Snowflake security audit checklist

Who holds ACCOUNTADMIN?

SELECT grantee_name FROM snowflake.account_usage.grants_to_users
WHERE role='ACCOUNTADMIN' AND deleted_on IS NULL;

Keep it to 2 or 3 named people, with MFA.

Password users without MFA: check ACCOUNT_USAGE.USERS (has_password, ext_authn_duo) and LOGIN_HISTORY.

Failed logins:

SELECT user_name, COUNT(*) FROM snowflake.account_usage.login_history
WHERE is_success='NO' AND event_timestamp > DATEADD(day,-30,CURRENT_TIMESTAMP())
GROUP BY 1 ORDER BY 2 DESC;

Grants to PUBLIC on databases, schemas and tables.
Dormant users with no login in 90 days.
Network policies on the account and on service users.
Masking coverage for PII-tagged columns.

Ready-made SQL from Thyne Ventures

Snowflake RBAC & Security Audit Kit ($39): 11 SQL scripts for MFA, admin roles, grants, logins and masking coverage.

Snowflake Cost + Security Audit Bundle ($79): All 21 cost and security scripts together.

Published by Thyne Ventures. Snowflake is a trademark of Snowflake Inc.; we are not affiliated.