Detections
Analytics

1.18 Ensure that an account-level authentication policy has been configured to require network policies when using Programmatic Access Tokens (PATs)

Information

Snowflake supports Programmatic Access Tokens (PATs) as a time-limited alternative to passwords, with additional security mitigations such as requiring a network policy. A network policy is required by default to use PATs to log in, but this behavior is configurable through authentication policies.

While PATs are more secure than passwords due to their ephemeral nature, PATs are at risk of being accidentally leaked and used by a threat actor to log in. A network policy provides a second line of defense to ensure that logins to the user only come from known, trusted IP addresses.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Programmatically :

In a Snowsight worksheet or through the SnowSQL CLI:

 -

Create an authentication policy that sets the NETWORK_POLICY_EVALUATION to ENFORCED_REQUIRED in the PAT_POLICY. NOTE: If you already have an account-level authentication policy, you can alter the existing policy to set NETWORK_POLICY_EVALUATION:

CREATE AUTHENTICATION POLICY <policy_name> PAT_POLICY=(NETWORK_POLICY_EVALUATION=ENFORCED_REQUIRED);

 -

Set the authentication policy at the account level:

ALTER ACCOUNT SET AUTHENTICATION POLICY <policy_name>;

Impact:

If network policies are not currently required in the account, existing automation that uses PATs to connect to users that are not subject to a network policy will fail until the user is assigned a network policy.

See Also

https://workbench.cisecurity.org/benchmarks/15569

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2

Plugin: Snowflake

Control ID: d93f0e9c1c64e8f85e6e70584bcbf5ded4f14167dd4ce011d178e7d06c5f819a