Detections
Analytics

2.7 Ensure monitoring and alerting exists for new share exposures

Information

Snowflake tables, views and UDFs can be shared across Snowflake accounts using share objects created by data providers and imported by data consumers.

To expose a share to another account, the share provider account needs to add or set consumer accounts on a share using the ALTER SHARE command. The consumer account can then import the share using the CREATE DATABASE FROM SHARE command.

A share exposed to another Snowflake account can be used for data exfiltration.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Programmatically:

In a Snowsight worksheet or through the SnowSQL CLI:

 -

Configure your security monitoring solution to alert on new share exposures. The following query can be run periodically.

select end_time,
 query_type,
 query_text,
 user_name,
 role_name
from snowflake.account_usage.query_history
where execution_status = 'SUCCESS'
 and query_type = 'ALTER'
 and regexp_instr(query_text, '^alter\\\\s*share.*(add|set)\\\\s*accounts\\\\s*=', 1, 1, 0, 'is') > 0
order by end_time desc;

Impact:

If exposing shares to another account event happens frequently, monitoring and alerting on this event may generate undue load on the detection and response team.

See Also

https://workbench.cisecurity.org/benchmarks/15569

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-6, 800-53|AU-6(1), 800-53|AU-7(1), CSCv7|6.7

Plugin: Snowflake

Control ID: 88fca76d3081185a34e4fa81026b7b8b099d4096c398620742a9ec5e55902282