Account Access & Security Flashcards
(66 cards)
1
Q
Role-based Access Control (RBAC)
A
an access control framework in which access privileges are assigned to roles and in turn assigned to users.
2
Q
Discretionary Access Control (DAC)
A
Snowflake combines RBAC with Discretionary Access Control (DAC) in which each object has an owner, who can in turn grant access to that object.
3
Q
What command shows the role of the securable object?
A
SHOW <object></object>
4
Q
Owning Role
A
- Has all privileges on the object by default
- Can grant or revoke privileges on the object to other roles
- Transfer ownership to another role
- Share control of an object if the owning role is shared
5
Q
What privilege access is granted to roles?
A
- Ability to create a Warehouse
- Ability to list tables contained in a schema
- Ability to add data to a table
6
Q
What objects are securable?
A
7
Q
Unless allowed by a grant, access to a securable object will be __________.
A
denied
8
Q
Role
A
an entity to which privileges on securable objects can be granted or revoked
9
Q
User
A
- Roles are assigned to users to give them the authorization to perform actions
- A user can have multiple roles and switch between them within a Snowflake session
- Roles can be granted to other roles creating a role hierarchy
- Privileges of child roles are inherited by parent roles
10
Q
System-defined Roles type
A
- ORGADMIN
- ACCOUNTADMIN
- SECURITYADMIN
- SYSADMIN
- USERADMIN
- PUBLIC
11
Q
ORGADMIN
A
- Manages operations at organization level
- Can create account in an organization
- Can view all accounts in an organization
- Can view usage information across an organization
12
Q
ACCOUNTADMIN
A
- Top-level and most powerful role for an account
- Encapsulates SYSADMIN & SECURITYADMIN
- Responsible for configuring account-level parameters
- View and operate on all objects in an account
- View and manage Snowflake billing and credit data
- Stop any running SQL statements
13
Q
SYSADMIN
A
- Can create warehouses, databases, schemas and other objects in an account
14
Q
SECURITYADMIN
A
- Manage grants globally via the MANAGE GRANTS privilege
- Create, monitor and manage users and roles
15
Q
USERADMIN
A
- User and Role management via CREATE USER and CREATE ROLE security privileges
- Can create users and roles in an account
16
Q
PUBLIC
A
- Automatically granted to every user and every role in an account
- Can own securable objects, however objects owned by PUBLIC role are available to every other user and role in an account
17
Q
Customer Role
A
- allows you to create a role with custom and fine-grained security privileges defined
- allow administrators working with the system-defined roles to exercise the security principle of least privilege
- can be created by the SECURITYADMIN & USERADMIN roles as well as by any role to which the CREATE ROLE privilege has been granted
- it is recommend to create a hierarch of custom roles with the top-most custom role assigned to the SYSADMIN role
- if custom roles are not assigned to the SYSADMIN role, system admins will not be able to manage the objects owned by the custom role
18
Q
Privilege
A
A security privilege defines a level of access to an object
For each object there is a set of security privileges that can be granted on it
19
Q
What are the 4 categories of security privileges?
A
- Global privileges
- Privileges for account objects
- Privileges for schemas
- Privileges for schema objects
Global Privileges–>Account Objects–>Schemas–>Schema Objects
20
Q
Privileges are managed using the ___________ and __________ commands.
A
GRANT; REVOKE
GRANT USAGE ON DATABASE MY_DB TO ROLE MY_ROLE;
REVOKE USAGE ON DATABASE MY_DB TO ROLE MY_ROLE;
21
Q
Statement to grant future privileges for objects not yet created.
A
GRANT SELECT ON FUTURE TABLES IN SCHEMA MY_SCHEMA TO ROLE MY_ROLE;
22
Q
User Authentication
A
the process of authenticating with Snowflake via user provided username and password credentials
the default method of authentication
23
Q
Users with the ______________ role can create additional Snowflake users, which makes use of the ______________ privilege.
A
USERADMIN; CREATE USER
CREATE USER USER1
PASSWORD=’ABC123’
DEFAULT_ROLE = MYROLE
MUST_CHANGE_PASSWORD = TRUE;
24
Q
Password Requirements
A
- can be any case-sensitive string up to 256 characters
- must be at least 8 characters long
- must contain at least 1 digit
- must contain at least 1 uppercase letter and 1 lowercase letter
25
Multi-factor Authentication (MFA)
an additional layer of security, requiring the user to prove their identity not only with a password but with an additional piece of information (or factor)
26
MFA in Snowflake is powered by a service called __________.
Duo Security
27
MFA is enabled on a ______________ basis & only via the _______.
per-user; UI
28
Snowflake recommends that all users with the _______________ role be required to use ____________.
ACCOUNTADMIN; MFA
29
Multi-Authentication Flow
30
MINS_TO_BYPASS_MFA
ALTER USER USER1 SET
MINS_TO_BYPASS_MFA=10;
Specifies the number of minutes to temporarily disable MFA for the user so that they can log in.
31
DISABLE_MFA
ALTER USER USER1 SET
DISABLE_MFA=TRUE;
Disables MFA for the user, effectively cancelling their enrollment. To use MFA again, the user must re-enroll.
32
ALLOWS_CLIENT_MFA_CACHING
ALTER USER USER1 SET
ALLOWS_CLIENT_MFA_CACHING=TRUE;
MFA token caching reduces the number of prompts that must be acknowledged while the connecting and authenticating to Snowflake.
33
Federated Authentication
- enables users to connect to Snowflake using secure SSO (single sign-on)
- Snowflake can delegate authentication responsibility to an SAML 2.0 compliant external identity provider (IdP) with native support for Okta and ADFS IdPs.
34
IdP
An independent service responsible for creating and maintain user credentials as well as authenticating users for SSO access to Snowflake.
35
In a federated environment Snowflake is referred to as a _______________.
Service Provider (SP)
36
Federated Authentication Login Flow
37
Key Pair Authentication Steps
1. Generate Key-Pair using OpenSSL
2. Assign Public Key to Snowflake User
3. Configure Snowflake Client
4. Configure Kye-Pair Rotation
38
Oauth
- Snowflake supports the OAuth 2.0 protocol.
- OAuth is an open-standard protocol that allows supported clients authorized acess to Snowflake without sharing or stronger user login credentials
- Snowflake offers two OAuth pathways; Snowflake OAuth and External OAuth.
39
SCIM
- System for Cross-domain Identity Management (SCIM) can be used to manage users and groups (Snowflake roles) in cloud applications using RESTful APIs.
40
Network Policies
- provide the user with the ability to allow or deny access to their Snowflake account based on a single IP address or list of addresses.
- composed of an allowed IP range and optionally a blocked IP range. Blocked IP ranges are applied first.
- currently support only IPv4 addresses
- use CIDR notation to express an IP subnet range
- can be applied on the account level or to individual users
- if a user is associated to both an account-level and user-level network policy, the user-level policy takes precedence
41
Only _ Network Policy can be associated with an account at any one time.
1
42
________________ or ______________ system roles can apply policies. Or custom role with the ____________________ global privilege.
SECURITYADMIN, ACCOUNTADMIN, ATTACH POLICY
43
Network policies can be applied to __________ or ______________.
ACCOUNT; USER
44
Data Encryption States
- Encryption At Rest
- Encryption In Transit
45
Encryption At Rest Security Protocol
AES-256 strong encryption
46
Encryption In Transit Security Protocol
HTTPS TLS 1.2
47
E2EE Encryption Flows - Internal
User --PUT--> Internal Stage -- COPY INTO -->Table
