Data Apps Design: “❄️ Snowflake will require Multi-Factor Authentication and Stronger Pas…”

❄️ Snowflake will require Multi-Factor Authentication and Stronger Password Policies by default

— Наконец-то получил письмо с уведомлением от Snowflake
— До этого неоднократно писал в поддержку и Sales rep в призыве к этому
— Ранее нашел способ включить политику MFA принудительно (ниже)
— В качестве MFA используется только DUO APP (from Cisco), Google Auth нельзя

🩷 Мой подход:

---------------------------
-- AUTHENTICATION POLICY --
---------------------------

CREATE AUTHENTICATION POLICY IF NOT EXISTS AUTHENTICATION_POLICY_REQUIRE_2FA
  AUTHENTICATION_METHODS = ('ALL')
  MFA_AUTHENTICATION_METHODS = ('PASSWORD', 'SAML')
  MFA_ENROLLMENT = REQUIRED
  CLIENT_TYPES = ('ALL')
  SECURITY_INTEGRATIONS = ('ALL')
  COMMENT = 'Enforce 2FA with DUO APP'
;

CREATE AUTHENTICATION POLICY IF NOT EXISTS AUTHENTICATION_POLICY_NONUSER_LOGIN
  AUTHENTICATION_METHODS = ('PASSWORD', 'KEYPAIR')
  CLIENT_TYPES = ('DRIVERS')
  COMMENT = 'Non-user logins are only allowed to authenticate through drivers via password or keypair'
;

ALTER USER A_KOZYR SET AUTHENTICATION POLICY AUTHENTICATION_POLICY_REQUIRE_2FA ;

ALTER USER KAFKA_CONNECTOR SET AUTHENTICATION POLICY AUTHENTICATION_POLICY_NONUSER_LOGIN ;

🔵 Самые важные отрывки из письма:

What you need to know:

This new MFA policy only applies to Snowflake users with the TYPE=PERSON or unset type (i.e., human users) that use a Snowflake built-in password to login. Please see the documentation for more information on user types and see the Timeline and Implementation below for additional details on how these policies will be applied.

For users created after a new account is bootstrapped

Make sure to mark the TYPE for all users
For human users TYPE=PERSON, follow the DUO enrollment process and start using MFA
For service users TYPE=SERVICE, make sure to either: 1) use external OAuth (preferred), or 2) use key pair authentication combined with network policy.
If a service user cannot leverage a key pair, mark them as TYPE= LEGACY_SERVICE. This is a temporary solution and we highly recommend that you fix your deployment based on the above.

✅ Считаю, что MFA должен быть включен по дефолту при работе с а) любыми активами в виде данных и б) при работе с облаками.

🌐 @data_apps | Навигация по каналу