DATA MOVEMENT: CHALLENGE OR STRENGTH ?

 USER TYPES in SNOWFLAKE "Securing is better than sorry" 

It's always wiser to take precautions and secure something properly, even if it seems unnecessary, rather than risk potential problems or regret later by not being careful enough; 

Snowflake have TYPE property for the USER object. This is one of the long-awaited no-brainer features we all wanted! Make sure to secure your data by securing your user first.

Key things to remember

 Never rely on one factor authentication(Always enroll at least in 2nd factor authentication)

Old-fashioned password logins are vulnerable in today's digital world, so configure strong authentication, such as OAuth, Key pair, and federated authentications.

In snowflake there are 4 properties of the user that can be set PERSON | SERVICE | LEGACY_SERVICE | NULL

PERSON: Users do not have restrictions when the TYPE property is set to PERSON, NULL, or when TYPE is unset.

NULL: See PERSON.

SERVICE: To improve the security posture of non-interactive use cases, users with the TYPE property set to SERVICE have the following characteristics:

They cannot log in using a password.

They cannot log in using SAML SSO.

They cannot enroll in MFA.

They are not subject to authentication policy MFA enforcement.

They cannot have the following properties:

FIRST_NAME, MIDDLE_NAME, LAST_NAME,PASSWORD,MUST_CHANGE_PASSWORD,MINS_TO_BYPASS_MFA

The following commands cannot be used:

ALTER USER RESET PASSWORD

ALTER USER SET DISABLE_MFA = TRUE

LEGACY_SERVICE: A user with their TYPE property set to LEGACY_SERVICE represents a non-interactive integration. LEGACY_SERVICE users let services or applications that cannot easily use more secure authentication methods authenticate using password or SAML authentication.

LEGACY_SERVICE users have the following characteristics:

They can log in using password or SAML authentication, unlike SERVICE: users.

They do not have the properties of a SERVICE user, but have the PASSWORD and MUST_CHANGE_PASSWORD properties available.

They have the command restrictions of a SERVICE user but can use the ALTER USER RESET PASSWORD command.

They are not affected by authentication policy multi-factor authentication (MFA) enforcement. This property lets administrators set account-level authentication policies that require MFA for password authentication without needing to set a user-level authentication policy to prevent LEGACY_SERVICE users from requiring MFA for password authentication.

So choose your user type wisely to build a robust secure applications from the day first.