Detections
Analytics

1.11 Ensure that all users granted the ACCOUNTADMIN role have a verified email address assigned

Information

Every Snowflake user can be assigned an email address. The email addresses are then used by Snowflake features like notification integration https://docs.snowflake.com/en/sql-reference/email-stored-procedures.html, resource monitor https://docs.snowflake.com/en/user-guide/resource-monitors.html and support cases https://docs.snowflake.com/en/user-guide/ui-support.html to deliver email notifications to Snowflake users. In trial Snowflake accounts these email addresses are used for password reset functionality.

The email addresses assigned to ACCOUNTADMIN users are used by Snowflake to notify administrators about important events related to their accounts. For example, ACCOUNTADMIN users are notified about impending expiration of SAML2 certificates or SCIM access tokens.

Email addresses must be verified before Snowflake will send notifications to the email address.

If users with the ACCOUNTADMIN role are not assigned working email addresses that are being monitored and if SAML2 certificate used in SSO integration is not proactively renewed, expiration of SAML2 certificate may break the SSO authentication flow. Similarly, uncaught expiration of SCIM access token may break the SCIM integration.

Additionally, emails assigned to ACCOUNTADMIN users can be used by Snowflake Support to contact account administrators in urgent situations.

Solution

Programmatically:

In a Snowsight worksheet or through the SnowSQL CLI:

 -

For every ACCOUNTADMIN user <username> that does not have email assigned run the following command to assign it:

ALTER USER <username>
 SET EMAIL = <email_address>;

 -

Start email verification for each ACCOUNTADMIN user <username> . Each user will then receive an email to validate their email address:

 SELECT SYSTEM$START_USER_EMAIL_VERIFICATION( '<username>' );

Impact:

None.

See Also

https://workbench.cisecurity.org/benchmarks/15569

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2

Plugin: Snowflake

Control ID: a34d78c3d5202f30b447adfcf09de6bfb88a5e1eeab017d832ee9b8821371d4f