Detections
Analytics

1.19 Ensure that an account-level authentication policy has been configured to require Programmatic Access Tokens be rotated at least every 90 days

Information

Snowflake supports Programmatic Access Tokens (PATs) as a time-limited alternative to passwords.

PATs expire after 15 days by default, but can be configured to remain active for up to the account's maximum expiration time, which defaults to 365 days. The MAX_EXPIRY_IN_DAYS property can be specified in an authentication policy to reduce the maximum allowed expiration time to less than 365 days.

PATs can be rotated to extend the expiration time. Snowflake also allows a single user to have multiple active PATs to avoid service disruption.

More frequent rotation of credentials mitigates the risk of a compromised or leaked PAT. It reduces the window of opportunity during which a given PAT is valid and can be used by a threat actor.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Programmatically:

In a Snowsight worksheet or through the SnowSQL CLI:

 - Create an authentication policy that sets the MAX_EXPIRY_IN_DAYS in the PAT_POLICY. NOTE: If you already have an account-level authentication policy, you can alter the existing policy to set MAX_EXPIRY_IN_DAYS:
CREATE AUTHENTICATION POLICY <policy_name> PAT_POLICY=(MAX_EXPIRY_IN_DAYS=90);

 - Set the authentication policy at the account level:
 ALTER ACCOUNT SET AUTHENTICATION POLICY <policy_name>;

Impact:

Existing automation and services that rely on PATs may break if they are not updated to use a new PAT before the old PAT expires.

See Also

https://workbench.cisecurity.org/benchmarks/15569

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2

Plugin: Snowflake

Control ID: 1e28a161f6a5e77ff95d3c23fb8fff9ab1bd1dfc693294a72f168515f475940d