Secure Snowflake with cnspec

Scan your Snowflake accounts to find security risks before they become incidents. cnspec evaluates user authentication policies, network access rules, role and privilege configurations, password policies, and dozens of other Snowflake controls.

If you're new to cnspec, start with the Quickstart. For an overview of every SaaS service cnspec can scan, see the SaaS scanning overview.

Prerequisites

To scan a Snowflake account with cnspec, you must have:

• cnspec installed on your workstation
• A Snowflake account with a role that has read access to account-level configuration (such as ACCOUNTADMIN or SECURITYADMIN)

Authenticate

To connect, cnspec needs your Snowflake:

• account identifier
• region
• user
• role with privileges to read account-level configuration (such as ACCOUNTADMIN or SECURITYADMIN)

cnspec supports three authentication methods:

• Programmatic access token (PAT) (recommended): Pass a programmatic access token with --token. Snowflake is phasing out password sign-ins, so use a PAT where you can. You can't combine --token with --password or --ask-pass.
• Key-pair authentication: Pass the path to your RSA private key with --identity-file (-i). See Key-pair authentication and key-pair rotation in the Snowflake documentation.
• Password (legacy): Set the password with --password (-p), or use --ask-pass to be prompted.

Connection options

Verify with a quick Snowflake check

Confirm that cnspec can reach your Snowflake account by opening a cnspec shell with a programmatic access token:

cnspec shell snowflake --account ACCOUNT-ID --region REGION --user YOUR-USER-ID --role YOUR-ROLE --token YOUR-PAT

To authenticate with an RSA key pair instead, pass the private key file:

cnspec shell snowflake --account ACCOUNT-ID --region REGION --user YOUR-USER-ID --role YOUR-ROLE --identity-file PATH-TO-KEY

Note: Use an unencrypted private key. The CLI can't supply a passphrase to unlock an encrypted key file.

Scan Snowflake

cnspec scan snowflake --account ACCOUNT-ID --region REGION --user YOUR-USER-ID --role YOUR-ROLE --token YOUR-PAT

When a scan completes, cnspec prints a summary of all the checks it ran, grouped by policy, along with a risk score from 0 (no risk) to 100 (highest risk). Failed checks include remediation guidance to help you fix issues. To learn more about reading scan results, read Understand cnspec Results.

Scan with the Mondoo Snowflake Security policy

Mondoo maintains an out-of-the-box Snowflake Security policy that checks user authentication, network policies, password requirements, and more.

Mondoo Platform users: Enable the policy in your space. In the Mondoo App, go to Findings > Policies, search for "Snowflake", and add the policy. To learn more, read Manage policies in Mondoo Platform.

Open source users: Pass the policy bundle URL directly to cnspec:

cnspec scan snowflake --account ACCOUNT-ID --region REGION --user YOUR-USER-ID --role YOUR-ROLE --token YOUR-PAT \
  --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-snowflake-security.mql.yaml

You can also create your own policies to meet your specific requirements.

Explore and test checks interactively

Open a cnspec shell to discover resources and try out checks.

List all users

cnspec> snowflake.account.users
snowflake.account.users: [
  0: snowflake.user name="STELLA"
  1: snowflake.user name="MWEZI"
  2: snowflake.user name="SNOWFLAKE"
]

Find users without MFA

cnspec> snowflake.account.users.where(hasMfa == false)

Find service (machine) users

cnspec> snowflake.account.users.where(type == "SERVICE")

List authentication policies

cnspec> snowflake.account.authenticationPolicies { name mfaEnrollment authenticationMethods }

List resource monitors

cnspec> snowflake.account.resourceMonitors { name creditQuota usedCredits }

List all databases

cnspec> snowflake.account.databases

Example security checks

Ensure MFA is enabled for all human users

cnspec> snowflake.account.users.where(disabled == false && type == "PERSON").all(hasMfa == true)
[ok] value: true

Ensure account administrators have MFA enabled

cnspec> snowflake.account.accountAdmins.all(hasMfa == true)
[ok] value: true

Ensure an authentication policy requires MFA enrollment

cnspec> snowflake.account.authenticationPolicies.any(mfaEnrollment == "REQUIRED")
[ok] value: true

Ensure network policies are configured

cnspec> snowflake.account.networkPolicies.length > 0
[ok] value: true

Ensure an account-level network policy is set

cnspec> snowflake.account.networkPolicy != ""
[ok] value: true

Ensure password policies enforce minimum length

cnspec> snowflake.account.passwordPolicies.all(passwordMinLength >= 14)
[ok] value: true

Ensure password policies enforce password history

cnspec> snowflake.account.passwordPolicies.all(passwordHistory >= 5)
[ok] value: true

Ensure session policies enforce an idle timeout

cnspec> snowflake.account.sessionPolicies.all(sessionIdleTimeoutMins <= 60)
[ok] value: true

Ensure a resource monitor caps credit usage

cnspec> snowflake.account.resourceMonitors.length > 0
[ok] value: true

Ensure SCIM provisioning is enabled

cnspec> snowflake.account.securityIntegrations.where(type == /SCIM/).any(enabled == true)
[ok] value: true

Ensure databases have Time Travel retention configured

cnspec> snowflake.account.databases.all(retentionTime > 0)
[ok] value: true

Learn more

• Snowflake Resource Pack Reference: every Snowflake resource and field cnspec can query
• Write Effective MQL: guide to authoring checks and queries