Detections
Analytics
2.2 Ensure monitoring and alerting exist for MANAGE GRANTS privilege grants
Information
The MANAGE GRANTS privilege is one of the most powerful privileges in the Snowflake environment. This privilege gives the ability to grant or revoke privileges on any object as if the invoking role were the owner of the object.A custom role with the MANAGE GRANTS privilege on account level will not be able to grant privileges on the account level as that privilege is implicitly reserved for the ACCOUNTADMIN and SECURITYADMIN roles. However, such custom roles will be able to grant any privileges on any objects below the account level.
Following the principle of least privilege and given how powerful the MANAGE GRANTS privilege is, any new MANAGE GRANTS privilege grants should be scrutinized.
Every new role granted the MANAGE GRANTS privilege increases the attack surface of a Snowflake environment. It may also indicate unauthorized privilege escalation performed by a threat actor.
If monitoring for MANAGE GRANTS privilege grants is not configured, inappropriate or unauthorized MANAGE GRANTS privilege grants may be missed. The latter can lead to eventual security posture degradation or late detection of an ongoing security incident.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Programmatically:In a Snowsight worksheet or through the SnowSQL CLI:
- Configure your monitoring task to alert on manage grants privilege grants. Note that this query will return grants even if they have since been revoked, as these may still be worth investigating.
set last_scan_time = '<last scan time>';
select
grantee_name as role_name,
granted_by,
created_on,
deleted_on
from snowflake.account_usage.grants_to_roles
where privilege = 'MANAGE GRANTS'
and created_on > $last_scan_time
order by created_on desc;
Impact:
If MANAGE GRANTS privilege grants happen frequently, monitoring and alerting on this event may generate undue load on the detection and response team.
See Also
Item Details
Audit Name: CIS Snowflake Foundations v2.0.0 L1
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-6, 800-53|AU-6(1), 800-53|AU-7(1), CSCv7|6.7
Plugin: Snowflake
Control ID: 18a4eebcf56997c1dce59b5540853c73b5619ac168d190097e6642f312aaa63e