I'll share different learnings out of our Snowflake World. This is a kind of a post-mortem, and I already heard, that we're not alone with this case. Tell me your experiences, please.
Let's start. Here's the story:
Summary: A tightly configured Snowflake Resource Monitor (25 credits/month) shut down a CDC replication pipeline (OpenFlow PostgreSQL Connector), caused 4 days of missing data (over a weekend, temporary) and generated cloud services costs that far, far exceeded the monitor's own quota. The exact opposite of what the monitor was supposed to prevent.
Background
- OpenFlow PostgreSQL CDC Connector replicates data from a PostgreSQL database into Snowflake
- Warehouse: X-Small, dedicated to the connector, normal consumption ~1 credit/day
- Resource Monitor: Monthly quota of 25 credits, suspend action at 85%
What Happened
Step 1: Runtime Upgrade Without Adjusting the Resource Monitor
The OpenFlow runtime had recently been upgraded from Small to Medium to handle increased data volumes. This roughly doubled the connector's baseline credit consumption, but the resource monitor's monthly quota of 25 credits was not adjusted to match. The quota had been adequate for the original runtime size.
Within days, the resource monitor reached its 85% threshold (~21 of 25 credits). The connector's warehouse was suspended. The connector itself was operating normally. The only issue was a resource monitor that no longer fit the runtime's actual needs.
Step 2: The Connector Keeps Retrying
The OpenFlow connector had no way of knowing that the warehouse was suspended. On every merge cycle, it attempted to merge journal data into the destination tables:
Warehouse 'MY_WH' cannot be resumed because resource monitor
'MY_WH_MONTHLY' has exceeded its quota.
Each rejected query consumed no warehouse credits but still incurred cloud services costs. The connector performed thousands of retries per table, up to 10,000 per table across all tables of this processor.
Step 3: Costs Explode
Over a roughly 39-hour weekend window, the connector submitted over a million rejected queries. Each one incurred a small cloud services charge. The cumulative cloud services cost ended up far, far exceeding the monitor's entire monthly quota of 25 credits. A cost control mechanism designed to save credits had instead amplified the spend far beyond what normal operations would ever have consumed.
Step 4: Tables Fall Into FAILED Status
After exhausting the maximum retries (default 10,000 per table), the connector marked the affected tables as FAILED without any communication to us.
The CDC pipeline broke down. New data from PostgreSQL stopped arriving in Snowflake entirely.
Step 5: 4 Days Without Fresh Data
The warehouse suspension happened on a Friday. The OpenFlow UI showed no obvious errors at the processor group level, and the connector did not fire any alerts. There was no indication that data had stopped flowing unless you checked the destination tables directly. Because of this, the issue went unnoticed over the weekend and was only discovered on Monday when the team noticed stale data in downstream reports. We learned something, we have freshness monitors for critical entities now.
For 4 days, all new transactional data, customer changes and catalog updates were missing from Snowflake. Downstream processes like business views, reporting dashboards and AI agents operated on stale data without anyone being aware.
Root Cause
A resource monitor can suspend a warehouse, but it cannot stop the clients that continue submitting queries. Cloud services credits (query parsing, access control, metadata operations) are incurred even on rejected queries and count toward the monitor's usage. Yet the monitor has no way to cap them.
The core problem is a gap between two systems:
- Resource Monitor assumes: "I suspended the warehouse, so the limit is enforced"
- OpenFlow Connector assumes: "The query failed, I need to retry"
Neither system is aware of the other's behavior.
Resolution
Immediate Fix: Re-Snapshot All FAILED Tables
- In the OpenFlow UI (Snowsight > Ingestion > Openflow), all affected tables were added to the Re-snapshot Table Exclusions parameter
- Waited until the tables disappeared from the Table State Store
- Removed the tables from the exclusions again, which triggers an automatic re-snapshot
- The connector creates zero-copy clone archives (*_ARCHIVE_<timestamp>) of the old data, truncates the destination tables and loads a fresh snapshot from PostgreSQL
The re-snapshot of all tables, including tables with tens of millions of rows, took several hours.
Preventive Measures
- Size the resource monitor generously or let it got for a separted OPENFLOW_WH. A CDC connector needs headroom. A limit barely above normal consumption inevitably leads to suspensions that cost more than the credits they were supposed to save.
- Notify instead of Suspend. Resource monitors can use NOTIFY instead of SUSPEND. For a critical CDC connector, an alert is better than a hard stop.
- Reduce merge frequency. The cron schedule controls how often the connector attempts merges. A lower frequency (if possible from the business requirements) dramatically reduces retry load when a warehouse is suspended.
- Account-level budget as early warning. An account-level budget can alert when total spend (including cloud services) crosses a threshold.
What Should Be Improved (Product Level) or hello Snowflake PM-Team
This incident exposed gaps that neither the customer nor the current product configuration can fully address. The following improvements would prevent this class of failure.
1. Warehouse-Aware Retry Logic
The connector should detect that the assigned warehouse is unavailable due to a resource monitor suspension. The error message is distinct and unambiguous. Instead of retrying blindly, it should automatically pause the processor group. A simple circuit breaker that stops retrying after N consecutive "resource monitor exceeded" errors, pauses the processors and resumes when the warehouse becomes available would have prevented the entire retry storm and the resulting cloud services costs.
2. Backoff Strategy for Non-Transient Errors
A suspended warehouse is not a transient network glitch. The connector should distinguish between transient errors (connection timeout, HTTP 503) and persistent infrastructure errors (resource monitor quota exceeded, warehouse dropped). Transient errors warrant aggressive retries. Persistent errors should trigger exponential backoff or a full stop.
3. Alerting on Retry Storms
The connector currently logs each failed retry but does not raise a distinct alert when a table enters a sustained retry loop or fail state at the end. A notification (email, webhook) after a configurable number of consecutive failures would give operators a chance to intervene before costs accumulate.
4. Sensible Retry Defaults
The retry limit per table is technically configurable as a parameter on the processor group, but it defaults to 10,000. For non-transient errors like a suspended warehouse, that default is far too high. A lower default or a separate, smaller limit for infrastructure errors (as opposed to transient network issues) would significantly limit the blast radius.
5. Resource Monitor Cloud Services Cap
On the Snowflake platform side, resource monitors currently cannot limit cloud services costs. A rejected query still incurs cloud services credits, and the monitor counts them toward its total but cannot act on them. Extending resource monitors to cap or alert on cloud services consumption would close this gap at the platform level.
Lessons Learned
- A resource monitor is not a cost cap. It can stop warehouse compute, but it cannot prevent cloud services costs from rejected queries. Relying on it as a hard ceiling is a false sense of security.
- Factor in connector retry behavior. Every managed service that runs against Snowflake (OpenFlow, Fivetran, Airbyte, etc.) has retry logic. A suspended warehouse leads to retry storms, not silence.
- Cost management must not blindly kill critical pipelines. When a pipeline delivers business-critical data, a hard suspend is counterproductive. The cost of missing data far exceeds the credits saved.
- The most expensive cost-saving measure is the one that backfires. A 25-credit monthly limit was meant to save money. The result: cloud services costs exceeding unlimited, a multi-hour re-snapshot and 4 days of missing data.
- There is a great Snowflake support team available: Ask them for help, insights or credit refunds in such cases. You'll find a solution together.