📝 Snowflake User password is not rotated every 90 days 🟢

• Contextual name: 📝 Password is not rotated every 90 days 🟢
• ID: /ce/ca/snowflake/user/password-is-not-rotated-every-90-days
• Located in: 📁 Snowflake User

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Snowflake User
  • 🔌 Snowflake User - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Ensure that Snowflake user account passwords are rotated at regular intervals, with a default threshold of 90 days.

Rational

In the event a password is exposed or exfiltrated, limiting its validity period minimizes the window of opportunity for unauthorized access. Regular rotation also mitigates the risks associated with reused, forgotten, or improperly stored credentials.

Impact

This policy enforces a password rotation interval of 90 days, aligning with common security best practices. Organizations may need to adjust this threshold to meet internal risk management policies or external regulatory requirements.

Audit

This policy marks a Snowflake User as INCOMPLIANT if:

• The Has Password field is true, and
• The Password Last Set Time exceeds 90 days.

A User is marked as INAPPLICABLE if the Has Password field is not set to true.

Remediation

Open File

Remediation

Password Rotation

Using SQL

The executing role must hold the OWNERSHIP privilege on the target user account to modify its properties via SQL.

1. Reset the User Password:

ALTER USER {{username}} 
    SET PASSWORD = '{{new_password}}';

2. Enforce Password Change on Next Login (Recommended):

ALTER USER <username> SET MUST_CHANGE_PASSWORD = TRUE;

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 Cloudaware Framework → 💼 Credential Lifecycle Management			18