snowflake-security-basics

# Snowflake Security Basics ## Overview Security best practices for Snowflake: network policies, key pair rotation, MFA, secret management, and least-privilege roles. ## Prerequisites - SECURITYADMIN or ACCOUNTADMIN role access - Understanding of network CIDR notation - Secret management solution (Vault, AWS Secrets Manager, etc.) ## Instructions ### Step 1: Create Network Policies ```sql -- Restrict access to known IP ranges CREATE OR REPLACE NETWORK POLICY corporate_policy ALLOWED_IP_LIST = ( '203.0.113.0/24', -- Corporate office '198.51.100.0/24', -- VPN range '10.0.0.0/8' -- Internal network ) BLOCKED_IP_LIST = ( '203.0.113.99' -- Block specific IP ); -- Apply to entire account ALTER ACCOUNT SET NETWORK_POLICY = corporate_policy; -- Or apply to specific user (service account) ALTER USER svc_etl SET NETWORK_POLICY = corporate_policy; -- Verify current policy SELECT * FROM TABLE(INFORMATION_SCHEMA.POLICY_REFERENCES(POLICY_NAME => 'corporate_policy')); ``` ### Step 2: Configure Key Pair Rotation ```bash #!/bin/bash # rotate-snowflake-keys.sh # Generate new key pair openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key_new.p8 -nocrypt openssl rsa -in rsa_key_new.p8 -pubout -out rsa_key_new.pub # Extract public key (remove headers and newlines) PUB_KEY=$(grep -v "BEGIN\|END" rsa_key_new.pub | tr -d '\n') echo "Run in Snowflake:" echo "ALTER USER svc_etl SET RSA_PUBLIC_KEY_2 = '${PUB_KEY}';"...