Snowflake network security checks
IP allow-lists, TLS, DNS and edge settings that keep the application reachable only from where it should be.
On Snowflake, Black Cat runs 4 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Snowflake connector needs.
Checks (4)
severity: high No Network Policy fix difficulty: medium #
Create and apply an account-level network policy to restrict Snowflake access by IP address
- Connect to Snowflake as ACCOUNTADMIN or SECURITYADMIN
- Identify the approved IP ranges for your organization (corporate VPN, office IPs, etc.)
- Create a network policy: CREATE NETWORK POLICY corp_access ALLOWED_IP_LIST = ('203.0.113.0/24', '198.51.100.0/24');
- Apply the policy at the account level: ALTER ACCOUNT SET NETWORK_POLICY = corp_access;
- Verify the policy is active: SHOW PARAMETERS LIKE 'NETWORK_POLICY' IN ACCOUNT;
- Test that authorized IPs can still connect before enforcing in production
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: high Network Policy Wildcard fix difficulty: medium #
Remove the 0.0.0.0/0 wildcard from the network policy allowed IP list and restrict to known CIDRs
- Connect to Snowflake as ACCOUNTADMIN or SECURITYADMIN
- View the current policy: DESCRIBE NETWORK POLICY <policy_name>;
- Identify the specific IP ranges that should be allowed (corporate VPN, office ranges, etc.)
- Alter the policy to replace the wildcard: ALTER NETWORK POLICY <policy_name> SET ALLOWED_IP_LIST = ('203.0.113.0/24', '198.51.100.0/24');
- Verify the updated policy: DESCRIBE NETWORK POLICY <policy_name>;
- Test connectivity from an authorized IP before applying to production workloads
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: low Network Policy No Blocklist fix difficulty: easy #
Add a blocked IP list to the network policy to explicitly deny known malicious IP ranges
- Connect to Snowflake as ACCOUNTADMIN or SECURITYADMIN
- View the current policy: DESCRIBE NETWORK POLICY <policy_name>;
- Obtain a list of known malicious or untrusted IP ranges to block
- Update the policy to add a blocked list: ALTER NETWORK POLICY <policy_name> SET BLOCKED_IP_LIST = ('192.0.2.0/24', '198.51.100.5');
- Verify the updated policy: DESCRIBE NETWORK POLICY <policy_name>;
- Keep the blocklist updated as new threat intelligence becomes available
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: high Integration No Network Policy fix difficulty: medium #
Attach a network policy to the security integration to restrict access by IP address
- Connect to Snowflake as ACCOUNTADMIN or SECURITYADMIN
- Identify an appropriate network policy or create one: CREATE NETWORK POLICY integration_access ALLOWED_IP_LIST = ('203.0.113.0/24');
- Attach the policy to the integration: ALTER SECURITY INTEGRATION <integration_name> SET NETWORK_POLICY = integration_access;
- Verify the setting: DESCRIBE INTEGRATION <integration_name>;
- Test the integration from an allowed IP to confirm connectivity
- Document the integration's allowed IP ranges for future audits
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9