Skip to content

Snowflake access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Snowflake, Black Cat runs 11 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Snowflake connector needs.

Checks (11)

severity: high Password Only Auth fix difficulty: medium #

Replace password-only authentication with MFA or key pair authentication

  1. Connect to Snowflake as ACCOUNTADMIN or SECURITYADMIN
  2. For human users, enforce MFA via authentication policy — run: ALTER USER <username> SET AUTHENTICATION POLICY require_mfa;
  3. For service accounts, configure key pair authentication — generate an RSA key pair and run: ALTER USER <username> SET RSA_PUBLIC_KEY = '<public_key>';
  4. Optionally disable password for service accounts: ALTER USER <username> SET DISABLE_MFA = TRUE; and remove password access
  5. Verify the update: SHOW USERS LIKE '<username>';
  6. Confirm the user can authenticate with the new method before revoking password access

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Service Account Password Auth fix difficulty: medium #

Switch service account authentication from password to key pair and set user type to SERVICE

  1. Connect to Snowflake as ACCOUNTADMIN or USERADMIN
  2. Generate an RSA key pair (2048-bit or 4096-bit) for the service account
  3. Assign the public key to the user: ALTER USER <username> SET RSA_PUBLIC_KEY = '<public_key>';
  4. Set the user type to SERVICE to signal this is a non-human account: ALTER USER <username> SET TYPE = SERVICE;
  5. Remove or expire the password: ALTER USER <username> SET PASSWORD = '' MUST_CHANGE_PASSWORD = FALSE;
  6. Update the calling application to use key pair authentication and verify connectivity

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high ACCOUNTADMIN Default Role fix difficulty: easy #

Change the user's default role from ACCOUNTADMIN to a lower-privilege role

  1. Connect to Snowflake as ACCOUNTADMIN
  2. Identify an appropriate lower-privilege role for the user (e.g., SYSADMIN, a custom role)
  3. Run: ALTER USER <username> SET DEFAULT_ROLE = '<lower_privilege_role>';
  4. Verify the change: SHOW USERS LIKE '<username>';
  5. Confirm the user can still perform their work with the new default role
  6. The user can still USE ROLE ACCOUNTADMIN when explicitly needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Excessive Admin Roles fix difficulty: medium #

Reduce the number of users with ACCOUNTADMIN or SYSADMIN roles to the minimum necessary

  1. Connect to Snowflake as ACCOUNTADMIN
  2. Review the current list of admin role holders: SHOW GRANTS OF ROLE ACCOUNTADMIN;
  3. For each user who does not require admin access, revoke the role: REVOKE ROLE ACCOUNTADMIN FROM USER <username>;
  4. Create custom roles with least-privilege permissions for users who need specific capabilities
  5. Assign the custom role: GRANT ROLE <custom_role> TO USER <username>;
  6. Document which users retain admin access and the business justification

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high No Separation Of Duties fix difficulty: medium #

Revoke conflicting admin roles so no single user holds both ACCOUNTADMIN and SYSADMIN or SECURITYADMIN

  1. Connect to Snowflake as ACCOUNTADMIN
  2. Identify users with conflicting role combinations: SHOW GRANTS TO USER <username>;
  3. Determine which role is appropriate for the user's primary function
  4. Revoke the conflicting role: REVOKE ROLE SYSADMIN FROM USER <username>; (or SECURITYADMIN as applicable)
  5. Create dedicated accounts for administrative tasks requiring elevated roles
  6. Verify the user's remaining roles: SHOW GRANTS TO USER <username>;

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Disabled User With Active Grants fix difficulty: easy #

Revoke all role grants from disabled Snowflake user accounts

  1. Connect to Snowflake as ACCOUNTADMIN or SECURITYADMIN
  2. List all roles granted to the disabled user: SHOW GRANTS TO USER <username>;
  3. Revoke each role: REVOKE ROLE <role_name> FROM USER <username>;
  4. Repeat for all granted roles identified in the previous step
  5. Verify no roles remain: SHOW GRANTS TO USER <username>;
  6. Consider dropping the user if the account is no longer needed: DROP USER <username>;

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Dormant User fix difficulty: easy #

Disable or remove dormant user accounts that have been inactive for 90+ days

  1. Connect to Snowflake as ACCOUNTADMIN or USERADMIN
  2. Review dormant users: SELECT name, last_success_login, disabled FROM snowflake.account_usage.users WHERE last_success_login < DATEADD(day, -90, CURRENT_TIMESTAMP);
  3. Contact the user or their manager to confirm whether access is still needed
  4. Disable the account: ALTER USER <username> SET DISABLED = TRUE;
  5. If the user is confirmed no longer needed, drop the account: DROP USER <username>;
  6. Review and revoke any object ownership or grants as needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium User Not Disabled fix difficulty: easy #

Disable long-inactive user accounts that have not logged in for 180+ days

  1. Connect to Snowflake as ACCOUNTADMIN or USERADMIN
  2. Identify inactive users: SELECT name, last_success_login FROM snowflake.account_usage.users WHERE last_success_login < DATEADD(day, -180, CURRENT_TIMESTAMP) AND disabled = FALSE;
  3. Verify with the user's team that the account is no longer needed
  4. Disable the account: ALTER USER <username> SET DISABLED = TRUE;
  5. Revoke active role grants: REVOKE ROLE <role> FROM USER <username>;
  6. Schedule a follow-up to drop the user if not re-enabled within 30 days

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high ACCOUNTADMIN Excessive Grants fix difficulty: medium #

Reduce the number of users granted the ACCOUNTADMIN role to three or fewer

  1. Connect to Snowflake as ACCOUNTADMIN
  2. List all ACCOUNTADMIN grantees: SHOW GRANTS OF ROLE ACCOUNTADMIN;
  3. Identify users who do not require full account administrator access
  4. Create a least-privilege role for each user's actual needs and grant appropriate privileges
  5. Revoke ACCOUNTADMIN from non-essential users: REVOKE ROLE ACCOUNTADMIN FROM USER <username>;
  6. Retain ACCOUNTADMIN only for break-glass emergency accounts and at most 2–3 designated administrators

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Weak Password Policy fix difficulty: easy #

Strengthen the Snowflake password policy to enforce minimum length, expiry, and lockout requirements

  1. Connect to Snowflake as ACCOUNTADMIN or SECURITYADMIN
  2. Identify the password policy: SHOW PASSWORD POLICIES;
  3. Update the policy with stronger settings: ALTER PASSWORD POLICY <policy_name> SET PASSWORD_MIN_LENGTH = 14 PASSWORD_MAX_AGE_DAYS = 90 PASSWORD_MAX_RETRIES = 5 PASSWORD_LOCKOUT_TIME_MINS = 15;
  4. Verify the updated policy: DESCRIBE PASSWORD POLICY <policy_name>;
  5. Ensure the policy is attached to the account or the appropriate users
  6. Notify users of the new requirements and set MUST_CHANGE_PASSWORD for users with non-compliant passwords

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high OAuth Integration Permissive fix difficulty: medium #

Restrict the OAuth security integration by attaching a network policy and scoping allowed roles

  1. Connect to Snowflake as ACCOUNTADMIN or SECURITYADMIN
  2. Review the current OAuth integration settings: DESCRIBE INTEGRATION <integration_name>;
  3. Create or identify a restrictive network policy for the integration
  4. Attach the network policy: ALTER SECURITY INTEGRATION <integration_name> SET NETWORK_POLICY = '<policy_name>';
  5. Restrict the OAuth allowed roles if applicable: ALTER SECURITY INTEGRATION <integration_name> SET OAUTH_ALLOWED_AUTHORIZATION_ROLE = '<role>';
  6. Verify: DESCRIBE INTEGRATION <integration_name>; and test OAuth flows from an authorized IP

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-308.a4 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Snowflake checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial