CIS Snowflake Benchmark

This recommendation ensures that multi-factor authentication is enforced on the Snowflake cloud data platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Snowflake cloud data platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

-- Verify multi-factor authentication is enforced:
SHOW PARAMETERS LIKE 'REQUIRE_MFA' IN ACCOUNT;

-- Check MFA enrollment per user:
SELECT NAME, HAS_MFA, LAST_SUCCESS_LOGIN
FROM SNOWFLAKE.ACCOUNT_USAGE.USERS
WHERE DELETED_ON IS NULL
ORDER BY HAS_MFA;

-- Enforce MFA at account level:
ALTER ACCOUNT SET REQUIRE_MFA = TRUE;

-- Or enforce per user:
ALTER USER username SET MINS_TO_BYPASS_MFA = 0;
ALTER USER username SET DISABLE_MFA = FALSE;

This recommendation verifies that network policy is configured on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Verify network policy is configured:
SHOW NETWORK POLICIES;

-- Check which policy is active:
SELECT SYSTEM$GET_ACTIVE_NETWORK_POLICY();

-- Create and activate network policy:
CREATE NETWORK POLICY corp_policy
  ALLOWED_IP_LIST=('10.0.0.0/8', '172.16.0.0/12')
  BLOCKED_IP_LIST=('0.0.0.0/0');

ALTER ACCOUNT SET NETWORK_POLICY = 'CORP_POLICY';

This recommendation ensures that minimum TLS version is enforced on the Snowflake cloud data platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Snowflake cloud data platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

-- Verify minimum TLS version:
SELECT SYSTEM$ALLOWLIST();

-- Check account parameter:
SHOW PARAMETERS LIKE 'MIN_DATA_RETENTION_TIME_IN_DAYS' IN ACCOUNT;

-- Set minimum TLS version via Snowflake Support ticket
-- or in the account parameters:
-- Contact Snowflake Support to enforce TLS 1.2+
-- Verify client connections use TLS 1.2+:
-- Check network policy allows only secure endpoints

This recommendation verifies that session idle timeout is configured on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Verify session idle timeout:
SHOW PARAMETERS LIKE 'CLIENT_SESSION_KEEP_ALIVE' IN ACCOUNT;
SHOW PARAMETERS LIKE 'CLIENT_SESSION_KEEP_ALIVE_HEARTBEAT_FREQUENCY' IN ACCOUNT;
SHOW PARAMETERS LIKE 'IDLE_TIMEOUT_IN_SECONDS' IN ACCOUNT;

-- Configure session timeout:
ALTER ACCOUNT SET CLIENT_SESSION_KEEP_ALIVE = FALSE;
ALTER ACCOUNT SET IDLE_TIMEOUT_IN_SECONDS = 900;

This recommendation verifies that password-only authentication is not used on the Snowflake cloud data platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Snowflake cloud data platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

-- Identify users with password-based authentication:
SELECT NAME, LOGIN_NAME, HAS_PASSWORD, HAS_RSA_PUBLIC_KEY,
  LAST_SUCCESS_LOGIN, CREATED_ON
FROM SNOWFLAKE.ACCOUNT_USAGE.USERS
WHERE DELETED_ON IS NULL AND HAS_PASSWORD = 'YES'
ORDER BY LAST_SUCCESS_LOGIN;

-- Disable password auth for users (use SSO/keypair):
ALTER USER username SET RSA_PUBLIC_KEY = 'MIIBIjAN...';
ALTER USER username SET DISABLED = FALSE;
ALTER USER username SET PASSWORD = NULL;

This recommendation ensures that password policy meets complexity requirements on the Snowflake cloud data platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Snowflake cloud data platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

-- Check password policy:
SHOW PASSWORD POLICIES;

-- Describe the password policy:
DESCRIBE PASSWORD POLICY account_password_policy;

-- Create strong password policy:
CREATE PASSWORD POLICY strong_policy
  PASSWORD_MIN_LENGTH = 14
  PASSWORD_MAX_LENGTH = 256
  PASSWORD_MIN_UPPER_CASE_CHARS = 1
  PASSWORD_MIN_LOWER_CASE_CHARS = 1
  PASSWORD_MIN_NUMERIC_CHARS = 1
  PASSWORD_MIN_SPECIAL_CHARS = 1
  PASSWORD_MAX_AGE_DAYS = 90
  PASSWORD_MAX_RETRIES = 5
  PASSWORD_LOCKOUT_TIME_MINS = 30
  PASSWORD_HISTORY = 12;

ALTER ACCOUNT SET PASSWORD POLICY = strong_policy;

This recommendation verifies that inactive users are disabled on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Identify unused/inactive users:
SELECT NAME, LAST_SUCCESS_LOGIN, CREATED_ON,
  DATEDIFF('day', LAST_SUCCESS_LOGIN, CURRENT_TIMESTAMP()) AS DAYS_INACTIVE
FROM SNOWFLAKE.ACCOUNT_USAGE.USERS
WHERE DELETED_ON IS NULL
  AND DATEDIFF('day', LAST_SUCCESS_LOGIN, CURRENT_TIMESTAMP()) > 90
ORDER BY DAYS_INACTIVE DESC;

-- Disable inactive users:
ALTER USER inactive_username SET DISABLED = TRUE;

-- Drop user if no longer needed:
DROP USER inactive_username;

This setting ensures that ACCOUNTADMIN role is restricted on the Snowflake cloud data platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Snowflake cloud data platform is essential for defense in depth.

-- Verify ACCOUNTADMIN role has limited users:
SELECT GRANTEE_NAME, ROLE, CREATED_ON
FROM SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS
WHERE ROLE = 'ACCOUNTADMIN' AND DELETED_ON IS NULL
ORDER BY GRANTEE_NAME;

-- Revoke ACCOUNTADMIN from unnecessary users:
REVOKE ROLE ACCOUNTADMIN FROM USER unnecessary_admin;

-- Grant lesser role:
GRANT ROLE SYSADMIN TO USER operations_user;

This recommendation verifies that custom roles follow least privilege on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Verify custom roles follow least privilege:
SHOW ROLES;
SHOW GRANTS TO ROLE analyst_role;

-- Check role hierarchy:
SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_ROLES
WHERE GRANTED_ON = 'ROLE' AND DELETED_ON IS NULL;

-- Create least-privilege custom role:
CREATE ROLE analyst_role;
GRANT USAGE ON DATABASE analytics_db TO ROLE analyst_role;
GRANT USAGE ON SCHEMA analytics_db.public TO ROLE analyst_role;
GRANT SELECT ON ALL TABLES IN SCHEMA analytics_db.public TO ROLE analyst_role;
GRANT ROLE analyst_role TO USER analyst_user;

This recommendation verifies that PUBLIC role has minimal privileges on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Check for PUBLIC role excessive grants:
SHOW GRANTS TO ROLE PUBLIC;

-- Verify databases accessible by PUBLIC:
SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_ROLES
WHERE GRANTEE_NAME = 'PUBLIC'
  AND PRIVILEGE NOT IN ('USAGE')
  AND DELETED_ON IS NULL;

-- Revoke unnecessary grants from PUBLIC:
REVOKE ALL PRIVILEGES ON DATABASE sensitive_db FROM ROLE PUBLIC;
REVOKE CREATE SCHEMA ON DATABASE any_db FROM ROLE PUBLIC;

This recommendation verifies that customer-managed encryption keys are used on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Verify Tri-Secret Secure (customer-managed keys):
-- Check with SYSTEM$GET_TAG or account params:
SHOW PARAMETERS LIKE 'PERIODIC_DATA_REKEYING' IN ACCOUNT;

-- Check encryption key provider:
SELECT SYSTEM$GET_SNOWFLAKE_PLATFORM_INFO();

-- Enable Tri-Secret Secure (Business Critical+ edition):
-- Contact Snowflake Support to enable customer-managed keys
-- Then configure your KMS (AWS KMS / Azure Key Vault / GCP KMS)
-- through Snowflake account setup

This recommendation verifies that Time Travel retention is configured on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Verify Time Travel retention:
SHOW PARAMETERS LIKE 'DATA_RETENTION_TIME_IN_DAYS' IN ACCOUNT;

-- Check per-database retention:
SELECT DATABASE_NAME, RETENTION_TIME
FROM SNOWFLAKE.ACCOUNT_USAGE.DATABASES
WHERE DELETED IS NULL;

-- Set appropriate Time Travel retention:
ALTER ACCOUNT SET DATA_RETENTION_TIME_IN_DAYS = 7;

-- Per database:
ALTER DATABASE production_db SET DATA_RETENTION_TIME_IN_DAYS = 14;

This recommendation verifies that external stages use encryption on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Verify external stages use encryption:
SHOW STAGES;

-- Check stage encryption settings:
DESCRIBE STAGE @my_s3_stage;

-- Verify MASTER_KEY or encryption type:

-- Create encrypted external stage:
CREATE STAGE encrypted_s3_stage
  URL = 's3://my-bucket/path/'
  CREDENTIALS = (AWS_KEY_ID = '...' AWS_SECRET_KEY = '...')
  ENCRYPTION = (TYPE = 'AWS_SSE_KMS' KMS_KEY_ID = 'aws-kms-key-id');

This setting ensures that data sharing is reviewed and restricted on the Snowflake cloud data platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Snowflake cloud data platform is essential for defense in depth.

-- Review outbound data shares:
SHOW SHARES;

-- Check what's shared:
SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.DATA_TRANSFER_HISTORY
WHERE TRANSFER_TYPE = 'REPLICATION'
ORDER BY START_TIME DESC
LIMIT 20;

-- Restrict data sharing:
-- Review and remove unnecessary shares:
ALTER SHARE sensitive_share REMOVE DATABASE sensitive_db;
DROP SHARE unused_share;

-- Set sharing restrictions:
ALTER ACCOUNT SET DATA_SHARING_ENABLED = FALSE;

This recommendation verifies that login and access history is monitored on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Verify access history tracking:
SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY
ORDER BY QUERY_START_TIME DESC
LIMIT 10;

-- Verify login history:
SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY
WHERE IS_SUCCESS = 'NO'
ORDER BY EVENT_TIMESTAMP DESC LIMIT 20;

-- Set up alerts for failed logins:
CREATE ALERT failed_login_alert
  WAREHOUSE = compute_wh
  SCHEDULE = '5 MINUTE'
  IF (EXISTS (
    SELECT 1 FROM SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY
    WHERE IS_SUCCESS = 'NO'
      AND EVENT_TIMESTAMP > DATEADD('minute', -5, CURRENT_TIMESTAMP())
    HAVING COUNT(*) > 10
  ))
  THEN CALL SYSTEM$SEND_EMAIL('security@company.com', 'Failed Login Alert', 'Multiple failed logins detected');

This recommendation verifies that query monitoring and resource monitors are configured on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Verify query history monitoring:
SELECT QUERY_TYPE, USER_NAME, ROLE_NAME, DATABASE_NAME,
  EXECUTION_STATUS, ERROR_CODE, ERROR_MESSAGE
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
WHERE EXECUTION_STATUS = 'FAIL'
ORDER BY START_TIME DESC LIMIT 20;

-- Create resource monitor:
CREATE RESOURCE MONITOR monthly_monitor
  WITH CREDIT_QUOTA = 1000
  TRIGGERS
    ON 75 PERCENT DO NOTIFY
    ON 90 PERCENT DO NOTIFY
    ON 100 PERCENT DO SUSPEND;

ALTER WAREHOUSE compute_wh SET RESOURCE_MONITOR = monthly_monitor;

This recommendation verifies that data classification tags are applied on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Check for object tagging (data classification):
SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES
WHERE TAG_NAME IN ('PII', 'SENSITIVE', 'CONFIDENTIAL')
ORDER BY TAG_NAME;

-- Create classification tags:
CREATE TAG IF NOT EXISTS PII ALLOWED_VALUES 'TRUE', 'FALSE';
CREATE TAG IF NOT EXISTS DATA_CLASSIFICATION
  ALLOWED_VALUES 'PUBLIC', 'INTERNAL', 'CONFIDENTIAL', 'RESTRICTED';

-- Apply tags:
ALTER TABLE customers SET TAG PII = 'TRUE';
ALTER COLUMN customers.email SET TAG DATA_CLASSIFICATION = 'CONFIDENTIAL';

This recommendation verifies that warehouse auto-suspend is configured on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Verify warehouse auto-suspend:
SHOW WAREHOUSES;

-- Check auto-suspend settings:
SELECT NAME, AUTO_SUSPEND, AUTO_RESUME, SIZE
FROM SNOWFLAKE.ACCOUNT_USAGE.WAREHOUSES
WHERE DELETED_ON IS NULL;

-- Configure auto-suspend:
ALTER WAREHOUSE compute_wh SET
  AUTO_SUSPEND = 300
  AUTO_RESUME = TRUE;

This recommendation verifies that statement timeout is configured on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Verify warehouse statement timeout:
SHOW PARAMETERS LIKE 'STATEMENT_TIMEOUT_IN_SECONDS' IN WAREHOUSE compute_wh;
SHOW PARAMETERS LIKE 'STATEMENT_QUEUED_TIMEOUT_IN_SECONDS' IN WAREHOUSE compute_wh;

-- Set statement timeout:
ALTER WAREHOUSE compute_wh SET
  STATEMENT_TIMEOUT_IN_SECONDS = 3600
  STATEMENT_QUEUED_TIMEOUT_IN_SECONDS = 600;

This recommendation verifies that dynamic data masking policies are applied on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Check masking policies:
SHOW MASKING POLICIES;

-- View policy assignments:
SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.POLICY_REFERENCES
WHERE POLICY_KIND = 'MASKING'
ORDER BY POLICY_NAME;

-- Create dynamic data masking policy:
CREATE MASKING POLICY email_mask AS (val STRING)
  RETURNS STRING ->
  CASE
    WHEN CURRENT_ROLE() IN ('ADMIN', 'DATA_OWNER') THEN val
    ELSE REGEXP_REPLACE(val, '.+@', '***@')
  END;

-- Apply to column:
ALTER TABLE customers ALTER COLUMN email
  SET MASKING POLICY email_mask;

This recommendation verifies that row access policies are configured on the Snowflake cloud data platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Snowflake cloud data platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

-- Check row access policies:
SHOW ROW ACCESS POLICIES;

-- View assignments:
SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.POLICY_REFERENCES
WHERE POLICY_KIND = 'ROW_ACCESS'
ORDER BY POLICY_NAME;

-- Create row access policy:
CREATE ROW ACCESS POLICY region_access AS (region_col VARCHAR)
  RETURNS BOOLEAN ->
  CASE
    WHEN CURRENT_ROLE() = 'ADMIN' THEN TRUE
    WHEN region_col = CURRENT_USER() THEN TRUE
    ELSE FALSE
  END;

-- Apply to table:
ALTER TABLE sales ADD ROW ACCESS POLICY region_access ON (region);