Detections
Analytics

1.12 Ensure that no users have ACCOUNTADMIN or SECURITYADMIN as the default role

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The ACCOUNTADMIN system role is the most powerful role in a Snowflake account and is intended for performing initial setup and managing account-level objects. SECURITYADMIN role can trivially escalate their privileges to that of ACCOUNTADMIN Neither of these roles should be used for performing daily non-administrative tasks in a Snowflake account.

Instead, users should be assigned custom roles containing only those privileges that are necessary for successfully completing their job responsibilities.

When ACCOUNTADMIN is not set as a default user role, it forces account administrators to explicitly change their role to ACCOUNTADMIN each time they log in. This can help make account administrators aware of the purpose of roles in the system, prevent them from inadvertently using the ACCOUNTADMIN role for non-administrative tasks, and encourage them to change to the appropriate role for a given task. Same logic applies to the SECURITYADMIN role.

Solution

Programmatically:

In a Snowsight worksheet or through the SnowSQL CLI:

 -

For each user <user_name> who has ACCOUNTADMIN or SECURITYADMIN as their default role, choose a less privileged role <job_appropriate_role> appropriate for their daily job responsibilities and run the following query:

ALTER USER <user_name> SET DEFAULT_ROLE = <job_appropriate_role>;

Note: You could also unset the default role, thus forcing users to explicitly assume a role every time they log in.

Impact:

None.

See Also

https://workbench.cisecurity.org/benchmarks/14781

Item Details

References: CSCv7|4.3

Plugin: Snowflake

Control ID: 7e071f36dbc16dc0b23404fceea58d465ecbb3dd1061eccffbda3d3a910dcb47