Skip to content

Snowflake configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On Snowflake, Black Cat runs 10 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Snowflake connector needs.

Checks (10)

severity: medium Low Data Retention fix difficulty: easy #

Increase the minimum data retention period to at least 7 days to support point-in-time recovery

  1. Connect to Snowflake as ACCOUNTADMIN
  2. Increase the minimum retention period: ALTER ACCOUNT SET MIN_DATA_RETENTION_TIME_IN_DAYS = 7;
  3. Verify the setting: SHOW PARAMETERS LIKE 'MIN_DATA_RETENTION_TIME_IN_DAYS' IN ACCOUNT;
  4. For critical databases, set higher retention: ALTER DATABASE <db_name> SET DATA_RETENTION_TIME_IN_DAYS = 14;
  5. Review your data recovery SLA and set retention accordingly (max 90 days on Enterprise tier)
  6. Document the retention policy in your data governance records

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-316.b NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium SSO Login Page Disabled fix difficulty: easy #

Enable the federated SSO login page so users can authenticate via your identity provider

  1. Connect to Snowflake as ACCOUNTADMIN
  2. Enable the SSO login page: ALTER ACCOUNT SET SSO_LOGIN_PAGE = TRUE;
  3. Verify the setting: SHOW PARAMETERS LIKE 'SSO_LOGIN_PAGE' IN ACCOUNT;
  4. Ensure a SAML2 security integration is configured and active
  5. Test SSO login flow via https://app.snowflake.com/<account>
  6. Communicate the SSO login URL to users and update internal documentation

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium No SSO Configured fix difficulty: hard #

Configure a SAML2 security integration to enable SSO via your corporate identity provider

  1. Obtain your IdP SAML2 metadata (issuer, SSO URL, x509 certificate) from your identity provider
  2. Connect to Snowflake as ACCOUNTADMIN
  3. Create the SAML2 integration: CREATE SECURITY INTEGRATION corp_sso TYPE = SAML2 ENABLED = TRUE SAML2_ISSUER = '<idp_entity_id>' SAML2_SSO_URL = '<idp_sso_url>' SAML2_PROVIDER = '<provider>' SAML2_X509_CERT = '<cert>';
  4. Enable the SSO login page: ALTER ACCOUNT SET SSO_LOGIN_PAGE = TRUE;
  5. Configure your IdP with the Snowflake service provider metadata: DESCRIBE INTEGRATION corp_sso;
  6. Test the SSO flow and document the login URL for users

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium No SCIM Configured fix difficulty: hard #

Configure a SCIM security integration to enable automated user provisioning and deprovisioning

  1. Connect to Snowflake as ACCOUNTADMIN
  2. Create the SCIM integration: CREATE SECURITY INTEGRATION scim_provisioning TYPE = SCIM ENABLED = TRUE SCIM_CLIENT = '<provider>' RUN_AS_ROLE = USERADMIN;
  3. Generate a SCIM access token: SELECT SYSTEM$GENERATE_SCIM_ACCESS_TOKEN('scim_provisioning');
  4. Configure your IdP (Okta, Azure AD, etc.) with the Snowflake SCIM endpoint and the access token
  5. Verify user sync: SHOW USERS; — confirm provisioned users appear
  6. Enable automatic deprovisioning by configuring deprovision actions in your IdP

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Warehouse No Auto Suspend fix difficulty: easy #

Enable auto-suspend on the warehouse to automatically stop it after a period of inactivity

  1. Connect to Snowflake as ACCOUNTADMIN or SYSADMIN
  2. Enable auto-suspend with a 5-minute timeout: ALTER WAREHOUSE <warehouse_name> SET AUTO_SUSPEND = 300;
  3. Verify the setting: SHOW WAREHOUSES LIKE '<warehouse_name>';
  4. Adjust the timeout based on workload patterns (lower for dev/test, higher for interactive query warehouses)
  5. Monitor warehouse credit usage in the Snowsight Admin > Warehouses view
  6. Set up resource monitors to alert on unexpected credit consumption

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Warehouse No Auto Resume fix difficulty: easy #

Enable auto-resume on the warehouse so it starts automatically when queries arrive

  1. Connect to Snowflake as ACCOUNTADMIN or SYSADMIN
  2. Enable auto-resume: ALTER WAREHOUSE <warehouse_name> SET AUTO_RESUME = TRUE;
  3. Verify the setting: SHOW WAREHOUSES LIKE '<warehouse_name>';
  4. Ensure auto-suspend is also enabled to balance availability with cost
  5. Test by submitting a query after the warehouse has suspended to confirm it resumes
  6. Monitor the warehouse start latency for latency-sensitive workloads

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Warehouse No Resource Monitor fix difficulty: easy #

Assign a resource monitor to the warehouse to track and cap credit usage

  1. Connect to Snowflake as ACCOUNTADMIN
  2. Create a resource monitor if one does not exist: CREATE RESOURCE MONITOR wh_monitor WITH CREDIT_QUOTA = 100 TRIGGERS ON 80 PERCENT DO NOTIFY ON 100 PERCENT DO SUSPEND;
  3. Assign it to the warehouse: ALTER WAREHOUSE <warehouse_name> SET RESOURCE_MONITOR = wh_monitor;
  4. Verify the assignment: SHOW WAREHOUSES LIKE '<warehouse_name>';
  5. Configure notification recipients via Admin > Resource Monitors in Snowsight
  6. Review credit usage weekly to adjust quotas as needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Warehouse Oversized fix difficulty: medium #

Downsize the warehouse to an appropriate size for its workload to reduce credit consumption

  1. Connect to Snowflake as ACCOUNTADMIN or SYSADMIN
  2. Review historical query performance: SELECT warehouse_name, avg(execution_time), avg(queued_overload_time) FROM snowflake.account_usage.query_history WHERE warehouse_name = '<warehouse_name>' GROUP BY 1;
  3. If queued_overload_time is low, the warehouse may be oversized
  4. Resize the warehouse: ALTER WAREHOUSE <warehouse_name> SET WAREHOUSE_SIZE = 'LARGE'; (or MEDIUM/SMALL as appropriate)
  5. Monitor query performance and credit usage for one week after the change
  6. Scale back up if query execution times increase significantly

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium No Account Resource Monitor fix difficulty: medium #

Create an account-level resource monitor to track and cap total credit consumption

  1. Connect to Snowflake as ACCOUNTADMIN
  2. Create an account-level resource monitor: CREATE RESOURCE MONITOR account_monitor WITH CREDIT_QUOTA = 1000 FREQUENCY = MONTHLY START_TIMESTAMP = IMMEDIATELY TRIGGERS ON 75 PERCENT DO NOTIFY ON 90 PERCENT DO NOTIFY ON 100 PERCENT DO SUSPEND_IMMEDIATE;
  3. Assign the monitor to the account: ALTER ACCOUNT SET RESOURCE_MONITOR = account_monitor;
  4. Verify the assignment: SHOW PARAMETERS LIKE 'RESOURCE_MONITOR' IN ACCOUNT;
  5. Configure email notification recipients in Snowsight under Admin > Resource Monitors
  6. Review and adjust the credit quota based on historical usage trends

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Resource Monitor Notify Only fix difficulty: easy #

Add suspend or suspend-immediate triggers to the resource monitor so it automatically stops warehouses at the credit limit

  1. Connect to Snowflake as ACCOUNTADMIN
  2. View the current monitor configuration: SHOW RESOURCE MONITORS;
  3. Update the monitor to add suspend triggers: ALTER RESOURCE MONITOR <monitor_name> TRIGGERS ON 90 PERCENT DO NOTIFY ON 100 PERCENT DO SUSPEND ON 110 PERCENT DO SUSPEND_IMMEDIATE;
  4. Verify the updated triggers: SHOW RESOURCE MONITORS;
  5. Test by reviewing the trigger thresholds relative to current usage via Snowsight Admin > Resource Monitors
  6. Adjust thresholds to avoid unintentionally suspending production workloads

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More Snowflake checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial