snowflake-policy-guardrails

# Snowflake Policy & Guardrails ## Overview Automated policy enforcement and governance guardrails using Snowflake-native features: network rules, authentication policies, session policies, and object-level governance. ## Instructions ### Step 1: Network Rules and Policies ```sql -- Network rules (more granular than legacy network policies) CREATE OR REPLACE NETWORK RULE corp_vpn_rule TYPE = IPV4 MODE = INGRESS VALUE_LIST = ('203.0.113.0/24', '198.51.100.0/24'); CREATE OR REPLACE NETWORK RULE cloud_services_rule TYPE = HOST_PORT MODE = EGRESS VALUE_LIST = ('api.company.com:443', 'events.company.com:443'); -- Create network policy using rules CREATE OR REPLACE NETWORK POLICY prod_network_policy ALLOWED_NETWORK_RULE_LIST = (corp_vpn_rule) BLOCKED_NETWORK_RULE_LIST = (); -- Apply at account level ALTER ACCOUNT SET NETWORK_POLICY = prod_network_policy; -- Or per-user (service accounts can have different rules) ALTER USER svc_etl SET NETWORK_POLICY = prod_network_policy; ``` ### Step 2: Authentication Policies ```sql -- Require MFA for interactive users CREATE OR REPLACE AUTHENTICATION POLICY interactive_auth MFA_AUTHENTICATION_METHODS = ('TOTP') CLIENT_TYPES = ('SNOWFLAKE_UI', 'SNOWSQL') SECURITY_INTEGRATIONS = ('saml_sso'); -- Service accounts: key pair only, no password CREATE OR REPLACE AUTHENTICATION POLICY service_auth AUTHENTICATION_METHODS = ('KEYPAIR') CLIENT_TYPES = ('SNOWFLAKE_DRIVER') MFA_AUTHENTICATION_METHODS = (); -- Apply po...