---
title: "Snowflake: Configuring the SaaS Posture Integration"
slug: "snowflake-configuring-the-saas-posture-integration"
updated: 2026-11-01T13:58:06Z
published: 2026-11-01T13:58:06Z
canonical: "knowledge.catonetworks.com/snowflake-configuring-the-saas-posture-integration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.catonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake: Configuring the SaaS Posture Integration

## Overview

SaaS Posture integrations provide visibility into the configuration and security posture of your connected SaaS applications. Cato continuously reviews the application settings and compares them to the recommended posture defined by Cato’s research team. This helps identify misconfigurations that can increase risk, such as authentication settings, third-party integrations, and data-sharing controls.

Posture data appears in the [Cloud Apps Dashboard](/v1/docs/using-the-applications-dashboard), where you can view posture scores and the highest-severity findings across connected applications. You can review each posture check from the Posture page, including the issue details, status, and remediation action required to pass the check.

For more information, see [Reviewing the Security Posture of Your SaaS Applications.](https://knowledge.catonetworks.com/v1/docs/understanding-the-security-posture-of-your-saas-applications)

To configure the SaaS Posture integration, you need to:

1. Configure the required settings in the SaaS application
2. Create the API connector in the CMA

A CASB license is required for SaaS Posture integrations.

## Configuring the Snowflake Integration

To configure the Snowflake integration, create a service user, configure its permissions and network policy, and generate a programmatic access token.

### Prerequisites

- A Snowflake user with the `ACCOUNTADMIN` role to create the connector's role, warehouse, service user, network policy, and token
- The IP addresses that Cato uses to connect to your Snowflake account

Snowflake accepts a service user's programmatic access token only from addresses allowed by a network policy.

If an authentication policy applies to the account or service user and limits `AUTHENTICATION_METHODS`, include `'PROGRAMMATIC_ACCESS_TOKEN'` in the list. Otherwise, Snowflake does not let the user generate or use the token.

### Step 1: Configure the Integration in Snowflake

Create the Snowflake resources, restrict network access, and save the token and account URL for the CMA.

The connector role requires these grants:

- `SNOWFLAKE.SECURITY_VIEWER` database role: Users, role grants, programmatic access tokens, network policies and rules, password and session policies, and policy assignments
- `SNOWFLAKE.GOVERNANCE_VIEWER` database role: Masking and row access policies, policy assignments, and sensitive-data classification tags
- `SNOWFLAKE.OBJECT_VIEWER` database role: Tasks, stored procedures, and stages
- `USAGE` on the warehouse: Running the connector's queries

You can rename the objects in the SQL examples. Use the same names in later steps.

If you already created this role and user for the Snowflake **App Activities** capability, run only the `SNOWFLAKE.OBJECT_VIEWER` grant and reuse the same token.

**To create the role, warehouse, and service user:**

1. Log in to Snowsight as a user with the `ACCOUNTADMIN` role and open a SQL worksheet.
2. Run these statements:

```sql
USE ROLE ACCOUNTADMIN;

CREATE ROLE IF NOT EXISTS CATO_CONNECTOR_ROLE;
GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE CATO_CONNECTOR_ROLE;
GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE CATO_CONNECTOR_ROLE;
GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER TO ROLE CATO_CONNECTOR_ROLE;

CREATE WAREHOUSE IF NOT EXISTS CATO_CONNECTOR_WH
  WAREHOUSE_SIZE = XSMALL AUTO_SUSPEND = 60 AUTO_RESUME = TRUE INITIALLY_SUSPENDED = TRUE;
GRANT USAGE ON WAREHOUSE CATO_CONNECTOR_WH TO ROLE CATO_CONNECTOR_ROLE;

CREATE USER IF NOT EXISTS CATO_CONNECTOR_SVC
  TYPE = SERVICE
  DEFAULT_ROLE = CATO_CONNECTOR_ROLE
  DEFAULT_WAREHOUSE = CATO_CONNECTOR_WH
  COMMENT = 'Cato connector';
GRANT ROLE CATO_CONNECTOR_ROLE TO USER CATO_CONNECTOR_SVC;
```

A network policy is required to generate and use a service user's programmatic access token. A user-level policy overrides the account-level network policy for that user only.

**To allow Cato's IP addresses with a network policy:**

1. In the SQL worksheet, run these statements to create a network rule and policy, then activate the policy on the service user.

Replace `<Cato IP address>` with the IP addresses Cato uses to connect to your Snowflake account.

You can create the network rule in any existing database and schema instead of `CATO_CONNECTOR_DB.NETWORK`.

```sql
CREATE DATABASE IF NOT EXISTS CATO_CONNECTOR_DB;
CREATE SCHEMA IF NOT EXISTS CATO_CONNECTOR_DB.NETWORK;

CREATE NETWORK RULE CATO_CONNECTOR_DB.NETWORK.CATO_CONNECTOR_IPS
  MODE = INGRESS
  TYPE = IPV4
  VALUE_LIST = ('<Cato IP address>');

CREATE NETWORK POLICY CATO_CONNECTOR_POLICY
  ALLOWED_NETWORK_RULE_LIST = ('CATO_CONNECTOR_DB.NETWORK.CATO_CONNECTOR_IPS');

ALTER USER CATO_CONNECTOR_SVC SET NETWORK_POLICY = CATO_CONNECTOR_POLICY;
```

For details, see [the Snowflake documentation](https://docs.snowflake.com/en/user-guide/network-policies).

Set the token lifetime to 90 days or less. Tokens with a longer lifetime are reported by the **Limit Programmatic Access Token Lifetime** check.

**To generate the programmatic access token:**

1. In Snowsight, go to **Governance & security > Users & roles**.
2. Select the `CATO_CONNECTOR_SVC` user.
3. Under **Programmatic access tokens**, select **Generate new token**.
4. Enter a **Name**, such as `CATO_CONNECTOR_TOKEN`.

**(Optional)** Enter a **Comment**.
5. In **Expires in**, choose 90 days or less.
6. Select **One specific role** and choose `CATO_CONNECTOR_ROLE`.
7. Select **Generate**.
8. Copy and save the **Programmatic Access Token** so it can be entered into the CMA.

Snowflake displays the token only once. Store it securely before continuing.

Alternatively, generate the token in a SQL worksheet:

```sql
ALTER USER CATO_CONNECTOR_SVC ADD PROGRAMMATIC ACCESS TOKEN CATO_CONNECTOR_TOKEN
  ROLE_RESTRICTION = 'CATO_CONNECTOR_ROLE'
  DAYS_TO_EXPIRY = 90;
```

The token is returned in the `token_secret` column. Copy and save the **Programmatic Access Token** so it can be entered into the CMA. Store it securely.

For details, see [Using programmatic access tokens for authentication](https://docs.snowflake.com/en/user-guide/programmatic-access-tokens).

Record the account URL for the connector. In the CMA, use `https://` without a trailing slash or path.

**To record the account URL:**

1. In Snowsight, open the account selector and select **View account details**.
2. Copy and save the **Account/Server URL** so it can be entered into the CMA.

For example, `orgname-account_name.snowflakecomputing.com` is entered in the CMA as `https://orgname-account_name.snowflakecomputing.com`.

The token stops working when it expires. After you create the connector, rotate the token before it expires.

**To rotate the programmatic access token:**

1. Go to **Governance & security > Users & roles** and select the service user.
2. Under **Programmatic access tokens**, click on the three dots and select **Rotate**.
3. Copy and save the new **Programmatic Access Token** so it can be entered into the CMA.
4. Update the token in the CMA connector and confirm that its connection status is **Connected**.

### Step 2: Create the API Connector in the CMA

After you have set up an integration with the required application, add the details in the CMA.

**To create the API connector in the CMA:**

1. From the navigation menu, click **Resources > Integrations.**
2. Click the **Configured Integrations** tab.
3. Click **New**. The **New Integration** panel opens.
4. Select the **SaaS Application** you want to add.

For this integration, select **Snowflake**.
5. In the **Capability** drop-down, select **SaaS Posture**.
6. Add the details created during step one.
  - **Auth**: Select **Programmatic access token for Snowflake**.
  - **Name**: Enter a name for the connector.
  - **(Optional) Description**: Enter a description.
  - **Account URL**: Enter the saved account URL with `https://` and without a trailing slash or path, for example `https://orgname-account_name.snowflakecomputing.com`.
  - **Warehouse**: Enter the warehouse created in step 1, for example `CATO_CONNECTOR_WH`.
  - **Programmatic Access Token**: Enter the token saved in step 1.
7. Click **Save**.

The app is visible on the **Integrated Apps** table with a **Connected** status.