Snowflake: Configuring the SaaS Posture Integration

Configuring the Snowflake Integration

To configure the Snowflake integration, create a service user, configure its permissions and network policy, and generate a programmatic access token.

Prerequisites

• A Snowflake user with the ACCOUNTADMIN role to create the connector's role, warehouse, service user, network policy, and token

• The IP addresses that Cato uses to connect to your Snowflake account

Snowflake accepts a service user's programmatic access token only from addresses allowed by a network policy.

If an authentication policy applies to the account or service user and limits AUTHENTICATION_METHODS, include 'PROGRAMMATIC_ACCESS_TOKEN' in the list. Otherwise, Snowflake does not let the user generate or use the token.

Step 1: Configure the Integration in Snowflake

Create the Snowflake resources, restrict network access, and save the token and account URL for the CMA.

The connector role requires these grants:

• SNOWFLAKE.SECURITY_VIEWER database role: Users, role grants, programmatic access tokens, network policies and rules, password and session policies, and policy assignments

• SNOWFLAKE.GOVERNANCE_VIEWER database role: Masking and row access policies, policy assignments, and sensitive-data classification tags

• SNOWFLAKE.OBJECT_VIEWER database role: Tasks, stored procedures, and stages

• USAGE on the warehouse: Running the connector's queries

You can rename the objects in the SQL examples. Use the same names in later steps.

If you already created this role and user for the Snowflake App Activities capability, run only the SNOWFLAKE.OBJECT_VIEWER grant and reuse the same token.

To create the role, warehouse, and service user:

1. Log in to Snowsight as a user with the ACCOUNTADMIN role and open a SQL worksheet.

2. Run these statements:

   USE ROLE ACCOUNTADMIN;
   
   CREATE ROLE IF NOT EXISTS CATO_CONNECTOR_ROLE;
   GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE CATO_CONNECTOR_ROLE;
   GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE CATO_CONNECTOR_ROLE;
   GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER TO ROLE CATO_CONNECTOR_ROLE;
   
   CREATE WAREHOUSE IF NOT EXISTS CATO_CONNECTOR_WH
     WAREHOUSE_SIZE = XSMALL AUTO_SUSPEND = 60 AUTO_RESUME = TRUE INITIALLY_SUSPENDED = TRUE;
   GRANT USAGE ON WAREHOUSE CATO_CONNECTOR_WH TO ROLE CATO_CONNECTOR_ROLE;
   
   CREATE USER IF NOT EXISTS CATO_CONNECTOR_SVC
     TYPE = SERVICE
     DEFAULT_ROLE = CATO_CONNECTOR_ROLE
     DEFAULT_WAREHOUSE = CATO_CONNECTOR_WH
     COMMENT = 'Cato connector';
   GRANT ROLE CATO_CONNECTOR_ROLE TO USER CATO_CONNECTOR_SVC;

A network policy is required to generate and use a service user's programmatic access token. A user-level policy overrides the account-level network policy for that user only.

To allow Cato's IP addresses with a network policy:

1. In the SQL worksheet, run these statements to create a network rule and policy, then activate the policy on the service user.

   Replace <Cato IP address> with the IP addresses Cato uses to connect to your Snowflake account.

   You can create the network rule in any existing database and schema instead of CATO_CONNECTOR_DB.NETWORK.

   CREATE DATABASE IF NOT EXISTS CATO_CONNECTOR_DB;
   CREATE SCHEMA IF NOT EXISTS CATO_CONNECTOR_DB.NETWORK;
   
   CREATE NETWORK RULE CATO_CONNECTOR_DB.NETWORK.CATO_CONNECTOR_IPS
     MODE = INGRESS
     TYPE = IPV4
     VALUE_LIST = ('<Cato IP address>');
   
   CREATE NETWORK POLICY CATO_CONNECTOR_POLICY
     ALLOWED_NETWORK_RULE_LIST = ('CATO_CONNECTOR_DB.NETWORK.CATO_CONNECTOR_IPS');
   
   ALTER USER CATO_CONNECTOR_SVC SET NETWORK_POLICY = CATO_CONNECTOR_POLICY;

For details, see the Snowflake documentation.

Set the token lifetime to 90 days or less. Tokens with a longer lifetime are reported by the Limit Programmatic Access Token Lifetime check.

To generate the programmatic access token:

1. In Snowsight, go to Governance & security > Users & roles.

2. Select the CATO_CONNECTOR_SVC user.

3. Under Programmatic access tokens, select Generate new token.

4. Enter a Name, such as CATO_CONNECTOR_TOKEN.

   (Optional) Enter a Comment.

5. In Expires in, choose 90 days or less.

6. Select One specific role and choose CATO_CONNECTOR_ROLE.

7. Select Generate.

8. Copy and save the Programmatic Access Token so it can be entered into the CMA.

   Snowflake displays the token only once. Store it securely before continuing.

Alternatively, generate the token in a SQL worksheet:

ALTER USER CATO_CONNECTOR_SVC ADD PROGRAMMATIC ACCESS TOKEN CATO_CONNECTOR_TOKEN
  ROLE_RESTRICTION = 'CATO_CONNECTOR_ROLE'
  DAYS_TO_EXPIRY = 90;

The token is returned in the token_secret column. Copy and save the Programmatic Access Token so it can be entered into the CMA. Store it securely.

For details, see Using programmatic access tokens for authentication.

Record the account URL for the connector. In the CMA, use https:// without a trailing slash or path.

To record the account URL:

1. In Snowsight, open the account selector and select View account details.

2. Copy and save the Account/Server URL so it can be entered into the CMA.

   For example, orgname-account_name.snowflakecomputing.com is entered in the CMA as https://orgname-account_name.snowflakecomputing.com.

The token stops working when it expires. After you create the connector, rotate the token before it expires.

To rotate the programmatic access token:

1. Go to Governance & security > Users & roles and select the service user.

2. Under Programmatic access tokens, click on the three dots and select Rotate.

3. Copy and save the new Programmatic Access Token so it can be entered into the CMA.

4. Update the token in the CMA connector and confirm that its connection status is Connected.

Step 2: Create the API Connector in the CMA

After you have set up an integration with the required application, add the details in the CMA.

To create the API connector in the CMA:

1. From the navigation menu, click Resources > Integrations.

2. Click the Configured Integrations tab.

3. Click New. The New Integration panel opens.

4. Select the SaaS Application you want to add.

   For this integration, select Snowflake.

5. In the Capability drop-down, select SaaS Posture.

6. Add the details created during step one.

   • Auth: Select Programmatic access token for Snowflake.

   • Name: Enter a name for the connector.

   • (Optional) Description: Enter a description.

   • Account URL: Enter the saved account URL with https:// and without a trailing slash or path, for example https://orgname-account_name.snowflakecomputing.com.

   • Warehouse: Enter the warehouse created in step 1, for example CATO_CONNECTOR_WH.

   • Programmatic Access Token: Enter the token saved in step 1.

7. Click Save.

The app is visible on the Integrated Apps table with a Connected status.