Frequently asked questions

Advanced

Installation

Where is the Posit Team Native App available?

The Posit Team Native App is available in any region where Snowflake offers Snowpark Container Services. The Snowflake documentation describes the set of supported regions and their limitations.

Do I need to run all Posit Team products?

No. The Posit Team Native App lets you choose which of the Posit products to install and manage. You need a license only for the products you choose to run. Additionally, your initial choice is not permanent. You can start with Workbench and then later add Connect.

What are the requirements to install the Posit Team Native App?

  • You need the ACCOUNTADMIN role or a custom role with equivalent privileges. See installation prerequisites for specific privilege requirements.
  • No license is required to install the Native App or start a product. Each product offers a free 30-day self-service trial. To keep using a product past its trial, you need a Posit Team Advanced tier license for that product. Contact snowflakemarketplace@posit.co to purchase one.

How much does the Posit Team Native App cost?

The Native App incurs the following variable and fixed costs:

  1. Posit Team Advanced tier license: A license is required per product past its free 30-day trial. See pricing for more information.

  2. Compute resources: The Posit Team Native App itself runs on a small compute pool for the landing page. Each product you activate runs on its own additional compute pool, whose instance family you choose. You control the compute resources each pool uses, and can suspend or resize a product’s compute pool at any time. Snowflake has a wide variety of instance sizes. For more information, see the Snowflake Create Compute Pool documentation.

  3. Infrastructure costs: Each product incurs a minimal fixed infrastructure cost, including the application warehouse and the block volume storage that product uses.

Authentication

How can I reduce repeated Snowflake sign-in prompts?

Users authenticate with Snowflake in two places:

  • When opening a product URL. Posit Team runs several Snowpark Container Services (SPCS) ingress endpoints: the landing page and each product URL for Workbench, Connect, and Posit Package Manager. Each endpoint shows a Snowflake sign-in page where users select their identity provider before continuing.
  • During the OAuth flow. Workbench-managed credentials and Connect viewer integrations authorize through the standard Snowflake sign-in page.

Most organizations sign in to Snowflake with single sign-on (SSO) through an identity provider such as Okta, Microsoft Entra ID, or Ping Identity. Snowflake configures this SSO as a SAML2 security integration. If your account works this way, set the LOGIN_IDP_REDIRECT account parameter so Snowflake redirects users straight to your identity provider instead of showing its own sign-in page:

Snowsight UI
ALTER ACCOUNT SET LOGIN_IDP_REDIRECT = (
  DEFAULT = my_saml_integration,
  SPCS = my_saml_integration
);
  • SPCS redirects the ingress sign-in page shown when users open the landing page or a product URL. This removes the most common prompt for Posit Team users.
  • DEFAULT redirects the standard Snowflake sign-in page, including the OAuth authorization flow used by managed credentials, which users encounter less often.

Set either key on its own, or both. Setting LOGIN_IDP_REDIRECT replaces the entire mapping, so include every key you want to keep in each statement. The referenced security integration must exist and be enabled, and the command requires the ACCOUNTADMIN role. Keep a backup sign-in method, such as a password with multi-factor authentication (MFA), for at least one account administrator.

Is MFA supported?

Yes. Multi-factor authentication (MFA) is supported. Posit Team relies on your account’s existing authentication methods, including MFA, for ingress and OAuth integration.

Is FIDO2 authentication supported?

Snowflake Authentication does not support Fast Identity Online 2 (FIDO2). However, it supports various methods detailed in the Snowflake Authentication docs.

Security

Does my data leave Snowflake?

No. Data accessed within Posit Team remains within Snowflake unless explicitly sent outside via egress. All egress is controlled by network rules detailed in the Snowflake Network Policies Guide.

What is the default egress policy for the Posit Team Native App?

The default is an open egress policy that you can restrict. See Security for the default egress endpoints per product and steps to reduce them, including hosting Package Manager internally and using Private Link to remove public egress entirely.

Can I connect to external databases or resources exposed within my private network?

Yes. You can connect to external data using a variety of methods including:

  • Expose the external database or connection to the public internet, and allow egress to the host:port of your data.
  • Use a Snowflake connector or third-party connector (for example, Fivetran) to move your data into a Snowflake database and access it directly.
  • If you use AWS PrivateLink or Azure Private Link, configure outbound connectivity to reach resources in your VPC or VNet directly, without exposing them to the public internet.

Networking

Why do requests stop after 90 seconds?

Snowpark Container Services (SPCS) enforces a 90-second ingress connection timeout. Because users reach Posit Team through ingress endpoints, this limit applies to everything hosted by the Native App.

The 90-second limit applies to the time it takes for the endpoint to complete the response. Incrementally sending data back to the client does not keep the connection open. Snowflake closes a streaming response after about 90 seconds even if it is actively sending data. Time spent uploading the request does not count toward the limit.

The timeout most often affects content published to Connect that takes a long time to respond. An API endpoint that runs a lengthy query and then returns a response is a common example.

Snowflake can extend the ingress timeout for an individual account, up to a limit of a few minutes. Open a support case with Snowflake requesting a higher ingress timeout for your account.

You might be able to avoid the ingress timeout by using a WebSocket or obtaining incremental results through polling. If your task does not need to be computed on demand, perform the work on a schedule in Connect, then load previously computed results.

Functionality

Which version of each product is installed?

The Posit Team Native App includes recent stable releases of Workbench, Connect, and Package Manager, though not always the most recent. Each release is listed in the release notes.

How do I add additional packages or software?

Workbench and Connect use the internal Package Manager automatically when it is installed, without requiring egress configuration. If Package Manager is not installed, users can install R and Python packages via CRAN, PyPI, and the public Posit Package Manager mirror, assuming internet access is configured via egress policies. Adding system dependencies requires contacting Posit support.

Does the Native App automatically scale or suspend?

Posit Team can automatically suspend Workbench after a period with no active sessions; see Automatic suspension.

You can also manually stop, start, or restart any product with a stored procedure. To stop and start Workbench, for example:

Snowsight UI
SELECT POSIT_TEAM.app.STOP_SERVICE('workbench', FALSE);
SELECT POSIT_TEAM.app.START_SERVICE('workbench');

See the Workbench, Connect, and Package Manager documentation for details about additional management commands.

Can I resize the product compute pools for larger workloads?

Yes. The Manage page for each product lets you change the compute pool instance family. See the Workbench, Connect, and Package Manager documentation for product-specific guidance.

Can I resize the storage associated with a product?

Yes. Each product stores its data on a block volume, and you can increase the size of that volume from the Manage page for that product. Storage can only grow. See the Workbench, Connect, and Package Manager documentation for details.

What can I do if a product service is stuck in a PENDING state?

If a product service is stuck in a PENDING state after a restart (30 minutes or longer), the following options might help it recover:

  • Select a different instance family for the compute pool.

    If you are using an older instance family, try moving to a current generation instance family. If you are using a smaller instance family, try moving to a slightly larger instance family. The Snowflake documentation explains all of the available instance families.

  • Stop the service, wait for it to suspend, then start it.

    Use the STOP_SERVICE('workbench', FALSE) SQL command to stop the product. Wait for it to fully suspend, then start it again. The FALSE argument tells Snowflake not to let user activity auto-resume the service before you explicitly start it.

  • Create a backup of the service, then restore it.

    The Manage page lets you create a backup of the product. Create a backup, wait for it to complete, then restore from that backup. See Backup and restore.

When a product service is stuck in a PENDING state, Snowflake might report a CAPACITY_ERROR. This error does not always represent a true capacity problem and might indicate some other service provisioning failure. These options help recover from a number of different scenarios.

Please submit a request through the Posit support form when you encounter this problem. We can work with Snowflake to understand the exact reason, and this investigation helps us improve Posit Team and SPCS.

How does the Posit Team Native App deal with disaster recovery?

The Posit Team Native App uses Snowpark Container Services (SPCS), which does not support disaster recovery across regions.

To protect your code, push it to Git remote repositories. Store sensitive data in Snowflake databases, which Snowflake protects.

For the product services, Posit Team automatically backs up each product about once per week and keeps the four most recent backups. Each backup is a Snowflake snapshot. See the Workbench, Connect, and Package Manager documentation for details.

Back to top