audit-labs/audit-tools

 1# databases/snowflake
 2
 3> Planned SQL scripts for Snowflake security audits. Mirrors the style of `databases/postgres/`
 4> and `databases/mysql/`. All queries target `SNOWFLAKE.ACCOUNT_USAGE` views, which require
 5> the ACCOUNTADMIN role or a role granted the SNOWFLAKE database privilege.
 6
 7## Planned Scripts
 8
 9### `admins.sql`
10List users and roles holding `ACCOUNTADMIN`, `SECURITYADMIN`, or `SYSADMIN` via
11`SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_ROLES` and `GRANTS_TO_USERS`.
12
13### `passwords.sql`
14Read account-level password policy parameters from `SNOWFLAKE.ACCOUNT_USAGE.ACCOUNT_PARAMETERS`
15(min length, max age, lockout attempts, MFA enforcement).
16
17### `users.sql`
18List all users from `SNOWFLAKE.ACCOUNT_USAGE.USERS` with `last_success_login`, `disabled`,
19`must_change_password`, and `has_password` flags.
20
21### `network_policies.sql`
22List all network policies and their assignments. Flag users with no network policy attached.
23
24### `stale_users.sql`
25Filter `SNOWFLAKE.ACCOUNT_USAGE.USERS` for accounts inactive for 90+ days or that have
26never logged in.
27
28### `service_accounts.sql`
29Identify likely service accounts: no email set and `has_rsa_public_key = TRUE`.
30Join against role grants to show what access each holds.