Snowflake’s Phase 3 Password Migration Puts Service-Account Governance in Focus
Summary
Snowflake’s Phase 3 rollout migrates legacy service users to passwordless SERVICE accounts by account-specific deadlines. The article advises inventorying dependencies and owners, choosing authentication per workload, and revoking exposed credentials.
Key points
- During Phase 3, covered Snowflake accounts must migrate legacy service accounts away from password authentication before their account-specific enforcement dates.
- Snowflake’s ACCOUNT_USAGE schema and 365 days of login history can help identify service accounts still using passwords and show when and from where they authenticated.
- The article recommends documenting each account’s owner and dependencies, using controlled disable windows where ownership is unclear, and decommissioning only after validating dependencies.
- Authentication options include workload identity federation, external OAuth, key-pair authentication, and programmatic access tokens; the article recommends choosing per workload rather than using one method across the estate.
- Key-pair authentication remains a long-lived secret; Snowflake requires network policies and role restrictions by default for programmatic access tokens, though authentication policies can relax those requirements.
- Snowflake and Mandiant found prior credential exposure for at least 79.7% of accounts used in the UNC5537 campaign; password replacement alone does not remove copied credentials from other systems.
- The article says Connor Moucka used valid customer credentials in a campaign affecting more than 165 Snowflake customer organizations and pleaded guilty on August 5.
Article Details
- Defense Focus
- Replace password-based service-account authentication in Snowflake with passwordless methods while establishing account ownership, dependency visibility, and credential lifecycle controls.
- Detection Methods
- Use the account user list and login history to identify service accounts still authenticating with passwords, when they last authenticated, and the client and source IP used.
- During a controlled disable window, monitor authentication failures and validate account dependencies before decommissioning.
- Search secrets stores, CI variables, runbooks, and endpoints for reused copies of replaced passwords and dependent credentials.
- Data Sources
- Snowflake ACCOUNT_USAGE user list and account type
- Snowflake login history, which records client and source IP for authentication attempts for 365 days
- Secrets stores, CI variables, runbooks, and endpoints
- Platforms
- Snowflake
- Defensive Actions
- Inventory legacy service accounts before their account-specific Phase 3 enforcement dates; document which systems use each account and what depends on it.
- Assign a named owner responsible for authentication failures, dependency validation, and deprovisioning.
- Where ownership or dependencies are unclear, use a controlled disable window, monitor for failures, restore the account if needed, and decommission only after validating dependencies.
- Prefer workload identity federation where the workload can present a federatable identity; otherwise use key-pair authentication or a role-scoped token with network policy and rotation controls.
- At every programmatic access token rotation, validate the network policy, role grant, expiration, and owner.
- Treat replaced passwords as exposed: search for reuse, revoke dependent credentials, and reduce the account’s role scope during cutover.