Snowflake Security: Securing Your Snowflake Data Cloud

Table of Contents
About the Authors
About the Technical Reviewers
Acknowledgments
Foreword
Introduction
Let’s Get Started
Chapter 1: Snowflake Organization Structure
	1.1. Single Account vs. Multiple Accounts
		1.1.1. Scaling Multiple Accounts Management
	1.2. Choosing the Right Pricing Plan
	1.3. Summary
Chapter 2: Infrastructure Security
	2.1. Account Data Storage
	2.2. Access to the Stored Data
		2.2.1. The Standard Multi-tenant Deployment
		2.2.2. Business Critical Edition
		2.2.3. Virtual Private Snowflake
		2.2.4. PrivateLink
	2.3. Access to Historical Data
		2.3.1. Stage Data
		2.3.2. Internal or External Backup
		2.3.3. Time Travel
		2.3.4. Fail-Safe
	2.4. Good to Know
	2.5. Summary
Chapter 3: Data Encryption and Ingestion
	3.1. Encryption of Data in Transit
	3.2. Encryption at Rest
		3.2.1. Uploading Files to Staging Areas
		3.2.2. Snowflake-Provided Staging Areas
		3.2.3. Customer-Provided Staging Areas
		3.2.4. Using Storage Integration
		3.2.5. How Snowflake Encrypts Your Data in Tables
			Snowflake Hierarchical Key Model
		3.2.6. Unloading Files to Staging Areas
		3.2.7. External Tables
		3.2.8. Customer Managed Keys
		3.2.9. Application-Level Encryption
	3.3. Summary
Chapter 4: Authentication: Keeping Strangers Out
	4.1. Users Management
	4.2. User Provisioning
		4.2.1. SCIM Integration
			Okta Integration
				User Management
				Role Management
				Security Considerations
				ACME Candies Wants This!
			Azure Active Directory Integration
				Setting Up the Integration in Snowflake
				Setting Up the Integration in Azure
			Other SCIM
			Assigning a Network Policy over SCIM
			SCIM Token Management
			Debugging and Monitoring SCIM
		4.2.2. User Provisioning Using SQL Integration
		4.2.3. Combining SCIM and SQL Integration
	4.3. Authentication Types
		4.3.1. Built-In Authentication
			Password Policy Enforcement
			Client Sessions Keep Alive
			Multifactor Authentication (MFA) in Snowflake
				Setting Up MFA in Snowflake
				So... Should You Use It?
		4.3.2. Federation: Single Sign-On (SSO) Integration
			Setting Up SAML 2.0 Federated Authentication
				Setting Up SSO Integration with Okta
				Setting Up SSO Integration with Other SAML 2.0 Providers
			SSO for Code
				SSO Connection Caching
				SSO with Automated Okta Authentication
			SSO for BI Tools
		4.3.3. Nonhuman Authentication
			Key-Pair Authentication
				Using Key-Pair Authentication in Production
				Rotating Your Key Pairs
			Snowflake SQL API
				SQL API Security Notes
			Preventing SQL Injection in Application Queries
		4.3.4. Compensating Factors in Authentication
	4.4. Summary
Chapter 5: Network Access Control
	5.1. How Do Network Access Policies Work?
		5.1.1. Setting Up Account-Level Network Policy
		5.1.2. Setting Up User-Level Network Policy
		5.1.3. Limitations
			No Group-Level Granularity
				Workarounds
			No Granularity Within Account
				Workarounds
			Network Policies Are Only IPv4
	5.2. PrivateLink Integrations
	5.3. Summary
Chapter 6: Authorization: Data Access Control
	6.1. Data Access Models
		6.1.1. MAC (Mandatory Access Control)
		6.1.2. DAC (Discretionary Access Control)
		6.1.3. ABAC (Attribute-Based Access Control)
		6.1.4. RBAC (Role-Based Access Control)
	6.2. Snowflake Access Control Model
		6.2.1. Snowflake Security Model
		6.2.2. The Built-In Roles in Snowflake
	6.3. Designing Your Role Architecture
		6.3.1. Document Your Role Architecture
		6.3.2. Privilege Granting
		6.3.3. Approaches to Access Management
			IdP-Dominated Access
			Classic Snowflake Role Management
			Per Project Roles
			Role Per User
			Functional Roles Coupled with Access Roles
			Role Hierarchy
				Hierarchy Hell
			Self-Service: Data Access Provisioning
				Role Creation Delegation
				Building a Self-Service Portal
			Third-Party Solutions
		6.3.4. Creating Your Own Blend of Data Access
	6.4. Fine-Grained Data Access Control
		6.4.1. Column-Based Access Control
			Static Cloning of Data
			Abstraction by Using Secure Views
			Dynamic Masking
			Column-Based Security for Semi-structured Data
			De-tokenization and Decryption
		6.4.2. Row-Based Access Control
			Implementing Row-Level Security Static Copies
			Implementing Row-Level Security Using Secure Views
			Abstraction by Using Secure UDFs
			Row-Level Security in Semi-structured Data
			Snowflake Row Access Policies
			Hierarchical Row-Level Security
		6.4.3. Combining Column and Row Security
		6.4.4. Attribute-Based Access Control
		6.4.5. Self-Service Access Control
		6.4.6. Third-Party Solutions
	6.5. Rolling Out Access Control Changes
	6.6. Summary
Chapter 7: Auditing and Monitoring
	7.1. Snowflake Audits Characteristics
		7.1.1. Every Operation Is Audited
		7.1.2. Audits Are Available via… Snowflake
	7.2. Snowflake Metadata
		7.2.1. Account Usage vs. Information Schema
		7.2.2. Relevant Views for Security in Snowflake.account_usage
			GRANTS_TO_ROLES
				Examples
			GRANTS_TO_USERS
				Examples
			LOGIN_HISTORY
				Examples
			SESSIONS
				Examples
			MASKING_POLICIES
				Examples
			POLICY_REFERENCES
				Examples
			QUERY_HISTORY
				Examples
			ROLES
				Examples
			STAGES
				Examples
			TASK_HISTORY
				Examples
			USERS
			Examples
			ACCESS_HISTORY
			Examples
		7.2.3. The Reader Accounts Schema
		7.2.4. Views in the Information Schema
			APPLICABLE_ROLES
				Examples
			ENABLED_ROLES
			OBJECT_PRIVILEGES
				Examples
			STAGES
				Examples
			TABLE_PRIVILEGES
				Examples
			Other Views
		7.2.5. Table Functions in the Information Schema
			EXTERNAL_FUNCTIONS_HISTORY
				Examples
			LOGIN_HISTORY
				Examples
			LOGIN_HISTORY_BY_USER
				Examples
			POLICY_REFERENCES
			QUERY_HISTORY
				Examples
			QUERY_HISTORY_BY_*
			REST_EVENT_HISTORY
				Examples
			Other Table Functions
		7.2.6. Use Cases
			Database Access Monitoring
				Examples
			Finding Admin Role Abuses
				Examples
			Monitoring Administrative Operations and Configuration Changes
				Examples
			Managing Overprivileged Users
				Examples
			Monitoring Usage of Vulnerable Drivers
	7.3. Object Tagging
	7.4. How to Monitor?
		7.4.1. Using Tasks to Prepare Data
			Examples
		7.4.2. Building a Snowsight Security Dashboard
			Failed Logins Tile
			Users Connecting from the Most IPs Tile
			Users with Admin Roles Tile
	7.5. Alerting
		7.5.1. Using Custom Scripting
		7.5.2. Using Tasks and External Functions
		7.5.3. Using SnowAlert
	7.6. Using Third-Party Vendors for Monitoring, Auditing, and Alerting
	7.7. Summary
Chapter 8: Secure Data Sharing with Snowflake
	8.1. Direct Share
		8.1.1. Consuming Shared Data
		8.1.2. Sharing Partial Data Using Secure Objects
			Using Secure Views
			Using Dynamic Secure Views
			Using Secure UDFs
			Using Secure Joins
	8.2. Data Exchange and the Snowflake Data Marketplace
		8.2.1. Managing Data Exchange
	8.3. Reader Accounts
	8.4. Distributed Data Clean Rooms
	8.5. Summary
Chapter 9: Snowflake for Security
	9.1. How We Got Here
		9.1.1. In Comes SIEM
		9.1.2. Snowflake As a Security Data Lake
	9.2. Why Snowflake for a Security Data Lake
		9.2.1. Ease of Integration
		9.2.2. Scalability and Features
		9.2.3. Enrichments with Data Marketplace Sources
		9.2.4. Sharing Is Easy
	9.3. SnowAlert
		9.3.1. Getting Started
		9.3.2. Running SnowAlert
		9.3.3. Managing SnowAlert
		9.3.4. SnowAlert Data
	9.4. Summary
Epilogue
Index