How to govern Security in Snowflake
A step-by-step guide to governing Security in Snowflake with Rencore: detect, review by owner and severity, and remediate with an audit trail.
Governing Security in Snowflake means finding where it goes wrong, reviewing the findings by owner and severity, and remediating with an audit trail. Rencore covers this concern for Snowflake with the pre-built controls below, so it becomes a repeatable check rather than a one-off cleanup. The steps that follow apply the same detect, review, remediate loop to Security.
Steps
-
Inventory Snowflake
Connect Snowflake and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.
-
Detect with policies
Turn on the pre-built policies that cover Security in Snowflake to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.
-
Review by owner and severity
Use the Snowflake reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.
-
Remediate and automate
Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.
Snowflake controls for Security
Grounded in the Rencore catalog. See the full Snowflake catalog on the Snowflake connector page.
-
Snowflake user is active
Active users are live identities that can authenticate, raising the likelihood that a weakness is exploited
Severity: Medium -
Snowflake stage is external
External stages are internet-facing data paths, raising the likelihood that a weakness leads to exfiltration
Severity: Medium -
Snowflake network policy is unrestricted
Unrestricted network policies expose a wide-open surface, raising the likelihood that a weakness is reachable
Severity: Medium -
Disabled Snowflake users with role grants
Detects disabled users that still have role grants assigned
Severity: High -
Snowflake users without MFA
Detects active users that do not have multi-factor authentication enabled
Severity: High -
Snowflake account with too many role grants
Detects accounts with more than 10 role grants
Severity: Medium -
Snowflake external volumes that allow writes
Detects external volumes configured to allow writes to external storage
Severity: Medium -
Snowflake schemas without managed access
Detects schemas that are not configured with managed access
Severity: Medium -
Snowflake outbound (HOST_PORT) network rules
Detects network rules of type HOST_PORT that define external egress destinations
Severity: Medium -
Snowflake stages with stored credentials
Detects stages that store inline credentials instead of using a storage integration
Severity: High -
Snowflake external stages without a storage integration
Detects external stages that do not use a storage integration
Severity: Medium -
Snowflake databases owned by ACCOUNTADMIN
Detects databases whose owning role is ACCOUNTADMIN
Severity: Medium -
Snowflake warehouses owned by ACCOUNTADMIN
Detects warehouses whose owning role is ACCOUNTADMIN
Severity: Medium -
Snowflake schemas owned by ACCOUNTADMIN
Detects schemas whose owning role is ACCOUNTADMIN
Severity: Low -
Snowflake secrets owned by ACCOUNTADMIN
Detects secrets whose owning role is ACCOUNTADMIN
Severity: Medium -
Snowflake stages owned by ACCOUNTADMIN
Detects stages whose owning role is ACCOUNTADMIN
Severity: Low -
Snowflake users defaulting to ACCOUNTADMIN
Detects active users whose default role is the privileged ACCOUNTADMIN role
Severity: High -
Snowflake network policies with no IP or network-rule restriction
Detects network policies that define neither an allowed IP list nor any allowed network rule
Severity: High -
Snowflake users with password-only authentication
Detects active users that have neither MFA nor a key-pair configured
Severity: High -
Snowflake service accounts using password authentication
Detects SERVICE-type users that have a password set instead of key-pair authentication
Severity: High
