Snowflake Encryption and Key Management

Encryption scrambles data so unauthorized readers see only meaningless characters. Snowflake encrypts all customer data automatically, at rest and in transit, without any setup. Understanding how the keys work helps teams answer audit questions and choose the right security level.

Locks and Keys in Everyday Terms

Imagine a building where every room has its own lock. A master key opens a floor. A bigger master key opens the whole building. A safe in the basement stores the biggest key. Even when a thief steals one room key, the other rooms stay closed. Snowflake builds its protection the same way, with layers of keys that protect smaller keys.

Encryption in Transit and at Rest

• In transit: every connection uses TLS 1.2 or higher, so network eavesdroppers see scrambled traffic.
• At rest: all stored data, including tables, stage files, and query results, uses AES-256 encryption.
• Temporary data: files that spill to disk during query processing remain encrypted.

The Key Hierarchy

SNOWFLAKE KEY HIERARCHY
=======================

        +----------------------------+
        |        ROOT KEY            |   stored in a hardware security module
        +-------------+--------------+
                      |
        +-------------v--------------+
        |   ACCOUNT MASTER KEY       |   one per account
        +-------------+--------------+
                      |
        +-------------v--------------+
        |    TABLE MASTER KEYS       |   one per table
        +-------------+--------------+
                      |
        +-------------v--------------+
        |       FILE KEYS            |   one per micro-partition file
        +-------------+--------------+
                      |
                 [ Your data ]

Each key level encrypts the level below it.

A leaked file key exposes one file at most. The upper keys never leave protected hardware.

Automatic Key Rotation and Rekeying

Snowflake rotates table master keys automatically about every 30 days. After rotation, the old key still decrypts older data, and the new key protects new data. Enterprise Edition and above add periodic rekeying. Rekeying re-encrypts older data with a fresh key once its key reaches one year of age, which retires the old key completely.

-- Enable yearly rekeying (Enterprise Edition and above)
ALTER ACCOUNT SET PERIODIC_DATA_REKEYING = TRUE;

Rekeying runs in the background and adds a small storage and compute cost.

Tri-Secret Secure: Customer-Managed Keys

Business Critical Edition lets a company bring its own key. Snowflake combines the customer key with its own account master key to build a composite master key. Neither party alone can decrypt the data. Revoking the customer key in the cloud provider's key service makes all data in the account unreadable immediately.

TRI-SECRET SECURE
=================

 Snowflake-managed key  --+
                          +-->  COMPOSITE MASTER KEY  -->  protects data
 Customer-managed key   --+
 (AWS KMS, Azure Key Vault,
  Google Cloud KMS)

 Customer revokes its key  -->  Composite key breaks  -->  Data unreadable

Comparing Key Options

FEATURE                        STANDARD  ENTERPRISE  BUSINESS CRITICAL
-----------------------------  --------  ----------  -----------------
Automatic AES-256 at rest      Yes       Yes         Yes
TLS in transit                 Yes       Yes         Yes
Automatic 30 day rotation      Yes       Yes         Yes
Periodic yearly rekeying       No        Yes         Yes
Customer-managed key           No        No          Yes

Client-Side Encryption for Staged Files

Files uploaded to external stages can carry client-side encryption. The customer encrypts the file before upload and shares the key through the stage definition. Snowflake uses the key to read the file during loading and never stores the plain file.

CREATE STAGE secure_stage
  URL = 's3://my-company-data/secure/'
  STORAGE_INTEGRATION = s3_int
  ENCRYPTION = (TYPE = 'AWS_SSE_KMS' KMS_KEY_ID = 'aws/key-id-here');

What Teams Still Own

Encryption protects stored and moving data. Access control, masking policies, network policies, and strong authentication protect the data after a legitimate user decrypts it through a query. Combine every layer for a complete defense.

A Practical Scenario

A bank must prove to auditors that it controls access to customer records even inside a cloud platform. The bank selects Business Critical Edition and enables Tri-Secret Secure with a key held in its own cloud key service. Auditors see that the bank can revoke the key and make every record unreadable on demand. The bank documents the automatic rotation schedule and the yearly rekeying setting as supporting evidence.

Frequently Asked Questions

Do I need to turn encryption on?

Encryption runs automatically for every account and every edition. No setting or extra cost applies for the standard protection.

Does encryption slow queries?

Snowflake handles encryption and decryption inside its service layers, and users see no extra steps in normal query work.

Key Points

• Snowflake encrypts all data at rest with AES-256 and all traffic with TLS.
• A four-level key hierarchy limits the damage of any single key exposure.
• Keys rotate automatically about every 30 days.
• Periodic rekeying in Enterprise Edition retires old keys after one year.
• Tri-Secret Secure combines a customer key with a Snowflake key in Business Critical Edition.
• Encryption works alongside access control, masking, and network policies.