Full Report
Snowflake is ending password authentication for legacy service accounts, forcing organizations to migrate them to passwordless methods. Token Security explains why the harder challenge is identifying what uses each account, who owns it, and how much access it still needs. [...]
Analysis Summary
# Best Practices: Migrating Snowflake Service Accounts to Passwordless Authentication
## Overview
These practices address the mandatory deprecation of legacy password-based authentication for Snowflake service accounts. The focus is on transitioning from "Identity Debt" (unmanaged, password-reliant accounts) to a secure, non-human identity (NHI) framework using the `SERVICE` user type.
## Key Recommendations
### Immediate Actions
1. **Identify Legacy Accounts:** Query the `ACCOUNT_USAGE` schema to list all users currently categorized as `LEGACY_SERVICE` or users of type `USER` acting as service accounts.
2. **Audit Login History:** Analyze the `LOGIN_HISTORY` for the past 365 days to identify active service accounts, their source IPs, and client types.
3. **Halt Password Provisioning:** Ensure all new non-human entities are created as `TYPE = SERVICE` to prevent further growth of password-based debt.
### Short-term Improvements (1-3 months)
1. **Map Ownership:** Assign a "Named Owner" (a specific person or team) to every service account. If no owner is found, flag the account for decommissioning.
2. **Perform "Scream Tests":** For accounts with unknown dependencies, implement a controlled disable window. Monitor for system failures before proceeding to full deletion.
3. **Select Authentication Methods:** Match each account to a passwordless method based on its environment (e.g., Key Pair for scripts, OAuth for BI tools, or Workload Identity Federation for cloud-native apps).
### Long-term Strategy (3+ months)
1. **Automated Governance:** Move away from manual spreadsheets to automated identity security tools that discover agents and map risky access in real-time.
2. **Identity Federation:** Prioritize "Secretless" authentication (Workload Identity Federation) to eliminate the overhead of rotating keys or managing secrets.
3. **Lifecycle Management:** Establish a policy where service accounts are automatically deprovisioned when the associated project or workload is retired.
## Implementation Guidance
### For Small Organizations
- Focus on **Key Pair Authentication**. It is relatively simple to implement for basic scripts and provides a significant security lift over static passwords.
- Maintain a central, protected repository (like a basic Secret Manager) for private keys.
### For Medium Organizations
- Leverage **OAuth 2.0** for third-party integrations (BI tools, ETL pipelines).
- Implement a formal "Request and Ownership" process in your ticketing system to ensure every new service account has a recorded sponsor.
### For Large Enterprises
- Default to **Workload Identity Federation**. This allows Snowflake to trust identities issued by your cloud provider (AWS, Azure, GCP), removing the need to manage Snowflake-specific credentials.
- Integrate NHI (Non-Human Identity) monitoring into your SOC to alert on anomalous source IPs or credential usage.
## Configuration Examples
### Identifying Legacy Accounts
sql
-- Find accounts that need migration
SELECT USER_NAME, LAST_SUCCESS_LOGIN, DAYS_SINCE_LAST_LOGIN
FROM SNOWFLAKE.ACCOUNT_USAGE.USERS
WHERE USER_TYPE = 'LEGACY_SERVICE'
AND IS_DISABLED = 'FALSE';
### Creating a Secure Service User
sql
-- Creating a passwordless service user
CREATE USER "SVC_DATA_PIPELINE"
TYPE = SERVICE
AUTHENTICATOR = 'KEYPAIR'; -- Or OAUTH / EXTERNALBROWSER
## Compliance Alignment
- **NIST SP 800-63B:** Aligns with requirements for secure authentication and the phasing out of shared secrets.
- **CIS Snowflake Benchmark:** Supports recommendations for Multi-Factor Authentication (MFA) and limiting the use of passwords for service roles.
- **ISO/IEC 27001:** Addresses access control and the management of non-human identities.
## Common Pitfalls to Avoid
- **The "October Deadline" Trap:** Waiting until the enforcement date to build an inventory, leading to emergency outages when undocumented integrations break.
- **Orphaned Accounts:** Migrating accounts that are no longer in use. Use this migration as a "cleanup" opportunity to reduce your attack surface.
- **Universal Method Application:** Trying to force one authentication method (e.g., Key Pair) on every use case instead of using the best fit (e.g., Federation for Cloud, OAuth for Tools).
## Resources
- **Snowflake Documentation:** [hXXp://docs.snowflake.com/en/user-guide/security-mfa-rollout]
- **Identity Security Tools:** [Token Security NHI Discovery - hXXps://www.token.security]
- **Snowflake Security Schema:** [hXXp://docs.snowflake.com/en/sql-reference/account-usage]