Snowflake Network Policies

A correct password and a valid user still need a safe path to Snowflake. Network policies decide which internet addresses may reach an account. Requests from unknown locations stop at the gate, even when the credentials are correct.

The Idea in Plain Words

Picture an office building with a guard at the entrance. The guard holds a list of approved visitor addresses. A person with a valid badge who arrives from an unlisted address does not enter. A network policy plays the role of that guard list. It narrows the door to the locations the company trusts, such as office networks and a corporate VPN.

NETWORK POLICY CHECK
====================

 Request from 203.0.113.25 -------+
                                  v
                       +-------------------------+
                       |   NETWORK POLICY        |
                       | Allowed: 203.0.113.0/24 |
                       | Blocked: 203.0.113.99   |
                       +----------+--------------+
                                  |
                  +---------------+----------------+
                  v                                v
          Address is allowed               Address is blocked
          Sign-in continues                Connection refused

Allowed and Blocked Lists

A policy contains an allowed list and an optional blocked list. Addresses use CIDR notation, a compact way to write a range. The entry 203.0.113.0/24 covers all addresses from 203.0.113.0 to 203.0.113.255. The blocked list removes specific addresses from the allowed range, and blocked entries win over allowed entries.

CREATE NETWORK POLICY office_only
  ALLOWED_IP_LIST = ('203.0.113.0/24', '198.51.100.10')
  BLOCKED_IP_LIST = ('203.0.113.99')
  COMMENT = 'Head office and VPN exit address';

Network Rules: The Modern Approach

Network rules store address lists as separate reusable objects. Policies reference the rules. Teams edit one rule and every policy that uses it updates.

CREATE NETWORK RULE office_ips
  TYPE       = IPV4
  MODE       = INGRESS
  VALUE_LIST = ('203.0.113.0/24', '198.51.100.10');

CREATE NETWORK RULE blocked_ips
  TYPE       = IPV4
  MODE       = INGRESS
  VALUE_LIST = ('203.0.113.99');

CREATE NETWORK POLICY office_only_v2
  ALLOWED_NETWORK_RULE_LIST = ('office_ips')
  BLOCKED_NETWORK_RULE_LIST = ('blocked_ips');

Applying a Policy

-- Account level: affects every user
ALTER ACCOUNT SET NETWORK_POLICY = office_only;

-- User level: affects one user and overrides the account policy
ALTER USER etl_service SET NETWORK_POLICY = pipeline_servers;

-- Check what is active
SHOW PARAMETERS LIKE 'NETWORK_POLICY' IN ACCOUNT;
SHOW NETWORK POLICIES;

Policy Levels

LEVEL      SCOPE                 TYPICAL USE
---------  --------------------  ------------------------------------
Account    Every user            Company-wide office and VPN list
User       One user              Service accounts with fixed server IPs
Integration  One security integration  OAuth and SCIM connections

A user-level policy replaces the account-level policy for that user. Administrators use that behavior to give pipelines a narrow list of server addresses while employees follow the wider office list.

Avoiding a Lockout

A wrong entry in an account-level policy can lock out every administrator. Follow a safe routine.

  1. Confirm your own current IP address before editing any list.
  2. Include that address in the allowed list.
  3. Test the policy on a single test user first.
  4. Apply it to the account only after the test user connects successfully.
  5. Keep one emergency path documented, such as a support contact process.
-- Find the address Snowflake sees for your current session
SELECT SYSTEM$ALLOWLIST();   -- Snowflake endpoints your network must reach
SELECT CURRENT_IP_ADDRESS();

Private Connectivity

Public network policies filter traffic that travels over the internet. Business Critical Edition adds private connectivity through AWS PrivateLink, Azure Private Link, and Google Private Service Connect. Traffic stays on the cloud provider's private network and never touches the public internet. Many companies combine private connectivity with network policies for layered protection.

A Practical Scenario

A hospital analytics team connects from two office buildings and a corporate VPN. The security officer collects the three public address ranges, stores them in a network rule, and attaches the rule to an account-level policy. A contractor who tries to sign in from a coffee shop receives a refusal, even with a correct password. A nightly pipeline runs from a cloud server with a fixed address, so the officer creates a narrow user-level policy for the pipeline user alone.

Frequently Asked Questions

Do network policies replace passwords?

Network policies add a location check on top of authentication. Both layers work together.

What if an office address changes?

Update the network rule, and every policy that references it uses the new range at once.

Key Points

  • Network policies allow or block internet addresses before sign-in completes.
  • Entries use CIDR ranges, and blocked entries override allowed entries.
  • Network rules make address lists reusable across several policies.
  • User-level policies override account-level policies for that user.
  • Test with one user before applying a policy to the full account.
  • Private connectivity in Business Critical Edition keeps traffic off the public internet.
Previous lesson
Back to course
Next lesson