Security in Snowflake: Complete Guide with Easy Definitions
What is Security in Snowflake?
Security in Snowflake refers to the mechanisms and controls used to protect data, users, and
system resources from unauthorized access, misuse, or breaches.
Snowflake provides end-to-end security by default and follows a shared responsibility model.
Simple Definition:
Security in Snowflake ensures that data is protected through access control, encryption,
authentication, and monitoring.
Why Security is Important in Snowflake
Snowflake security helps to: 1. Protect sensitive and confidential data 2. Meet compliance and
regulatory requirements 3. Prevent unauthorized access 4. Secure multi-user environments 5. Ensure
data integrity and availability
Snowflake Shared Responsibility Model
• Snowflake manages:
• Infrastructure security
• Encryption
• Network protection
• Customer manages:
• Users and roles
• Access control
• Data usage policies
Core Security Pillars in Snowflake
Snowflake security is built on four main pillars: 1. Identity & Access Management 2. Data Protection 3.
Network Security 4. Monitoring & Auditing
1
1. Identity & Access Management (IAM)
Authentication
Snowflake supports: - Username & password - Multi-Factor Authentication (MFA) - Single Sign-On (SSO) -
OAuth integration
Authorization (RBAC)
• Role-Based Access Control (RBAC)
• Privileges granted to roles
• Roles assigned to users
2. Data Protection
Data Encryption
Snowflake encrypts data: - At rest - In transit - Using strong encryption standards (AES-256)
Encryption is enabled by default.
Column-Level & Row-Level Security
• Masking policies (hide sensitive data)
• Row access policies (restrict rows per user)
Example use cases: - Hide salary columns - Restrict data by region
Data Masking Policies
CREATE MASKING POLICY mask_ssn AS (val STRING) RETURNS STRING ->
CASE
WHEN CURRENT_ROLE() IN ('ADMIN_ROLE') THEN val
ELSE 'XXX-XX-XXXX'
END;
3. Network Security
Snowflake provides: - Network policies - IP whitelisting - Private connectivity (Azure Private Link, AWS
PrivateLink)
2
4. Monitoring & Auditing
Access History
• Tracks who accessed what data
• Available through ACCOUNT_USAGE views
Query History
• Monitors executed queries
• Useful for auditing and troubleshooting
Secure Data Sharing
• Share live data without copying
• Controlled by roles and privileges
• Read-only access to consumers
Compliance & Certifications
Snowflake supports: - SOC 1, SOC 2 - ISO 27001 - GDPR - HIPAA - PCI DSS
Security Best Practices
1. Enable MFA for all users
2. Use role hierarchy and least privilege
3. Mask sensitive data
4. Monitor access logs
5. Separate admin and user roles
Common Security Mistakes
• Using ACCOUNTADMIN for daily work
• Not enabling MFA
• Over-granting privileges
• Ignoring audit logs
Security in Real-Time Projects
Typical security setup: - ADMIN roles for management - ETL roles for ingestion - TRANSFORM roles for
dbt - ANALYST roles for reporting
3
Summary
• Snowflake provides strong built-in security
• Encryption is automatic
• RBAC controls access
• Advanced policies protect sensitive data
• Auditing ensures compliance
One-Line Definition:
Security in Snowflake is a comprehensive framework that protects data through
encryption, access control, authentication, and continuous monitoring.