Monitoring, Auditing, and Compliance
Where the evidence lives
Snowflake provides ACCESS_HISTORY (which objects and columns a query read or wrote), QUERY_HISTORY, LOGIN_HISTORY, SESSIONS, and INFORMATION_SCHEMA views. Account Usage views (in the SNOWFLAKE database) retain longer history than Information Schema, which is scoped and shorter. Object tagging and data classification support governance reporting. Access Transparency and Trust Center features help with compliance evidence.
Auditing patterns
Use ACCESS_HISTORY with flatten on the objects_modified and base_objects_accessed columns to trace column-level lineage. Row access policy and masking policy references appear in policy-related views. Resource monitors track credit consumption, not security events - a common trap.
Traps
- Assuming Information Schema retains a year of history - Account Usage generally retains longer.
- Confusing resource monitors (cost) with audit views (security).
- Forgetting that ACCESS_HISTORY requires the appropriate role and has latency.
- Believing query text alone proves which columns were accessed - use ACCESS_HISTORY for column-level detail.
Rule of thumb
For a compliance question, ask "what evidence view answers this?" - logins → LOGIN_HISTORY; who read which column → ACCESS_HISTORY; query performance and text → QUERY_HISTORY; cost → resource monitors and warehouse metering. Route audit data to external storage (e.g., via a reader account or export) for long-term retention.
Worked example
To find which roles read a sensitive column in the last 30 days, query ACCESS_HISTORY, flatten base_objects_accessed, filter on the column name, and group by role - then cross-check with masking policy references to confirm the policy was active.