Snowflake Integration

Overview

The Snowflake integration connects your Snowflake account to Fencer for security scanning through the Snowflake Trust Center and for identity sync. By connecting Snowflake, you gain visibility into Trust Center findings — such as disabled scanner packages and open security issues — and you see your Snowflake account users alongside the identities from your other tools.

Prerequisites

An active Fencer subscription.
The Administrator role in Fencer.
A Snowflake user with ACCOUNTADMIN, or another role that can create users, roles and warehouses, to prepare the account.
In your Snowflake account:
- A dedicated service user (the setup guide suggests <YOUR-ORG-SLUG>@FENCER.DEV).
- An RSA key pair for key-pair authentication.
- A dedicated role (default: FENCER_SCANNER_ROLE) granted the SNOWFLAKE.TRUST_CENTER_VIEWER application role.
- A warehouse the role can use (default: FENCER_SCANNER_WH).
This feature requires activation. Contact support to enable this feature for your organization.

How it works

Fencer authenticates to Snowflake using key-pair (JWT) authentication rather than username/password. When you provide your RSA private key, Fencer derives the corresponding public key, generates short-lived JWT tokens, and connects to your Snowflake account to run queries.

Fencer adds the Snowflake account as a cloud account and scans it as soon as you connect, then on your cloud scan schedule: every day on plans with daily scans, otherwise every Monday. Each scan reads the Snowflake Trust Center scanner packages and their findings. Disabled scanner packages are flagged as medium-severity issues, and open Trust Center findings are imported as vulnerabilities with their original severity. The integration also syncs Snowflake account users into Fencer’s identity inventory, detecting service accounts and MFA enrollment status.

Usage / Configuration

Preparing your Snowflake account

The setup guide beside the connect form shows these steps with copyable commands. In short:

Find your account identifier: in Snowsight, open the account menu and choose View account details. It looks like abcdefg-xy12345.

Generate a key pair in a terminal:

# Generate a private key
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

# Alternatively, generate a private key with a passphrase
openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8

# Generate a public key
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

In a Snowflake worksheet, create the role, the service user and (optionally) a warehouse. Replace the public key placeholder with the contents of rsa_key.pub, without its BEGIN and END lines, and <YOUR-ORG-SLUG> with your Fencer organization slug in capitals:

-- Create Scanner Role with Trust Center Access
CREATE OR REPLACE ROLE FENCER_SCANNER_ROLE
COMMENT = "Fencer Scanner Role Used For Scanning Integration";

GRANT APPLICATION ROLE SNOWFLAKE.TRUST_CENTER_VIEWER TO ROLE FENCER_SCANNER_ROLE;

-- Create Service Account User
CREATE OR REPLACE USER "<YOUR-ORG-SLUG>@FENCER.DEV"
    DEFAULT_ROLE="FENCER_SCANNER_ROLE"
    LOGIN_NAME="<YOUR-ORG-SLUG>@FENCER.DEV"
    DISPLAY_NAME="Fencer Scanner"
    RSA_PUBLIC_KEY="<your-public-key>"
    TYPE=SERVICE
    COMMENT="Service User for the Fencer Scanning Application";

GRANT ROLE FENCER_SCANNER_ROLE TO USER "<YOUR-ORG-SLUG>@FENCER.DEV";

-- Create a Warehouse (or grant USAGE on an existing one)
CREATE OR ALTER WAREHOUSE FENCER_SCANNER_WH
  WAREHOUSE_TYPE = 'STANDARD'
  WAREHOUSE_SIZE = 'X-SMALL'
  INITIALLY_SUSPENDED = TRUE
  AUTO_RESUME = TRUE
  COMMENT = 'Warehouse for Fencer scanning';

GRANT USAGE ON WAREHOUSE FENCER_SCANNER_WH TO ROLE FENCER_SCANNER_ROLE;

If your account uses a network policy, contact Fencer support so we can help you allow Fencer to connect.

Connecting Snowflake

Go to Admin > Integrations.
Click the Snowflake card under Available Integrations, then click Continue.
Fill in the connection form:
- Name or alias for this Snowflake connection — a friendly name (defaults to “Snowflake Production Account”).
- Environment — Production, Development, Test or Mixed.
- Account identifier — your Snowflake account identifier (e.g., abcdefg-xy12345).
- User name — the Snowflake service user you created.
- Warehouse — the warehouse Fencer should use for queries (default: FENCER_SCANNER_WH).
- Role — the Snowflake role Fencer should assume (default: FENCER_SCANNER_ROLE).
- Private key — paste the contents of rsa_key.p8, including the BEGIN and END header lines.
- Private key passphrase — the passphrase for your private key, or leave blank if the key is unencrypted.
Click Connect. Fencer checks the private key and signs in to Snowflake with it before saving.
On success, Fencer starts the first scan and an identity sync automatically.

Editing a connection

Go to Admin > Integrations and click Edit (the pencil icon) on the Snowflake connection.
Update any fields. The Private key field is optional when editing — leave it blank to keep the existing key. The edit page also holds the account’s asset settings.
Click Save changes.

Disconnecting Snowflake

Go to Admin > Integrations and find the Snowflake connection.
Click Remove (the trash icon), then confirm with Remove. This soft-deletes the connection, clears all stored credentials, and removes the associated cloud account.

Examples

Trust Center security scanning

After connecting, Fencer checks your Snowflake Trust Center for:

Disabled scanner packages — if any Trust Center scanner package is not enabled, Fencer creates a medium-severity finding recommending you enable it.
Open findings — all open findings from the Trust Center are imported with their original severity, description, and suggested remediation action.

These findings appear alongside your other cloud infrastructure vulnerabilities and can be triaged, assigned, and tracked through the standard vulnerability management workflow.

Identity sync

Fencer fetches all users from your Snowflake account and syncs them into Posture > Identities when you connect and again every night, on plans that include Identities:

Users with type SERVICE or LEGACY_SERVICE are classified as service accounts.
All other users are classified as human identities.
MFA enrollment status, default role, last successful login and creation date are recorded.
Disabled users are marked as Inactive.

Troubleshooting

“Invalid private key.” / “Invalid private key passphrase.” — Paste the whole private key, including its BEGIN and END lines, and check the passphrase (leave it blank for an unencrypted key).
“Unable to connect to Snowflake. Please check your credentials.” — Snowflake rejected the sign-in. Verify the account identifier, user name, role and warehouse, and that the user’s RSA_PUBLIC_KEY matches your private key.
Connection shows an issue — Fencer checks the connection by reading your Trust Center. If Snowflake rejects the key, the connection shows Issue; if the role cannot read the Trust Center, it shows Needs attention. Update your credentials, or grant the role SNOWFLAKE.TRUST_CENTER_VIEWER; the status clears at the next successful scan.
No Trust Center findings appearing — Ensure the Trust Center scanner packages are enabled in your Snowflake account. Navigate to the Snowflake Trust Center UI to verify.