Snowflake data sharing & exposure security checks
External sharing, public links, guest access, retention and data-protection settings that quietly push company data outside the tenant.
On Snowflake, Black Cat runs 6 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Snowflake connector needs.
Checks (6)
severity: high No Storage Integration Required fix difficulty: medium #
Enforce storage integrations for external stage creation to prevent unauthorized cloud storage access
- Connect to Snowflake as ACCOUNTADMIN
- Enable the requirement: ALTER ACCOUNT SET REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = TRUE;
- Verify the setting: SHOW PARAMETERS LIKE 'REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION' IN ACCOUNT;
- Ensure existing external stages are already using storage integrations; audit with: SHOW STAGES IN ACCOUNT;
- For any stages not using integrations, create the appropriate storage integration and update the stage
- Communicate the policy change to data engineers who create external stages
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: high Unload To Inline URL fix difficulty: easy #
Prevent data unloading to inline cloud storage URLs to block unauthorized data exfiltration
- Connect to Snowflake as ACCOUNTADMIN
- Enable the restriction: ALTER ACCOUNT SET PREVENT_UNLOAD_TO_INLINE_URL = TRUE;
- Verify the setting: SHOW PARAMETERS LIKE 'PREVENT_UNLOAD_TO_INLINE_URL' IN ACCOUNT;
- Ensure any legitimate data unload workflows use named external stages with storage integrations
- Update existing COPY INTO statements that reference inline URLs to use named stages
- Communicate this requirement to the data engineering and analytics teams
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: medium Unload To Internal Stages fix difficulty: medium #
Prevent data unloading to Snowflake internal stages to reduce data exfiltration risk
- Connect to Snowflake as ACCOUNTADMIN
- Enable the restriction: ALTER ACCOUNT SET PREVENT_UNLOAD_TO_INTERNAL_STAGES = TRUE;
- Verify the setting: SHOW PARAMETERS LIKE 'PREVENT_UNLOAD_TO_INTERNAL_STAGES' IN ACCOUNT;
- Identify any existing workflows that unload to internal stages: SHOW STAGES IN ACCOUNT;
- Migrate affected workflows to use external stages with storage integrations
- Test all data export pipelines after enabling to confirm no breakage
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: medium Outbound Share Review fix difficulty: medium #
Review and validate all outbound data shares to confirm they are still necessary and appropriately scoped
- Connect to Snowflake as ACCOUNTADMIN
- List all outbound shares: SHOW SHARES;
- For each share, review the shared objects: SHOW OBJECTS IN SHARE <share_name>;
- Verify the list of consuming accounts: SHOW GRANTS OF SHARE <share_name>;
- Remove any accounts that no longer need access: ALTER SHARE <share_name> REMOVE ACCOUNTS = '<account_identifier>';
- Drop shares that are no longer needed: DROP SHARE <share_name>;
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: medium Share To Many Accounts fix difficulty: easy #
Reduce the number of accounts consuming a data share to the minimum necessary
- Connect to Snowflake as ACCOUNTADMIN
- List accounts consuming the share: SHOW GRANTS OF SHARE <share_name>;
- Contact consuming account owners to verify ongoing need
- Revoke access from accounts that no longer require it: ALTER SHARE <share_name> REMOVE ACCOUNTS = '<account_identifier>';
- Verify the updated consumer list: SHOW GRANTS OF SHARE <share_name>;
- Document the remaining consumers and their business justification
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: medium Share Listing Unrestricted fix difficulty: easy #
Enable listing restrictions on outbound data shares
- Log in to Snowsight as an ACCOUNTADMIN
- Navigate to Data > Shared Data > Outbound Shares
- Select the flagged share
- Under Listing Settings, set restrictions to limit share visibility
- Confirm the change
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11