Detections
Analytics
1.20 Ensure an account-level authentication policy has been configured to restrict allowed provider accounts for Workload Identify Federation (WIF)
Information
Workload identity federation is a service-to-service authentication method that lets workloads, such as applications, services, or containers, authenticate with Snowflake using their cloud provider's native identity system, such as AWS Identity and Access Management (AWS IAM) roles, Microsoft Entra ID, and Google Cloud service accounts to get an attestation that Snowflake can use and validate.WIF is a more secure alternative to passwords, as end users do not have to manage and store their own credentials to Snowflake.
You can use an authentication policy to control which Snowflake service users can authenticate with workload identity federation. You can also create and set the authentication policy so that a workload can authenticate only if it uses a specified identity provider, or an account within that provider.
Restricting access to a specific cloud provider or a specific list of issuer accounts within that cloud provider can help mitigate risk of misconfiguration or insider access attacks. For example, restricting WIF usage to a specific AWS account would prevent a different Azure account from accessing the Snowflake account.
Additionally, restricting WIF providers can help ensure compliance with regulations that dictate where data can be accessed from, particularly concerning specific cloud providers or geographical regions.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Programmatically:In a Snowsight worksheet or through the SnowSQL CLI:
- Create an authentication policy that sets the ALLOWED_PROVIDERS, as well as ALLOWED_AWS_ACCOUNTS, ALLOWED_AWS_PARTITIONS, ALLOWED_AZURE_ISSUERS, ALLOWED_OIDC_ISSUERS (if applicable) in the WORKLOAD_IDENTITY_POLICY. NOTE: If you already have an account-level authentication policy, you can alter the existing policy to set WORKLOAD_IDENTITY_POLICY:
CREATE AUTHENTICATION POLICY <policy_name> WORKLOAD_IDENTITY_POLICY=(
ALLOWED_PROVIDERS=(<provider>, ...)
[ALLOWED_AWS_ACCOUNTS=('<account>', ...)
ALLOWED_AWS_PARTITIONS=('<partition>', ...)
ALLOWED_AZURE_ISSUERS=('<issuer>', ...)
ALLOWED_OIDC_ISSUERS=('<issuer>', ...]
);
- Set the authentication policy at the account level:
ALTER ACCOUNT SET AUTHENTICATION POLICY <policy_name>;
Impact:
If the allowed providers or issuers are incorrectly configured, automation from cloud providers or issuer accounts outside the allowlist will be unable to access Snowflake.
See Also
Item Details
Audit Name: CIS Snowflake Foundations v2.0.0 L2
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-2
Plugin: Snowflake
Control ID: 7caa547c15f6558f0508ed354bcbe3bafbf6791ef09a0011e53c6adeb15829d6