SnowPro® Advanced: Security Engineer cheat sheet

The security model is role-based: a session's active primary role determines privileges; secondary roles (enabled via USE SECONDARY ROLES) add privileges but never override the primary role's object ownership.

Privileges are granted on securable objects (databases, schemas, tables, warehouses, stages, functions) or on account-level objects (users, roles, warehouses, resource monitors); object privileges are held by roles, not users directly.

A role hierarchy grants privileges transitively downward: privileges of a child role are inherited by roles granted that child, but never upward to the parent.

Access control has two schemes: Discretionary Access Control (DAC) where object owners/privilege holders grant access, and Role-Based Access Control (RBAC) where roles bundle privileges; Snowflake uses both together.

Ownership of an object confers all privileges on it including the ability to grant to others; transferring ownership uses GRANT OWNERSHIP ... COPY CURRENT GRANTS to preserve existing grants.

SECURITYADMIN owns/manages grants and users; SYSADMIN owns warehouses and databases; ACCOUNTADMIN is the top role and should be tightly limited and protected with MFA.

Snowflake Horizon provides governance capabilities: object tagging, data classification, access history, and policy enforcement (masking, row access, projection) across the account.

Tags are schema-level objects applied to columns/tables; tag-based masking policies let a single masking policy apply to all columns carrying a given tag.

Future grants (GRANT ... ON FUTURE TABLES/SCHEMAS IN SCHEMA) apply automatically to objects created later, avoiding per-object grant maintenance.

Authentication methods: username/password, key-pair (RSA), OAuth (Snowflake or external IdP), SAML 2.0 SSO federation, and multi-factor authentication (MFA); MFA is required for password sign-ins by default for ACCOUNTADMIN or can be enforced account-wide via authentication policy.

Key-pair authentication uses an RSA public key registered on the user (ALTER USER ... SET RSA_PUBLIC_KEY) and the private key held by the client; no password is transmitted.

SAML SSO federates authentication to an external IdP; Snowflake validates the signed SAML assertion and maps the IdP user to a Snowflake user via LOGIN_NAME or the SAML subject, with optional role mapping.

OAuth uses an external authorization server issuing tokens; the client presents the access token to Snowflake, which validates it against the configured security integration.

SCIM provisioning (via a security integration) automates user and role creation/removal from an identity provider into Snowflake.

Network policies restrict access by IP address: ALLOWED_IP_LIST and BLOCKED_IP_LIST; a policy can be set per user or at the account level, and account-level policy applies to all users.

Authentication policies (account or user level) control MFA enrollment, allowed authentication methods, and client types; password policies enforce length, complexity, and lockout rules.

Users can be disabled with ALTER USER ... SET DISABLED = TRUE; session policies set idle and session lifetime limits.

A user's DEFAULT_ROLE and DEFAULT_WAREHOUSE set the starting context; DEFAULT_SECONDARY_ROLES controls which secondary roles are active by default.

Snowflake encrypts all data at rest with AES-256; data in transit uses TLS. Encryption is hierarchical: a root key protects account keys, which protect table keys, which protect data (envelope encryption).

Tri-Secret Secure (customer-managed keys) combines a Snowflake-held key with a customer-held key in a cloud KMS; revoking the customer key renders data unreadable (crypto-shredding).

Snowflake-managed keys are rotated automatically; key rotation re-encrypts table master keys without rewriting data.

Dynamic data masking uses a masking policy (a SQL expression returning a masked value based on the column type) attached to a column; the policy evaluates at query time based on the role.

Masking policies are applied with ALTER TABLE ... MODIFY COLUMN ... SET MASKING POLICY, or via tag-based masking where a tag carries a masking policy.

External tokenization replaces sensitive values with tokens; Snowflake can use external functions to call a tokenization service so plaintext never lands in the table.

Row access policies filter rows returned based on a mapping table or role; they apply to SELECTs and can be combined with masking policies.

Projection policies restrict which columns a query projects (column-level access control) without masking the value.

Secure views and secure UDFs prevent exposure of underlying definitions and prevent the optimizer from leaking data through query plans; use them when sharing sensitive logic.

Network policies are account-level or user-level objects with ALLOWED_IP_LIST and BLOCKED_IP_LIST; blocked entries take precedence, and if an allow list is set, only listed IPs may connect.

Private connectivity options: AWS PrivateLink, Azure Private Link, and Google Cloud Private Service Connect, each configured via a network policy with the cloud provider's private endpoint.

A private endpoint is enabled on the account with SYSTEM$AUTHORIZE_PRIVATELINK / SYSTEM$AUTHORIZE_PRIVATELINK_ENDPOINT and blocked public access can be enforced by setting the network policy to allow only the private endpoint.

Snowflake supports outbound private connectivity for external functions and external network access via network rules and external access integrations (egress).

Network rules (CREATE NETWORK RULE) define IP or private-endpoint egress/ingress lists; they can be grouped into network policies or external access integrations.

Snowflake supports outbound private connectivity for external functions and external network access via network rules and external access integrations (egress).

Client connections use ports 443 (HTTPS) by default; private connectivity avoids public internet exposure and is recommended for regulated workloads.

Snowflake supports outbound private connectivity for external functions and external network access via network rules and external access integrations (egress).

Access history (ACCESS_HISTORY view in ACCOUNT_USAGE and the Information Schema) records read/write access to objects, including which columns were read and which objects were written, for auditing data access.

The ACCOUNT_USAGE schema provides views such as LOGIN_HISTORY, QUERY_HISTORY, ACCESS_HISTORY, and GRANTS_TO_ROLES with up to 1-year retention (latency up to ~45 minutes), while Information Schema views are near real-time but limited retention.

LOGIN_HISTORY records authentication attempts including success/failure, client IP, and authentication method, useful for detecting unauthorized access.

QUERY_HISTORY and QUERY_HISTORY_BY_USER record executed queries, including failed and running queries, for performance and security review.

Object tagging and data classification (CLASSIFY / tag-based classification) identify sensitive columns; classification results appear in the DATA_CLASSIFICATION_LATEST view.

Snowflake Trust Center provides security posture checks (e.g., MFA enforcement, network policy, password policy) and surfaces findings for remediation.

Snowflake supports audit log export to cloud storage (e.g., via external stages) and integrates with SIEM tools for centralized monitoring.

A resource monitor tracks credit consumption against quotas and can suspend warehouses; monitoring credit usage supports cost governance and anomaly detection.

Time Travel and Fail-safe support data recovery: Time Travel retains historical data for a configurable period (0-90 days) and Fail-safe provides 7 days of recovery after Time Travel expires.

The security model is role-based: a session's active primary role determines privileges; secondary roles (enabled via USE SECONDARY ROLES) add privileges but never override the primary role's object ownership.

Privileges are granted on securable objects (databases, schemas, tables, warehouses, stages, functions) or on account-level objects (users, roles, warehouses, resource monitors); object privileges are held by roles, not users directly.

A role hierarchy grants privileges transitively downward: privileges of a child role are inherited by roles granted that child, but never upward to the parent.

Access control has two schemes: Discretionary Access Control (DAC) where object owners/privilege holders grant access, and Role-Based Access Control (RBAC) where roles bundle privileges; Snowflake uses both together.

Ownership of an object confers all privileges on it including the ability to grant to others; transferring ownership uses GRANT OWNERSHIP ... COPY CURRENT GRANTS to preserve existing grants.

SECURITYADMIN owns/manages grants and users; SYSADMIN owns warehouses and databases; ACCOUNTADMIN is the top role and should be tightly limited and protected with MFA.

Snowflake Horizon provides governance capabilities: object tagging, data classification, access history, and policy enforcement (masking, row access, projection) across the account.

Tags are schema-level objects applied to columns/tables; tag-based masking policies let a single masking policy apply to all columns carrying a given tag.

Future grants (GRANT ... ON FUTURE TABLES/SCHEMAS IN SCHEMA) apply automatically to objects created later, avoiding per-object grant maintenance.

Authentication methods: username/password, key-pair (RSA), OAuth (Snowflake or external IdP), SAML 2.0 SSO federation, and multi-factor authentication (MFA); MFA is required for password sign-ins by default for ACCOUNTADMIN or can be enforced account-wide via authentication policy.

Key-pair authentication uses an RSA public key registered on the user (ALTER USER ... SET RSA_PUBLIC_KEY) and the private key held by the client; no password is transmitted.

SAML SSO federates authentication to an external IdP; Snowflake validates the signed SAML assertion and maps the IdP user to a Snowflake user via LOGIN_NAME or the SAML subject, with optional role mapping.

OAuth uses an external authorization server issuing tokens; the client presents the access token to Snowflake, which validates it against the configured security integration.

SCIM provisioning (via a security integration) automates user and role creation/removal from an identity provider into Snowflake.

Network policies restrict access by IP address: ALLOWED_IP_LIST and BLOCKED_IP_LIST; a policy can be set per user or at the account level, and account-level policy applies to all users.

Authentication policies (account or user level) control MFA enrollment, allowed authentication methods, and client types; password policies enforce length, complexity, and lockout rules.

Users can be disabled with ALTER USER ... SET DISABLED = TRUE; session policies set idle and session lifetime limits.

A user's DEFAULT_ROLE and DEFAULT_WAREHOUSE set the starting context; DEFAULT_SECONDARY_ROLES controls which secondary roles are active by default.

Snowflake encrypts all data at rest with AES-256; data in transit uses TLS. Encryption is hierarchical: a root key protects account keys, which protect table keys, which protect data (envelope encryption).

Tri-Secret Secure (customer-managed keys) combines a Snowflake-held key with a customer-held key in a cloud KMS; revoking the customer key renders data unreadable (crypto-shredding).

Snowflake-managed keys are rotated automatically; key rotation re-encrypts table master keys without rewriting data.

Dynamic data masking uses a masking policy (a SQL expression returning a masked value based on the column type) attached to a column; the policy evaluates at query time based on the role.

Masking policies are applied with ALTER TABLE ... MODIFY COLUMN ... SET MASKING POLICY, or via tag-based masking where a tag carries a masking policy.

External tokenization replaces sensitive values with tokens; Snowflake can use external functions to call a tokenization service so plaintext never lands in the table.

Row access policies filter rows returned based on a mapping table or role; they apply to SELECTs and can be combined with masking policies.

Projection policies restrict which columns a query projects (column-level access control) without masking the value.

Secure views and secure UDFs prevent exposure of underlying definitions and prevent the optimizer from leaking data through query plans; use them when sharing sensitive logic.

Network policies are account-level or user-level objects with ALLOWED_IP_LIST and BLOCKED_IP_LIST; blocked entries take precedence, and if an allow list is set, only listed IPs may connect.

Private connectivity options: AWS PrivateLink, Azure Private Link, and Google Cloud Private Service Connect, each configured via a network policy with the cloud provider's private endpoint.

A private endpoint is enabled on the account with SYSTEM$AUTHORIZE_PRIVATELINK / SYSTEM$AUTHORIZE_PRIVATELINK_ENDPOINT and blocked public access can be enforced by setting the network policy to allow only the private endpoint.

Snowflake supports outbound private connectivity for external functions and external network access via network rules and external access integrations (egress).

Network rules (CREATE NETWORK RULE) define IP or private-endpoint egress/ingress lists; they can be grouped into network policies or external access integrations.

Client connections use ports 443 (HTTPS) by default; private connectivity avoids public internet exposure and is recommended for regulated workloads.

Snowflake supports outbound private connectivity for external functions and external network access via network rules and external access integrations (egress).

Snowflake supports outbound private connectivity for external functions and external network access via network rules and external access integrations (egress).

Access history (ACCESS_HISTORY view in ACCOUNT_USAGE and the Information Schema) records read/write access to objects, including which columns were read and which objects were written, for auditing data access.

The ACCOUNT_USAGE schema provides views such as LOGIN_HISTORY, QUERY_HISTORY, ACCESS_HISTORY, and GRANTS_TO_ROLES with up to 1-year retention (latency up to ~45 minutes), while Information Schema views are near real-time but limited retention.

LOGIN_HISTORY records authentication attempts including success/failure, client IP, and authentication method, useful for detecting unauthorized access.

QUERY_HISTORY and QUERY_HISTORY_BY_USER record executed queries, including failed and running queries, for performance and security review.

Object tagging and data classification (CLASSIFY / tag-based classification) identify sensitive columns; classification results appear in the DATA_CLASSIFICATION_LATEST view.

Snowflake Trust Center provides security posture checks (e.g., MFA enforcement, network policy, password policy) and surfaces findings for remediation.

Snowflake supports audit log export to cloud storage (e.g., via external stages) and integrates with SIEM tools for centralized monitoring.

A resource monitor tracks credit consumption against quotas and can suspend warehouses; monitoring credit usage supports cost governance and anomaly detection.

Time Travel and Fail-safe support data recovery: Time Travel retains historical data for a configurable period (0-90 days) and Fail-safe provides 7 days of recovery after Time Travel expires.