Detections
Analytics

2.8 Ensure monitoring and alerting exists for new share exposures

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Snowflake tables, views and UDFs can be shared across Snowflake accounts using share objects created by data providers and imported by data consumers.

To expose a share to another account, the share provider account needs to add or set consumer accounts on a share using the ALTER SHARE command. The consumer account can then import the share using the CREATE DATABASE FROM SHARE command.

A share exposed to another Snowflake account can be used for data exfiltration.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Programmatically:

In a Snowsight worksheet or through the SnowSQL CLI:

 -

Configure your security monitoring solution to alert on new share exposures. The following query can be run periodically.

select end_time, query_type, query_text, user_name, role_namefrom snowflake.account_usage.query_historywhere execution_status = 'SUCCESS' and query_type = 'ALTER' and regexp_instr(query_text, '^alter\\s*share.*(add|set)\\s*accounts\\s*=', 1, 1, 0, 'is') > 0order by end_time desc;

Impact:

If exposing shares to another account event happens frequently, monitoring and alerting on this event may generate undue load on the detection and response team.

See Also

https://workbench.cisecurity.org/benchmarks/14781

Item Details

References: CSCv7|6.7

Plugin: Snowflake

Control ID: 44a4295be1c26b7abd943866fb00a5ec6ec18c2aa52e69e950e20637830a1e72