databases/snowflake

Planned SQL scripts for Snowflake security audits. Mirrors the style of databases/postgres/ and databases/mysql/. All queries target SNOWFLAKE.ACCOUNT_USAGE views, which require the ACCOUNTADMIN role or a role granted the SNOWFLAKE database privilege.

Planned Scripts

admins.sql

List users and roles holding ACCOUNTADMIN, SECURITYADMIN, or SYSADMIN via SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_ROLES and GRANTS_TO_USERS.

passwords.sql

Read account-level password policy parameters from SNOWFLAKE.ACCOUNT_USAGE.ACCOUNT_PARAMETERS (min length, max age, lockout attempts, MFA enforcement).

users.sql

List all users from SNOWFLAKE.ACCOUNT_USAGE.USERS with last_success_login, disabled, must_change_password, and has_password flags.

network_policies.sql

List all network policies and their assignments. Flag users with no network policy attached.

stale_users.sql

Filter SNOWFLAKE.ACCOUNT_USAGE.USERS for accounts inactive for 90+ days or that have never logged in.

service_accounts.sql

Identify likely service accounts: no email set and has_rsa_public_key = TRUE. Join against role grants to show what access each holds.