Snowflake Network Security: Network Policy, Private Link & MFA Guide

Snowflake's network security stack rests on four pillars: Network Policy (IP restrictions), Private Link (private connectivity), MFA (multi-factor authentication), and encryption. These topics show up frequently in the Account Access & Security domain (20%) of the SnowPro Core exam.

This article walks through Network Policy SQL examples, a cloud-by-cloud Private Link comparison, how MFA works and how to configure it, and how Snowflake's encryption is structured — all at a practical, production-ready level.

Network Policy

A Network Policy controls access to your Snowflake account based on IP address. It is built from two lists: ALLOWED_IP_LIST (IP addresses that are permitted to connect) and BLOCKED_IP_LIST (IP addresses that are denied).

Creating and Applying a Network Policy

-- Create the Network Policy
CREATE OR REPLACE NETWORK POLICY corp_network_policy
  ALLOWED_IP_LIST = ('203.0.113.0/24', '198.51.100.10')
  BLOCKED_IP_LIST = ('203.0.113.99')
  COMMENT = 'Allow connections from the head-office network only';

-- Apply it at account level (affects every user)
ALTER ACCOUNT SET NETWORK_POLICY = corp_network_policy;

-- Apply it to one user (takes precedence over the account level)
ALTER USER analyst_user SET NETWORK_POLICY = analyst_policy;

-- Check the Network Policy
DESCRIBE NETWORK POLICY corp_network_policy;

-- Detach the Network Policy
ALTER ACCOUNT UNSET NETWORK_POLICY;

ALLOWED_IP_LIST and BLOCKED_IP_LIST Evaluation Logic

Network Policies can be set at both the account level and the user level, and user-level settings take precedence over account-level settings. This precedence rule comes up often on the SnowPro exam.

Network Rule vs Network Policy (2024+)

In addition to traditional Network Policies, Snowflake now supports Network Rules. Network Rules go beyond IP addresses and can also control access by VPC endpoint ID, Private Link ID, or hostname. You attach a Network Rule to a Network Policy to use it.

-- Create a Network Rule (VPC endpoint based)
CREATE NETWORK RULE vpc_rule
  TYPE = PRIVATE_HOST_PORT
  VALUE_LIST = ('vpce-0123456789abcdef0')
  MODE = INGRESS;

-- Attach the Network Rule to the Network Policy
CREATE NETWORK POLICY advanced_policy
  ALLOWED_NETWORK_RULE_LIST = ('vpc_rule');

Private Link: Cloud-by-Cloud Comparison

Private Link lets you connect to Snowflake over the cloud provider's private network instead of the public internet. It requires Business Critical Edition or higher.

-- Retrieve the Private Link settings (run as ACCOUNTADMIN)
SELECT SYSTEM$GET_PRIVATELINK_CONFIG();

-- Example result (AWS)
-- {
--   "privatelink-account-name": "abc12345.us-east-1.privatelink",
--   "privatelink-vpce-id": "com.amazonaws.vpce.us-east-1.vpce-svc-...",
--   "privatelink-account-url": "abc12345.us-east-1.privatelink.snowflakecomputing.com"
-- }

MFA (Multi-Factor Authentication)

Snowflake's MFA uses TOTP authentication backed by Duo Security (Cisco). Users can enable MFA from the Snowsight settings screen or with an ALTER USER statement.

-- Require MFA for a specific user
ALTER USER admin_user SET MINS_TO_BYPASS_MFA = 0;

-- Require MFA account-wide
ALTER ACCOUNT SET REQUIRE_MFA = TRUE;

-- Temporarily bypass MFA (for emergencies)
ALTER USER admin_user SET MINS_TO_BYPASS_MFA = 60;

Once MFA is enabled, you'll be prompted for a verification code on Snowsight, SnowSQL, and JDBC/ODBC drivers alike. For programmatic connections (ETL jobs and similar), key pair authentication is the recommended approach instead.

Encryption

Tri-Secret Secure combines Snowflake's managed encryption key with a customer-managed key held in the cloud provider's KMS (AWS KMS, Azure Key Vault, or Google Cloud KMS). If the customer disables their key, Snowflake's access to the data is also cut off — which is how the model satisfies data sovereignty requirements.

Sample Question

Frequently Asked Questions