Monitoring Cortex Spend: Usage Views, Compute Pools, Alerts and Tag-Based Budgets

1.Which usage view answers which question

Snowflake records Cortex consumption in several ACCOUNT_USAGE views. Each view covers one service at its own level of detail. Monitoring starts with picking the right one. METERING_DAILY_HISTORY, filtered to SERVICE_TYPE = 'AI_SERVICES', gives the account-wide total. The service-specific views then show where those credits went.

Watch the gaps between views. CORTEX_AISQL_USAGE_HISTORY records usage in the hour the query completed. It does not include AI_PARSE_DOCUMENT, so use CORTEX_AI_FUNCTIONS_USAGE_HISTORY when you need every function. The Search daily view does not yet include the warehouse that runs refreshes, so check warehouse metering for that part. CORTEX_FUNCTIONS_QUERY_USAGE_HISTORY breaks down a single query with one row per model. The query below finds the functions and models behind a spike:

SELECT
    DATE_TRUNC('day', START_TIME) AS usage_date,
    FUNCTION_NAME,
    MODEL_NAME,
    SUM(CREDITS) AS total_credits,
    COUNT(DISTINCT QUERY_ID) AS query_count
FROM SNOWFLAKE.ACCOUNT_USAGE.CORTEX_AI_FUNCTIONS_USAGE_HISTORY
WHERE START_TIME >= DATEADD('day', -30, CURRENT_TIMESTAMP())
GROUP BY 1, 2, 3
ORDER BY usage_date DESC, total_credits DESC;

SELECT *
  FROM SNOWFLAKE.ACCOUNT_USAGE.METERING_DAILY_HISTORY
  WHERE SERVICE_TYPE=' ? ';

Sources123456

2.Tracking Snowpark Container Services compute pools

Models and AI apps that run in Snowpark Container Services bill through compute pools. A pool is a set of VM nodes, and its credit consumption depends on how many nodes it has and their instance family. A pool is billed in IDLE, ACTIVE, STOPPING and RESIZING, and is not billed in STARTING or SUSPENDED. An idle pool therefore costs money until it suspends, which is why the docs point to AUTO_SUSPEND. Container services also incur storage costs (image repository stage, event-table logs, block storage) and data transfer costs.

For tracking, SNOWPARK_CONTAINER_SERVICES_HISTORY reports hourly credits for Snowpark Container Services only. In METERING_DAILY_HISTORY and METERING_HISTORY, filter on service_type = SNOWPARK_CONTAINER_SERVICES. For data transfer, DATA_TRANSFER_HISTORY labels outbound container traffic with transfer_type SNOWPARK_CONTAINER_SERVICES.

Sources7

3.Alerts and per-user limits for AI functions

Watching the views is passive. Snowflake's cost-management guide turns them into controls. The first is an account-wide monthly spending alert: an hourly ALERT checks the month-to-date SUM(CREDITS) in CORTEX_AI_FUNCTIONS_USAGE_HISTORY and calls a procedure that emails administrators. The procedure writes to a state table so the same alert fires only once a month. Because the view can lag by up to five minutes, the alert detects overspend after it happens and does not block it.

CREATE OR REPLACE ALERT ai_functions_monthly_spend_alert
    WAREHOUSE = <your_warehouse>
    SCHEDULE = 'USING CRON 0 * * * * UTC'  -- Runs every hour
    IF (EXISTS (
        SELECT 1
        FROM SNOWFLAKE.ACCOUNT_USAGE.CORTEX_AI_FUNCTIONS_USAGE_HISTORY
        WHERE START_TIME >= DATE_TRUNC('month', CURRENT_TIMESTAMP())
        HAVING SUM(CREDITS) > 1000  -- adjust the limit accordingly
    ))
    THEN
        CALL SEND_MONTHLY_SPEND_ALERT(1000);  -- please adjust the limit accordingly

The second control is a per-user monthly limit. Users get AI functions through a custom AI_FUNCTIONS_USER_ROLE. An hourly task removes that role from anyone over budget, and a monthly task gives it back. This only works if SNOWFLAKE.CORTEX_USER is first revoked from PUBLIC, because by default every user inherits Cortex access through PUBLIC.

Sources8

4.Object tagging and resource budgets for Cortex Agents

For Cortex Agents, Snowflake attributes cost through object tags. You create a tag, set it on the agent, and attach that tag to a budget that has a monthly credit limit. Snowflake then counts the credits consumed by the tagged object against the budget.

ALTER AGENT IF EXISTS my_agent SET TAG cost_mgmt_db.tags.cost_center = 'org-level';

CALL my_budget!SET_SPENDING_LIMIT(10000);

Thresholds are set as a percentage of the limit, and each one can run a stored procedure. A common setup emails at 80% and revokes the agent role at 100%. Thresholds can go up to 500%, so an administrator can restore access for a few users and keep a second hard stop at 200%. A cycle-start action restores access when the next month begins, and trigger type PROJECTED acts on forecast spend rather than actual spend. Enforcement is not immediate: it can take up to eight hours with a standard budget, or two hours with the low-latency option.

A resource budget caps one object. To give every user the same credit limit across Cortex Agents and other AI features, and to block users who reach it, the docs point to per-user quotas instead.

Sources9

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.CORTEX_AISQL_USAGE_HISTORY shows usage for every AI function, including document parsing.Why is that wrong?

   That view leaves out AI_PARSE_DOCUMENT. CORTEX_AI_FUNCTIONS_USAGE_HISTORY covers all functions.

   Covered in Which usage view answers which question

2. 2.CORTEX_SEARCH_DAILY_USAGE_HISTORY gives the full cost of a search service, including refresh warehouses.Why is that wrong?

   It reports embedding and serving credits. Warehouse usage is only planned for a future release.

   Covered in Which usage view answers which question

3. 3.A Cortex Agent resource budget cuts off access the moment spending passes 100%.Why is that wrong?

   Budgets are evaluated periodically, so enforcement can lag by hours.

   Covered in Object tagging and resource budgets for Cortex Agents

Practise it for real

Get an email when month-to-date Cortex AI function credits pass a threshold

1. 1.As ACCOUNTADMIN, grant your role IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE, CREATE INTEGRATION, EXECUTE ALERT, warehouse USAGE, and CREATE TABLE/PROCEDURE on a schema

   Why: The alert reads ACCOUNT_USAGE and must own the objects it runs

   You should see: The grants succeed and you can USE ROLE <your_role>

2. 2.CREATE OR REPLACE NOTIFICATION INTEGRATION ai_cost_alerts with TYPE = EMAIL and your verified address in ALLOWED_RECIPIENTS

   Why: SYSTEM$SEND_EMAIL can only deliver to addresses the integration allows

   You should see: The integration exists and is ENABLED

3. 3.Create the AI_FUNCTIONS_ALERT_STATE table and the SEND_MONTHLY_SPEND_ALERT procedure, using your address in place of admin@company.com

   Why: The state table stops the alert from emailing more than once a month

   You should see: Calling the procedure with a high threshold returns 'Threshold not exceeded'

4. 4.Create ai_functions_monthly_spend_alert with a threshold of 0, then run ALTER ALERT ai_functions_monthly_spend_alert RESUME

   Why: A threshold of 0 fires straight away, which proves the whole chain works

   You should see: Within the hour an email arrives and ALERT_HISTORY shows the alert ran

5. 5.Delete this month's row from AI_FUNCTIONS_ALERT_STATE and recreate the alert with your real threshold

   Why: Otherwise the test row blocks this month's real alert

   You should see: SHOW ALERTS lists the alert with the new threshold