timezone, run a Snowflake cost watchdog and post a single prioritized brief to my Slack channel #data-finops so I can act before the monthly bill arrives.

Use the Snowflake Execute SQL Statement action against the SNOWFLAKE.ACCOUNT_USAGE views. Pull the data you need from WAREHOUSE_METERING_HISTORY (credit consumption per warehouse over time), QUERY_HISTORY (per-query execution time, credits used, user, warehouse, query text fingerprint), and STORAGE_USAGE (database and stage storage in bytes). Run separate aggregations for three windows: the trailing 24 hours, the trailing 7 days, and the current month to date. Always qualify the database as SNOWFLAKE.ACCOUNT_USAGE and remember Snowflake uppercases unquoted identifiers.

Then reason about the results. Identify which warehouses and which users are driving the most credit consumption. Pick the top expensive queries by total credits and by execution time, and group near-duplicate queries by query hash so a runaway report does not list the same statement ten times. Compare yesterday's credit burn per warehouse against the trailing 14 day median and flag anything more than 2x baseline as anomalous. Project month-to-date spend out to end of month using a simple run rate and compare it to my configured monthly credit budget. If the projection exceeds the budget, say so explicitly with the expected overage.

Specifically watch for three classes of waste and surface the worst offender in each: oversized warehouses (a warehouse on size L or larger whose average query runs in under 10 seconds, suggesting it could be downsized), runaway queries (single queries or query fingerprints that burned more than the configurable per-query credit threshold in the last 24 hours), and idle warehouses with no auto-suspend or an auto-suspend over 10 minutes (look up AUTO_SUSPEND from SHOW WAREHOUSES or INFORMATION_SCHEMA.WAREHOUSES).

Finally, use the Slack Bot Send a Message action to post one message to #data-finops. The message should lead with a one-line headline (for example: 'On pace for 1,420 credits this month, 18% over the 1,200 budget'), then list the top 3 cost-saving recommendations as bullets. Each bullet must name the specific warehouse, user, or query fingerprint and end with a one-line concrete action I can take, like 'Downsize ANALYTICS_WH from L to M (avg query 4.2s, saved ~120 credits/mo)' or 'Add AUTO_SUSPEND=60 to LOAD_WH (24 idle minutes/day = ~85 credits/mo)'. Keep the formatting in Slack mrkdwn (single asterisks for bold, no double asterisks). If nothing crosses the thresholds, post a short 'all clear' message with the current month-to-date totals instead of skipping the run, so I know the workflow is healthy.

Make these configurable as workflow inputs: the Slack channel name, the list of warehouses to include or exclude, the monthly credit budget, the per-credit dollar rate (optional, for dollarized output), the runaway-query credit threshold, the anomaly multiplier versus baseline, and the run time and timezone. Default to covering every warehouse on the account if no allow/deny list is provided.

Additional information

What does this prompt do?

Reads your Snowflake usage every morning and totals credits spent by warehouse for yesterday, the last seven days, and month to date.
Picks out the top expensive queries and the users behind them, then flags anything that looks unusual versus the recent baseline.
Projects whether you are on pace to blow your monthly Snowflake budget and warns you early.
Posts one clean Slack message with the three highest-impact cost savings to act on today, each with the warehouse or query name and a one-line fix.

What do I need to use this?

A Snowflake account where you can read account usage data (an admin or accountadmin role works best).
A Slack workspace and the channel you want the daily summary posted to.
A rough monthly Snowflake credit or dollar budget so the agent can tell you when you are off track.

How can I customize it?

Change the schedule, the Slack channel, or who gets tagged when a warning fires.
Set your monthly budget and the credit thresholds that count as a runaway warehouse or query.
Limit the report to specific warehouses, environments, or business units instead of every warehouse on the account.

Frequently asked questions

Will this actually save me money?

It surfaces the three highest-impact savings every morning, things like oversized warehouses, queries burning credits, and idle warehouses without auto suspend. Acting on even one a week typically pays for itself.

Do I need to be an accountadmin in Snowflake?

You need a role that can read the account usage views. Accountadmin works out of the box. A custom role with usage on the SNOWFLAKE.ACCOUNT_USAGE schema also works if your team prefers least privilege.

How do I change which Slack channel it posts to?

Edit the workflow and swap the channel name. You can also point it at a private channel as long as the Slack bot has been added to that channel.

Can I track multiple warehouses or only one?

By default it covers every warehouse on the account. You can give it a list of warehouse names to focus on, or exclude dev and sandbox warehouses if you only want production reported.

What if my bill is in dollars, not credits?

Set your per credit rate when you configure the workflow. The agent will translate credit totals into dollar estimates and project your end of month spend.