How to create an Amazon QuickSight Snowflake data source using RSA key-pair authentication via AWS CLI/API?

Q&A
,
1

We are automating the migration of QuickSight assets across AWS environments using QuickSight Asset Bundles and GitLab CI/CD.

Our Snowflake connection uses RSA key-pair authentication rather than username/password authentication.

We retrieve the Snowflake username, private key, and private-key passphrase securely from AWS SSM Parameter Store and Secrets Manager. However, when attempting to create the Snowflake data source using aws quicksight create-data-source, we receive:



Unknown parameter in DataSourceParameters.SnowflakeParameters:
"AuthenticationType", must be one of: Host, Database, Warehouse

Unknown parameter in Credentials:
"KeyPairCredentials", must be one of:
CredentialPair, CopySourceArn, SecretArn

Our GitLab runner currently uses:



aws-cli/2.13.8

We also checked the CLI input skeleton, and KeyPairCredentials is not available in this version.

Questions:

  1. Is Snowflake RSA/key-pair authentication supported when creating or updating a QuickSight data source through the AWS CLI/API?
  2. If yes, which AWS CLI version/API model supports KeyPairCredentials?
  3. If key-pair credentials cannot be supplied through Asset Bundle import credential overrides, what is the recommended approach for automated DEV → QA → PROD QuickSight deployments using Snowflake key-pair authentication?
    We would like to keep the deployment fully automated and avoid manually configuring the Snowflake connection in each QuickSight environment.

I have added a capability check in the pipeline, and the current runner returns KEYPAIR_SUPPORTED=false. Can someone please help me what needs to be done?

2

Hi @dsahu

Welcome back to the Quick community!

Thank you for the detailed write-up, it really helped in diagnosing this quickly. Snowflake key-pair authentication is supported in Quick Suite, and the errors you’re seeing most likely trace back to the AWS CLI version on your GitLab runner being too old to recognize the feature. It doesn’t appear to be a gap on the Quick Suite service side.

Here are the answers:

  1. Yes. Quick Suite added key-pair authentication for Snowflake data sources as a generally available feature (announced by AWS on 19 February 2026), and it works through both the console and the CLI/API.

  2. Your runner is on aws-cli/2.13.8, a 2023 build that predates this feature, so it won’t contain the updated quicksight model. We recommend upgrading to the latest AWS CLI v2 release (and, if your pipeline uses an SDK such as boto3/botocore or the Java SDK, upgrading those to a current version as well, since they carry the same model). After upgrading, you can confirm the field is available before running the pipeline:

  3. Asset Bundle import credential overrides do not accept a raw KeyPairCredentials block. The AssetBundleImportJobDataSourceCredentials structure supports only CredentialPair or SecretArn.

Please refer the following official documentation, which might be helpful for you.

3

Hi @dsahu,

It’s been a while since we last heard from you, did you have any additional or follow up questions regarding your initial topic? Were you able to try out the second approach that was shared?

If we do not hear back within the next 3 business days, I’ll go ahead and mark the solution to close out/archive the topic.

Thank you!

4

Hi @dsahu,

Since we have not heard back from you, I’ll go ahead and close/archive this topic. However, if you have any additional questions, feel free to create a new topic in the community and link this discussion for relevant information.

Thank you!

5

Thank you so much @Xclipse for your response. We worked on upgrading to the latest CLI and it worked wonderfully! Appreciate your response, and apologies for not letting you know it worked so well! Now we are at the PROD migration stage! All because of your help and response. Thank you!!