Snowflake Network Security: Network Policy, Private Link & MFA Guide

Snowflake's network security stack rests on four pillars: Network Policy (IP restrictions), Private Link (private connectivity), MFA (multi-factor authentication), and encryption. These topics show up frequently in the Account Access & Security domain (20%) of the SnowPro Core exam.

This article walks through Network Policy SQL examples, a cloud-by-cloud Private Link comparison, how MFA works and how to configure it, and how Snowflake's encryption is structured — all at a practical, production-ready level.

Network Policy

A Network Policy controls access to your Snowflake account based on IP address. It is built from two lists: ALLOWED_IP_LIST (IP addresses that are permitted to connect) and BLOCKED_IP_LIST (IP addresses that are denied).

Creating and Applying a Network Policy

-- Network Policy の作成
CREATE OR REPLACE NETWORK POLICY corp_network_policy
  ALLOWED_IP_LIST = ('203.0.113.0/24', '198.51.100.10')
  BLOCKED_IP_LIST = ('203.0.113.99')
  COMMENT = '本社ネットワークからの接続のみ許可';

-- アカウントレベルで適用（全ユーザーに影響）
ALTER ACCOUNT SET NETWORK_POLICY = corp_network_policy;

-- 特定ユーザーに適用（アカウントレベルより優先）
ALTER USER analyst_user SET NETWORK_POLICY = analyst_policy;

-- Network Policy の確認
DESCRIBE NETWORK POLICY corp_network_policy;

-- Network Policy の解除
ALTER ACCOUNT UNSET NETWORK_POLICY;

ALLOWED_IP_LIST and BLOCKED_IP_LIST Evaluation Logic

Network Policies can be set at both the account level and the user level, and user-level settings take precedence over account-level settings. This precedence rule comes up often on the SnowPro exam.

Network Rule vs Network Policy (2024+)

In addition to traditional Network Policies, Snowflake now supports Network Rules. Network Rules go beyond IP addresses and can also control access by VPC endpoint ID, Private Link ID, or hostname. You attach a Network Rule to a Network Policy to use it.

-- Network Rule の作成（VPCエンドポイントベース）
CREATE NETWORK RULE vpc_rule
  TYPE = PRIVATE_HOST_PORT
  VALUE_LIST = ('vpce-0123456789abcdef0')
  MODE = INGRESS;

-- Network Policy に Network Rule をアタッチ
CREATE NETWORK POLICY advanced_policy
  ALLOWED_NETWORK_RULE_LIST = ('vpc_rule');

Private Link: Cloud-by-Cloud Comparison

Private Link lets you connect to Snowflake over the cloud provider's private network instead of the public internet. It requires Business Critical Edition or higher.

-- Private Link設定情報の取得（ACCOUNTADMINが実行）
SELECT SYSTEM$GET_PRIVATELINK_CONFIG();

-- 結果例（AWS）
-- {
--   "privatelink-account-name": "abc12345.us-east-1.privatelink",
--   "privatelink-vpce-id": "com.amazonaws.vpce.us-east-1.vpce-svc-...",
--   "privatelink-account-url": "abc12345.us-east-1.privatelink.snowflakecomputing.com"
-- }

MFA (Multi-Factor Authentication)

Snowflake's MFA uses TOTP authentication backed by Duo Security (Cisco). Users can enable MFA from the Snowsight settings screen or with an ALTER USER statement.

-- 特定ユーザーのMFA強制有効化
ALTER USER admin_user SET MINS_TO_BYPASS_MFA = 0;

-- アカウント全体でMFAを必須化
ALTER ACCOUNT SET REQUIRE_MFA = TRUE;

-- MFAの一時バイパス（緊急時）
ALTER USER admin_user SET MINS_TO_BYPASS_MFA = 60;

Once MFA is enabled, you'll be prompted for a verification code on Snowsight, SnowSQL, and JDBC/ODBC drivers alike. For programmatic connections (ETL jobs and similar), key pair authentication is the recommended approach instead.

Encryption

Tri-Secret Secure combines Snowflake's managed encryption key with a customer-managed key held in the cloud provider's KMS (AWS KMS, Azure Key Vault, or Google Cloud KMS). If the customer disables their key, Snowflake's access to the data is also cut off — which is how the model satisfies data sovereignty requirements.

Sample Question

Frequently Asked Questions