{"resources":{"snowflake":{"id":"snowflake","name":"snowflake","fields":{"account":{"name":"account","type":"\u001bsnowflake.account","title":"Snowflake Account","desc":"Top-level entry point for auditing a Snowflake account and every object it contains: `users`, `roles`, `databases`, `warehouses`, `stages`, `shares`, `apiIntegrations`, `tags`, `failoverGroups`, and account-level privileges via `grants`. The account-wide security posture is reachable through `securityIntegrations`, `passwordPolicies`, `networkPolicies`, `sessionPolicies`, `authenticationPolicies`, `maskingPolicies`, and `secrets`, while `resourceMonitors` exposes credit-usage guardrails for warehouses. `accountAdmins` lists the users that hold the ACCOUNTADMIN role, directly or through role grants, so you can review the account's most privileged identities.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"apiIntegration":{"name":"apiIntegration","type":"\u001bsnowflake.apiIntegration","title":"Snowflake API Integration","desc":"API integration object holding the cloud authentication context that external functions and Git repository integrations use to reach an HTTPS proxy service. The `type` field selects the backing provider (aws_api_gateway, azure_api_management, or google_api_gateway) and determines which credential fields carry a value. Auditing these matters because the integration grants Snowflake outbound access to external endpoints: `enabled` gates whether it is live, `apiAllowedPrefixes` and `apiBlockedPrefixes` constrain which URLs calls may reach, and `apiAwsRoleArn`, `apiAwsExternalId`, `azureTenantId`, and `azureAdApplicationId` expose the assumed role and tenant trust. The `properties` map returns the complete DESCRIBE API INTEGRATION output for any field not surfaced individually.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"application":{"name":"application","type":"\u001bsnowflake.application","title":"Snowflake Native App","desc":"An installed Snowflake Native App in the account, keyed by name. Native Apps run provider-supplied code inside the consumer account with granted privileges, so they are the account's third-party-code and supply-chain surface. Covers where the app was installed from (a Marketplace listing or a local application package), the installed version and patch, and the owning role. Select an app by name, for example `snowflake.applications.where(name == \"SECURITY_APP\")`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"applicationPackage":{"name":"applicationPackage","type":"\u001bsnowflake.applicationPackage","title":"Snowflake application package","desc":"An application package in the account, keyed by name. Application packages are the provider side of Snowflake Native Apps, bundling the code and data that become an installed application. Covers the release distribution (internal or external), the application class, and the owning role. Select a package by name, for example `snowflake.applicationPackages.where(name == \"MY_APP_PKG\")`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"authenticationPolicy":{"name":"authenticationPolicy","type":"\u001bsnowflake.authenticationPolicy","title":"Snowflake Authentication Policy","desc":"Authentication policy governing which login methods, MFA requirements, and client types are permitted for the account or the users it is attached to. This is the definitive control for whether MFA is enforced and whether password authentication is still allowed, so it is central to auditing login security. The `authenticationMethods` and `mfaAuthenticationMethods` fields report the permitted method sets, `mfaEnrollment` reports whether MFA is REQUIRED or OPTIONAL, `clientTypes` restricts which client applications may connect, and `securityIntegrations` lists the external auth integrations the policy allows.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"connection":{"name":"connection","type":"\u001bsnowflake.connection","title":"Snowflake Connection","desc":"Account-level connection object used for Business Critical failover and client redirect across replicated accounts, exposing a stable connection URL that clients target while the underlying primary account can change. Auditing connections surfaces which account currently serves as primary (`isPrimary`, `primary`), the accounts failover is permitted to (`failoverAllowedToAccounts`), and the durable `connectionUrl` clients use. Connections are selected by `name`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"cortexSearchService":{"name":"cortexSearchService","type":"\u001bsnowflake.cortexSearchService","title":"Snowflake Cortex Search service","desc":"A Cortex Search service in the account, the managed retrieval index that powers low-latency semantic and keyword search over a source query's text, the retrieval half of a Cortex retrieval-augmented-generation (RAG) application. Covers where the service lives (databaseName, schemaName, name), the warehouse that runs indexing and query serving, the target data freshness lag, the query that defines the indexed source data, and the URL clients call to issue searches. The query definition and service URL are high-value review targets: together they reveal exactly which data a service exposes and where it can be reached. Select a service by name, for example `snowflake.account.cortexSearchServices.where(name == \"SUPPORT_DOCS\")`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"currentRole":{"name":"currentRole","type":"\u0007","title":"Current role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"database":{"name":"database","type":"\u001bsnowflake.database","title":"Snowflake Database","desc":"Logical container that holds schemas, tables, views, and other objects in a Snowflake account. Auditing databases surfaces ownership, Time Travel data retention, transient (non-fail-safe) status, and the database-scoped roles that grant access to its contents. The `origin` field identifies a database created from a share or replica, and `roles` enumerates the roles defined within the database. The database-scoped data-governance controls are reachable through `schemas`, `maskingPolicies`, `rowAccessPolicies`, `tags`, and `secrets`, mirroring the account-wide collections but limited to this database. Asset discovery emits each database as its own asset, so these fields also form the posture surface scanned per database.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"databaseRole":{"name":"databaseRole","type":"\u001bsnowflake.databaseRole","title":"Snowflake Database Role","desc":"Database-scoped role that grants privileges confined to a single database, used to model least-privilege access without account-wide reach. Audit these to see who owns each role (`owner` and `ownerRoleType`, where the owner is either a ROLE or a DATABASE_ROLE) and how roles nest into one another. The grant counts (`grantedToRoles`, `grantedToDatabaseRoles`, and `grantedDatabaseRoles`) reveal the depth of the role chain, which matters when reasoning about effective privilege escalation.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"externalAccessIntegration":{"name":"externalAccessIntegration","type":"\u001bsnowflake.externalAccessIntegration","title":"Snowflake external access integration","desc":"An external access integration in the account, keyed by name. External access integrations are the account's outbound-egress control: they whitelist which network rules (hostnames and ports), secrets, and API authentication integrations a function or procedure may reach, so they are central to preventing data exfiltration from user code. Covers whether the integration is enabled and the allowed network rules, secrets, and API authentication integrations. Select an integration by name, for example `snowflake.externalAccessIntegrations.where(enabled == true)`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"failoverGroup":{"name":"failoverGroup","type":"\u001bsnowflake.failoverGroup","title":"Snowflake Failover Group","desc":"Failover or replication group that copies account-level objects to secondary accounts for disaster recovery and business continuity. The `type` field distinguishes a failover group (ACCOUNT) from a replication group (BUSINESS_CONTINUITY), and `isPrimary` marks whether this account holds the source group or a read-only replica. Auditing these groups confirms that critical databases and shares are replicated to the intended target accounts and, via `replicationSchedule` and `secondaryState`, that replicas are refreshing on the expected cadence rather than drifting or sitting suspended.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"function":{"name":"function","type":"\u001bsnowflake.function","title":"Snowflake user-defined function","desc":"A user-defined function (UDF) in a schema, keyed by name. UDFs run custom logic (SQL, JavaScript, Python, Java, or Scala) with the caller's or owner's rights, and can reach outside Snowflake through external access integrations and secrets, so they are a code-execution and data-egress surface. Covers the implementation language, whether the function is secure (its definition is hidden), whether it is an external function that calls an HTTP endpoint, the argument signature, and the bound external access integrations and secrets. Select a function by name, for example `snowflake.functions.where(language == \"PYTHON\")`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"grant":{"name":"grant","type":"\u001bsnowflake.grant","title":"Snowflake Grant","desc":"Single privilege granted on a Snowflake object to a role, user, or share, as returned by SHOW GRANTS. Grants are the core of Snowflake access control, so auditing them reveals who holds which privileges on which objects and whether a grantee can re-grant them. The `grantedTo` field discriminates the grantee kind (ROLE, USER, SHARE, or DATABASE_ROLE), `grantedOn` identifies the object type (such as DATABASE or TABLE), and `grantOption` flags whether the grantee holds WITH GRANT OPTION.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"managedAccount":{"name":"managedAccount","type":"\u001bsnowflake.managedAccount","title":"Snowflake Managed Account","desc":"Reader account provisioned by a provider account to share data with a consumer who has no Snowflake account of their own. Auditing managed accounts surfaces every reader account created for data sharing, where it lives (`cloud`, `region`), how it is reached (`url`, `accountLocatorUrl`, `locator`), and whether it is a reader account (`isReader`). Accounts are selected by `name`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"maskingPolicy":{"name":"maskingPolicy","type":"\u001bsnowflake.maskingPolicy","title":"Snowflake Masking Policy","desc":"Snowflake masking policy that redacts or transforms column values at query time based on the executing role or context. Auditing these policies reveals where sensitive data is protected and how: `body` holds the SQL CASE expression that implements the masking, `signature` gives the input columns and types the policy operates on (each as a `name:type` pair like `val:STRING`), and `references` enumerates every table, view, or column the policy is currently attached to. Policies are schema-scoped and selected by `name`, `databaseName`, and `schemaName`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"networkPolicy":{"name":"networkPolicy","type":"\u001bsnowflake.networkPolicy","title":"Snowflake Network Policy","desc":"Access control rule that restricts inbound access to the account, or to individual users, by source IP address and network rule. Audit network policies to confirm that access is limited to trusted ranges: allowed and blocked IP addresses are exposed through `allowedIpList` and `blockedIpList`, and the referenced network rules through `allowedNetworkRules` and `blockedNetworkRules`, while the corresponding `entriesIn*` counts give the size of each list at a glance. The `name` field selects the policy, for example `snowflake.networkPolicy(name: \"corp_ip_allowlist\")`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"networkRule":{"name":"networkRule","type":"\u001bsnowflake.networkRule","title":"Snowflake Network Rule","desc":"Named set of network identifiers (IP ranges, cloud private-link endpoints, or host:port pairs) that network policies and external-access integrations reference to allow or block traffic. The `type` field reports which kind of identifier the rule holds (HOST_PORT, AWSVPCEID, or AZURELINKID), and `mode` reports the traffic direction it governs (INGRESS, EGRESS, or INTERNAL_STAGE). The `valueList` field returns the actual identifiers, and `entriesInValueList` gives their count. Rules are schema-scoped and selected by `name`, `databaseName`, and `schemaName`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"notificationIntegration":{"name":"notificationIntegration","type":"\u001bsnowflake.notificationIntegration","title":"Snowflake Notification Integration","desc":"Account-level object that connects Snowflake to an external messaging or queue service (Amazon SNS/SQS, Google Pub/Sub, or Azure Event Grid) for event notifications and auto-ingest pipelines. Auditing notification integrations surfaces the trust edge to external messaging: `enabled` gates whether it is live, `direction` reports inbound versus outbound flow, `notificationProvider` names the backing service, and the provider-specific fields expose the topics, subscriptions, and roles involved. The `properties` map returns the complete DESCRIBE NOTIFICATION INTEGRATION output for any field not surfaced individually.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"parameter":{"name":"parameter","type":"\u001bsnowflake.parameter","title":"Snowflake Parameter","desc":"Configuration parameter governing account, session, or object behavior, such as session timeouts, network policy binding, and data-governance defaults. Auditing parameters surfaces settings that weaken security posture when left at unsafe values. The `key` field selects the parameter by name, for example `snowflake.account.parameters.where(key == \"STATEMENT_TIMEOUT_IN_SECONDS\")`. The `level` field reports the scope at which the effective value was set, letting you distinguish an explicit override from an inherited default.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"passwordPolicy":{"name":"passwordPolicy","type":"\u001bsnowflake.passwordPolicy","title":"Snowflake Password Policy","desc":"Password policy governing complexity and rotation rules for user passwords in the account, letting you audit whether length, character-class, age, reuse, and lockout requirements meet your baseline. Complexity controls surface as integers such as `passwordMinLength`, `passwordMinSpecialChars`, `passwordMaxAgeDays`, `passwordMaxRetries`, and `passwordHistory`. Password policies are scoped to a schema, so `databaseName` and `schemaName` identify where the policy lives.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"policyReference":{"name":"policyReference","type":"\u001bsnowflake.policyReference","title":"Snowflake Policy Reference","desc":"Single attachment of a governance policy (masking, row-access, password, projection, aggregation, or authentication) to a Snowflake entity, as reported by INFORMATION_SCHEMA.POLICY_REFERENCES. Each reference pairs the policy identity (policyDatabase, policySchema, policyName, policyKind) with the protected entity (refDatabaseName, refSchemaName, refEntityName, and refEntityDomain, one of ACCOUNT, INTEGRATION, TABLE, TAG, USER, or VIEW). refColumnName names the column for column-level masking, and tagName is populated when the policy is attached indirectly through a tag. Audit these to see where a policy is enforced across an account and whether each attachment is currently active (policyStatus).","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"procedure":{"name":"procedure","type":"\u001bsnowflake.procedure","title":"Snowflake Procedure","desc":"Stored procedure or built-in system procedure available in a Snowflake account. Procedures run custom logic with the caller's or owner's rights, so their definition and security posture matter for audits. The `isSecure` flag marks a procedure whose definition is hidden from users without ownership, and `isBuiltin` distinguishes account-defined procedures from Snowflake's system procedures.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"resourceMonitor":{"name":"resourceMonitor","type":"\u001bsnowflake.resourceMonitor","title":"Snowflake Resource Monitor","desc":"Resource monitor that caps credit consumption for one or more warehouses, the primary control for preventing runaway compute spend. A monitor tracks credit usage against a quota and can trigger notifications or suspend warehouses once configured thresholds are crossed. The `level` field indicates whether the monitor applies at the ACCOUNT or WAREHOUSE scope. `notifyAt` lists the usage percentages that trigger notifications, while `suspendAt` and `suspendImmediateAt` give the percentages at which warehouses are suspended (null when not configured).","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"role":{"name":"role","type":"\u001bsnowflake.role","title":"Snowflake Role","desc":"Role in the account's access-control model, the unit that privileges are granted to and that users and other roles inherit. Auditing roles reveals who holds which privileges and how they chain through the role hierarchy, which is central to least-privilege review. The `owner` holds administrative control over the role, `grants` lists the privileges granted to the role (SHOW GRANTS TO ROLE), and `grantees` lists the users and roles the role has in turn been granted to (SHOW GRANTS OF ROLE). The `assignedToUsers`, `grantedToRoles`, and `grantedRoles` counts summarize the role's reach and its position in the hierarchy.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"rowAccessPolicy":{"name":"rowAccessPolicy","type":"\u001bsnowflake.rowAccessPolicy","title":"Snowflake Row-Access Policy","desc":"Row-level access-control policy that filters which rows a query returns based on the executing role or context. Auditing row-access policies surfaces the columns each policy inspects (`signature` as `name:type` pairs), the SQL predicate it enforces (`body`), and every table or view it is attached to (`references`), so you can verify sensitive datasets are gated as intended. Policies are schema-scoped and selected by `name`, `databaseName`, and `schemaName`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"schema":{"name":"schema","type":"\u001bsnowflake.schema","title":"Snowflake Schema","desc":"Logical container within a database that groups tables, views, and other objects and carries its own retention and ownership settings. Schemas are enumerated across every database in the account, each reporting its parent `databaseName`, and are selected by `name`. `retentionTime` gives the Time Travel data-retention window in days, `isDefault` and `isCurrent` mark the session's active schema, and `ownerRoleType` distinguishes a standard role owner from a database role.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"secret":{"name":"secret","type":"\u001bsnowflake.secret","title":"Snowflake Secret","desc":"Snowflake-managed secret that stores the credentials Snowflake objects use to authenticate to external systems, referenced by external functions, notification integrations, and similar objects. Auditing secrets surfaces what kind of credential is held (`secretType` is PASSWORD, OAUTH2, or GENERIC_STRING), which security or API integration a secret is bound to, and the expiry deadlines on OAuth access and refresh tokens, so stale or over-scoped credentials can be flagged. The `oauthScopes` field records the OAuth scopes granted to the secret, and ownership is captured by `owner` and `ownerRoleType`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"securityIntegration":{"name":"securityIntegration","type":"\u001bsnowflake.securityIntegration","title":"Snowflake Security Integration","desc":"Security integration that configures how the account interoperates with external identity providers and authorization services, such as SAML2 single sign-on, OAuth clients, SCIM user provisioning, and external OAuth token validation. Auditing these integrations reveals which federation and delegated-authentication paths are trusted for account access, whether each is enabled, and how single sign-on is configured. The `type` field distinguishes the integration kind (for example SAML2 or OAUTH), and `properties` returns the full DESCRIBE SECURITY INTEGRATION result as a key/value map keyed by property name (SAML2_X509_CERT, SAML2_ISSUER, OAUTH_CLIENT_ID, and so on). The `saml2*` fields pull the corresponding single-sign-on settings out of that map for integrations of type SAML2.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"sessionPolicy":{"name":"sessionPolicy","type":"\u001bsnowflake.sessionPolicy","title":"Snowflake session policy","desc":"Session policy that controls how long a session may remain idle before Snowflake terminates it, a lever for limiting the window in which an unattended or hijacked session stays usable. The `sessionIdleTimeoutMins` value (Snowflake default 240) applies to all session types, while `sessionUiIdleTimeoutMins` applies specifically to Snowsight browser sessions, so the two can enforce a tighter bound on interactive UI logins.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"share":{"name":"share","type":"\u001bsnowflake.share","title":"Snowflake Share","desc":"Snowflake data share, the mechanism for exposing a database to other accounts. Auditing shares matters because they cross account boundaries: an OUTBOUND share grants external accounts read access to your data, so its `to` list is the set of accounts that can consume `databaseName`. The `kind` field distinguishes an OUTBOUND share (created by this account) from an INBOUND share (consumed from another account); for INBOUND shares `name` is fully qualified as account.share, and for OUTBOUND shares it is the bare share name.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"stage":{"name":"stage","type":"\u001bsnowflake.stage","title":"Snowflake Stage","desc":"Named location where Snowflake loads and unloads bulk data, either an internal stage backed by Snowflake-managed storage or an external stage pointing at a cloud bucket. The `type` field distinguishes INTERNAL from EXTERNAL, and for external stages `cloud`, `url`, `endpoint`, and `storeIntegration` describe the backing object store. Audit `hasCredentials` and `hasEncryptionKey` to find stages that embed inline credentials or a customer-supplied encryption key rather than relying on a storage integration, and `directoryEnabled` to see whether a directory table exposes file metadata over the staged contents.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"storageIntegration":{"name":"storageIntegration","type":"\u001bsnowflake.storageIntegration","title":"Snowflake Storage Integration","desc":"Account-level object that grants Snowflake access to external cloud storage (Amazon S3, Google Cloud Storage, or Azure Blob) without exposing static credentials, referenced by external stages. Auditing storage integrations matters because they define a trust boundary to external buckets: `enabled` gates whether it is live, `storageAllowedLocations` and `storageBlockedLocations` constrain which URLs stages may reach, and the provider-specific fields (`storageAwsRoleArn`, `storageAwsIamUserArn`, `storageGcpServiceAccount`, `azureTenantId`, `azureConsentUrl`) expose the assumed identity on each cloud. The `properties` map returns the complete DESCRIBE STORAGE INTEGRATION output for any field not surfaced individually.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"tag":{"name":"tag","type":"\u001bsnowflake.tag","title":"Snowflake Tag","desc":"Schema-level label used for governance, data classification, and policy attachment across Snowflake objects. A tag is identified by `name` within its `databaseName` and `schemaName`. When `allowedValues` is non-empty, the tag is constrained to that set of permitted string values, letting you audit whether sensitive-data tagging follows an approved vocabulary; an empty list means the tag accepts any value. `ownerRoleType` distinguishes a standard role owner from a database role.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"task":{"name":"task","type":"\u001bsnowflake.task","title":"Snowflake task","desc":"A scheduled or triggered unit of SQL in a schema, keyed by name. Tasks run with the owner's rights on a warehouse and a schedule, which makes them a common automation surface and a persistence or privilege-escalation vector. Covers the warehouse the task runs on, the schedule and predecessor relationships that form a task graph, the run state, the SQL definition and its gating condition, and whether overlapping runs are allowed. Select a task by name, for example `snowflake.tasks.where(name == \"REFRESH_SALES\")`.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"user":{"name":"user","type":"\u001bsnowflake.user","title":"Snowflake User","desc":"Snowflake user account, covering login identity, authentication state (password, RSA key-pair, and Duo external authentication), access controls (disabled status, forced password change, default role and default warehouse), and lifecycle timestamps. Auditing users surfaces dormant or stale accounts, missing credential hygiene, and over-broad default roles. `daysSinceLastLogin` is derived from the last successful login and returns -1 when the user has never logged in. `grants` lists the roles granted directly to this user, and `parameters` lists user-level parameter overrides.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"view":{"name":"view","type":"\u001bsnowflake.view","title":"Snowflake View","desc":"View or materialized view defined in a Snowflake schema, exposing a stored query over one or more underlying tables. The `text` field holds the view definition SQL, which reveals exactly what data the view surfaces, and `isSecure` reports whether it is a secure view that hides its definition and restricts what unauthorized roles can read. Materialized views (`isMaterialized`) persist query results for faster reads. Query views to review data exposure, ownership, and the SQL behind derived datasets.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true},"warehouse":{"name":"warehouse","type":"\u001bsnowflake.warehouse","title":"Snowflake Warehouse","desc":"Snowflake virtual warehouse that provides the compute resources for query execution and data loading. Warehouse size, multi-cluster counts, and auto-suspend behavior drive both credit consumption and performance, so these records support audits of idle-timeout hygiene, cluster scaling limits, and credit governance through the associated resource monitor. Live utilization is reported in available, provisioning, quiescing, and other, while running and queued reflect the current query load.","provider":"go.mondoo.com/mql/v13/providers/snowflake","is_implicit_resource":true}},"title":"Snowflake Data Cloud","desc":"Root namespace for all Snowflake resources. Query `snowflake.account` for users, roles, security integrations, password and network policies, warehouses, databases, stages, shares, API integrations, tags, failover groups, and grants. `currentRole` returns the role active for the current session.","min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.account":{"id":"snowflake.account","name":"snowflake.account","fields":{"accountAdmins":{"name":"accountAdmins","type":"\u0019\u001bsnowflake.user","title":"Users that hold the ACCOUNTADMIN role (directly or indirectly via role grants)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"accountId":{"name":"accountId","type":"\u0007","title":"Account ID","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"apiIntegrations":{"name":"apiIntegrations","type":"\u0019\u001bsnowflake.apiIntegration","title":"API integrations in the account","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"applicationPackages":{"name":"applicationPackages","type":"\u0019\u001bsnowflake.applicationPackage","title":"Application packages in the account (Native App providers)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"applications":{"name":"applications","type":"\u0019\u001bsnowflake.application","title":"Installed Snowflake Native Apps in the account","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"authenticationPolicies":{"name":"authenticationPolicies","type":"\u0019\u001bsnowflake.authenticationPolicy","title":"Authentication policies in the account","min_provider_version":"13.2.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"connections":{"name":"connections","type":"\u0019\u001bsnowflake.connection","title":"Connections in the account (replication and failover)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"cortexEnabledCrossRegion":{"name":"cortexEnabledCrossRegion","type":"\u0007","title":"Value of the account's CORTEX_ENABLED_CROSS_REGION parameter","desc":"Governs whether Snowflake Cortex may process inference requests in a region other than the account's own when a model is not available locally. Common values are DISABLED (no cross-region inference), ANY_REGION (any Snowflake region), and region-group values such as AWS_US, AWS_EU, AWS_APJ, AZURE_US, or AWS_US_ANY. Empty when the parameter is unset.","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"cortexSearchServices":{"name":"cortexSearchServices","type":"\u0019\u001bsnowflake.cortexSearchService","title":"Cortex Search services in the account (managed retrieval indexes for RAG)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databases":{"name":"databases","type":"\u0019\u001bsnowflake.database","title":"Databases in the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"externalAccessIntegrations":{"name":"externalAccessIntegrations","type":"\u0019\u001bsnowflake.externalAccessIntegration","title":"External access integrations in the account (outbound network egress governance)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"failoverGroups":{"name":"failoverGroups","type":"\u0019\u001bsnowflake.failoverGroup","title":"Failover/replication groups in the account","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"functions":{"name":"functions","type":"\u0019\u001bsnowflake.function","title":"User-defined functions across every schema in the account","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grants":{"name":"grants","type":"\u0019\u001bsnowflake.grant","title":"Account-level grants (privileges granted ON ACCOUNT)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"managedAccounts":{"name":"managedAccounts","type":"\u0019\u001bsnowflake.managedAccount","title":"Managed (reader) accounts provisioned for data sharing","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"maskingPolicies":{"name":"maskingPolicies","type":"\u0019\u001bsnowflake.maskingPolicy","title":"Masking policies in the account (column-level masking for sensitive data)","min_provider_version":"13.2.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"networkPolicies":{"name":"networkPolicies","type":"\u0019\u001bsnowflake.networkPolicy","title":"Network policies in the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"networkPolicy":{"name":"networkPolicy","type":"\u0007","title":"Value of the account's NETWORK_POLICY parameter (empty when unset)","desc":"Deliberately a string rather than a typed snowflake.networkPolicy reference: the value reports whether an account-level policy is configured, and the named policy is not always enumerable in networkPolicies (e.g. when the session role lacks privileges to list it). A typed reference would resolve to null in those cases and wrongly read as \"no policy set\".","min_provider_version":"13.2.10","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"networkRules":{"name":"networkRules","type":"\u0019\u001bsnowflake.networkRule","title":"Network rules in the account (IP ranges, private-link endpoints, and host:port sets)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"notificationIntegrations":{"name":"notificationIntegrations","type":"\u0019\u001bsnowflake.notificationIntegration","title":"Notification integrations in the account (external messaging and queue endpoints)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"parameters":{"name":"parameters","type":"\u0019\u001bsnowflake.parameter","title":"Parameters in the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordPolicies":{"name":"passwordPolicies","type":"\u0019\u001bsnowflake.passwordPolicy","title":"Password policies in the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"procedures":{"name":"procedures","type":"\u0019\u001bsnowflake.procedure","title":"Procedures in the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"region":{"name":"region","type":"\u0007","title":"Account region","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"resourceMonitors":{"name":"resourceMonitors","type":"\u0019\u001bsnowflake.resourceMonitor","title":"Resource monitors that govern credit usage for warehouses","min_provider_version":"13.2.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"roles":{"name":"roles","type":"\u0019\u001bsnowflake.role","title":"Roles in the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"rowAccessPolicies":{"name":"rowAccessPolicies","type":"\u0019\u001bsnowflake.rowAccessPolicy","title":"Row-access policies in the account (row-level access control on tables and views)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemas":{"name":"schemas","type":"\u0019\u001bsnowflake.schema","title":"Schemas across every database in the account","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"secrets":{"name":"secrets","type":"\u0019\u001bsnowflake.secret","title":"Snowflake-managed secrets in the account","min_provider_version":"13.2.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"securityIntegrations":{"name":"securityIntegrations","type":"\u0019\u001bsnowflake.securityIntegration","title":"Security integrations in the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"sessionPolicies":{"name":"sessionPolicies","type":"\u0019\u001bsnowflake.sessionPolicy","title":"Session policies in the account","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"shares":{"name":"shares","type":"\u0019\u001bsnowflake.share","title":"Shares in the account (inbound and outbound)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"stages":{"name":"stages","type":"\u0019\u001bsnowflake.stage","title":"Stages in the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"storageIntegrations":{"name":"storageIntegrations","type":"\u0019\u001bsnowflake.storageIntegration","title":"Storage integrations in the account (external cloud storage access)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"tags":{"name":"tags","type":"\u0019\u001bsnowflake.tag","title":"Tags defined in the account (governance / classification)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"tasks":{"name":"tasks","type":"\u0019\u001bsnowflake.task","title":"Scheduled tasks across every schema in the account","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"url":{"name":"url","type":"\u0007","title":"Account URL","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"users":{"name":"users","type":"\u0019\u001bsnowflake.user","title":"Users in the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"views":{"name":"views","type":"\u0019\u001bsnowflake.view","title":"Views across every schema in the account","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"warehouses":{"name":"warehouses","type":"\u0019\u001bsnowflake.warehouse","title":"Warehouses in the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Account","desc":"Top-level entry point for auditing a Snowflake account and every object it contains: `users`, `roles`, `databases`, `warehouses`, `stages`, `shares`, `apiIntegrations`, `tags`, `failoverGroups`, and account-level privileges via `grants`. The account-wide security posture is reachable through `securityIntegrations`, `passwordPolicies`, `networkPolicies`, `sessionPolicies`, `authenticationPolicies`, `maskingPolicies`, and `secrets`, while `resourceMonitors` exposes credit-usage guardrails for warehouses. `accountAdmins` lists the users that hold the ACCOUNTADMIN role, directly or through role grants, so you can review the account's most privileged identities.","min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.apiIntegration":{"id":"snowflake.apiIntegration","name":"snowflake.apiIntegration","fields":{"apiAllowedPrefixes":{"name":"apiAllowedPrefixes","type":"\u0019\u0007","title":"List of URL prefixes that calls from Snowflake are restricted to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"apiAwsExternalId":{"name":"apiAwsExternalId","type":"\u0007","title":"AWS IAM user ARN that Snowflake uses to assume the role (assume-role principal)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"apiAwsRoleArn":{"name":"apiAwsRoleArn","type":"\u0007","title":"AWS IAM role ARN for AWS API Gateway integrations","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"apiBlockedPrefixes":{"name":"apiBlockedPrefixes","type":"\u0019\u0007","title":"List of URL prefixes that calls from Snowflake are blocked from","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"azureAdApplicationId":{"name":"azureAdApplicationId","type":"\u0007","title":"Azure AD application ID (for Azure API Management integrations)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"azureTenantId":{"name":"azureTenantId","type":"\u0007","title":"Azure tenant ID (for Azure API Management integrations)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Category of the integration (always \"API\")","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the integration was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the integration is enabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the API integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","title":"DESCRIBE API INTEGRATION output","desc":"Every property Snowflake reports for the integration, keyed by its raw uppercase property name. Common keys are API_AWS_ROLE_ARN, API_AWS_EXTERNAL_ID, API_ALLOWED_PREFIXES, API_BLOCKED_PREFIXES, AZURE_TENANT_ID, AZURE_AD_APPLICATION_ID, ENABLED, and COMMENT. The set of keys depends on `type`, so AWS keys are absent on an Azure integration and vice versa. Prefix and credential values are also available individually via apiAllowedPrefixes, apiAwsRoleArn, and the other dedicated fields.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"API type (e.g., aws_api_gateway, azure_api_management, google_api_gateway)","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake API Integration","desc":"API integration object holding the cloud authentication context that external functions and Git repository integrations use to reach an HTTPS proxy service. The `type` field selects the backing provider (aws_api_gateway, azure_api_management, or google_api_gateway) and determines which credential fields carry a value. Auditing these matters because the integration grants Snowflake outbound access to external endpoints: `enabled` gates whether it is live, `apiAllowedPrefixes` and `apiBlockedPrefixes` constrain which URLs calls may reach, and `apiAwsRoleArn`, `apiAwsExternalId`, `azureTenantId`, and `azureAdApplicationId` expose the assumed role and tenant trust. The `properties` map returns the complete DESCRIBE API INTEGRATION output for any field not surfaced individually.","min_provider_version":"13.0.7","defaults":"name type enabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.application":{"id":"snowflake.application","name":"snowflake.application","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment on the application","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Installed version display label","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u001bsnowflake.role","title":"Role that owns the application","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"patch":{"name":"patch","type":"\u0005","is_mandatory":true,"title":"Installed patch number within the version","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source the application was installed from (the listing or application package)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"sourceType":{"name":"sourceType","type":"\u0007","is_mandatory":true,"title":"How the application was sourced (such as REPOSITORY for a listing or a local application package)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Installed version label","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Native App","desc":"An installed Snowflake Native App in the account, keyed by name. Native Apps run provider-supplied code inside the consumer account with granted privileges, so they are the account's third-party-code and supply-chain surface. Covers where the app was installed from (a Marketplace listing or a local application package), the installed version and patch, and the owning role. Select an app by name, for example `snowflake.applications.where(name == \"SECURITY_APP\")`.","min_provider_version":"13.3.7","defaults":"name version owner","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.applicationPackage":{"id":"snowflake.applicationPackage","name":"snowflake.applicationPackage","fields":{"applicationClass":{"name":"applicationClass","type":"\u0007","is_mandatory":true,"title":"Application class of the package","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment on the application package","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"distribution":{"name":"distribution","type":"\u0007","is_mandatory":true,"title":"Release distribution (INTERNAL or EXTERNAL)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application package name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u001bsnowflake.role","title":"Role that owns the application package","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake application package","desc":"An application package in the account, keyed by name. Application packages are the provider side of Snowflake Native Apps, bundling the code and data that become an installed application. Covers the release distribution (internal or external), the application class, and the owning role. Select a package by name, for example `snowflake.applicationPackages.where(name == \"MY_APP_PKG\")`.","min_provider_version":"13.3.7","defaults":"name distribution owner","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.authenticationPolicy":{"id":"snowflake.authenticationPolicy","name":"snowflake.authenticationPolicy","fields":{"authenticationMethods":{"name":"authenticationMethods","type":"\u0019\u0007","title":"Permitted authentication methods (one or more of ALL, SAML, PASSWORD, OAUTH, KEYPAIR)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"clientTypes":{"name":"clientTypes","type":"\u0019\u0007","title":"Permitted client types (one or more of ALL, SNOWFLAKE_UI, DRIVERS, SNOWSQL)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\u0007","is_mandatory":true,"title":"When the policy was created (Snowflake-formatted string)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database that owns the policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"mfaAuthenticationMethods":{"name":"mfaAuthenticationMethods","type":"\u0019\u0007","title":"Permitted MFA authentication methods (one or more of ALL, SAML, PASSWORD)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"mfaEnrollment":{"name":"mfaEnrollment","type":"\u0007","title":"MFA enrollment requirement (REQUIRED or OPTIONAL)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Authentication policy name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"options":{"name":"options","type":"\u0007","is_mandatory":true,"title":"Comma-separated list of policy options reported by SHOW","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Owner role type (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema that owns the policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"securityIntegrationRefs":{"name":"securityIntegrationRefs","type":"\u0019\u001bsnowflake.securityIntegration","title":"Security integrations permitted by this policy","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"securityIntegrations":{"name":"securityIntegrations","type":"\u0019\u0007","title":"Names of security integrations permitted by this policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Authentication Policy","desc":"Authentication policy governing which login methods, MFA requirements, and client types are permitted for the account or the users it is attached to. This is the definitive control for whether MFA is enforced and whether password authentication is still allowed, so it is central to auditing login security. The `authenticationMethods` and `mfaAuthenticationMethods` fields report the permitted method sets, `mfaEnrollment` reports whether MFA is REQUIRED or OPTIONAL, `clientTypes` restricts which client applications may connect, and `securityIntegrations` lists the external auth integrations the policy allows.","min_provider_version":"13.2.7","defaults":"name mfaEnrollment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.connection":{"id":"snowflake.connection","name":"snowflake.connection","fields":{"accountLocator":{"name":"accountLocator","type":"\u0007","is_mandatory":true,"title":"Account locator that owns the connection","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"accountName":{"name":"accountName","type":"\u0007","is_mandatory":true,"title":"Account name that owns the connection","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"connectionUrl":{"name":"connectionUrl","type":"\u0007","is_mandatory":true,"title":"Durable connection URL clients target","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the connection was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"failoverAllowedToAccounts":{"name":"failoverAllowedToAccounts","type":"\u0019\u0007","is_mandatory":true,"title":"Accounts that failover is permitted to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isPrimary":{"name":"isPrimary","type":"\u0004","is_mandatory":true,"title":"Whether this account is the primary for the connection","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the connection","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"organizationName":{"name":"organizationName","type":"\u0007","is_mandatory":true,"title":"Organization name that owns the connection","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"primary":{"name":"primary","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the primary connection (when this is a replica)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"regionGroup":{"name":"regionGroup","type":"\u0007","is_mandatory":true,"title":"Region group of the connection (empty when not set)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflakeRegion":{"name":"snowflakeRegion","type":"\u0007","is_mandatory":true,"title":"Snowflake region the connection lives in","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Connection","desc":"Account-level connection object used for Business Critical failover and client redirect across replicated accounts, exposing a stable connection URL that clients target while the underlying primary account can change. Auditing connections surfaces which account currently serves as primary (`isPrimary`, `primary`), the accounts failover is permitted to (`failoverAllowedToAccounts`), and the durable `connectionUrl` clients use. Connections are selected by `name`.","min_provider_version":"13.3.7","defaults":"name isPrimary","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.cortexSearchService":{"id":"snowflake.cortexSearchService","name":"snowflake.cortexSearchService","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment on the service","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the service was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database that contains the service","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"definition":{"name":"definition","type":"\u0007","title":"Query that defines the source data indexed by the service","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cortex Search service name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema that contains the service","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"serviceQueryUrl":{"name":"serviceQueryUrl","type":"\u0007","title":"URL clients call to query the service","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"targetLag":{"name":"targetLag","type":"\u0007","title":"Target data freshness lag, the maximum staleness of indexed data (such as \"1 hour\" or \"5 minutes\")","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"warehouse":{"name":"warehouse","type":"\u001bsnowflake.warehouse","title":"Warehouse that runs indexing and query serving for the service","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Cortex Search service","desc":"A Cortex Search service in the account, the managed retrieval index that powers low-latency semantic and keyword search over a source query's text, the retrieval half of a Cortex retrieval-augmented-generation (RAG) application. Covers where the service lives (databaseName, schemaName, name), the warehouse that runs indexing and query serving, the target data freshness lag, the query that defines the indexed source data, and the URL clients call to issue searches. The query definition and service URL are high-value review targets: together they reveal exactly which data a service exposes and where it can be reached. Select a service by name, for example `snowflake.account.cortexSearchServices.where(name == \"SUPPORT_DOCS\")`.","min_provider_version":"13.3.7","defaults":"name databaseName schemaName","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.database":{"id":"snowflake.database","name":"snowflake.database","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the database","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the database was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"droppedAt":{"name":"droppedAt","type":"\t","is_mandatory":true,"title":"When the database was dropped","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isCurrent":{"name":"isCurrent","type":"\u0004","is_mandatory":true,"title":"Whether the database is a current database","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether the database is a default database","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"maskingPolicies":{"name":"maskingPolicies","type":"\u0019\u001bsnowflake.maskingPolicy","title":"Masking policies in the database (column-level masking for sensitive data)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the database","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"options":{"name":"options","type":"\u0007","is_mandatory":true,"title":"Database options string","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"origin":{"name":"origin","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the source database","desc":"Populated when the database was created from a share or as a replica, naming the origin object. Empty for a standard, locally created database.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Database owner","desc":"Deprecated in favor of ownerRole. The name of the role that owns the database.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"ownerRole":{"name":"ownerRole","type":"\u001bsnowflake.role","title":"Role that owns the database","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"resourceGroup":{"name":"resourceGroup","type":"\u0007","is_mandatory":true,"title":"Resource group of the database","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"retentionTime":{"name":"retentionTime","type":"\u0005","is_mandatory":true,"title":"Time Travel data retention period, in days","desc":"Number of days that Snowflake preserves historical data for Time Travel, allowing dropped or modified objects to be recovered within the window.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"roles":{"name":"roles","type":"\u0019\u001bsnowflake.databaseRole","title":"Database-scoped roles (SHOW DATABASE ROLES IN DATABASE)","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"rowAccessPolicies":{"name":"rowAccessPolicies","type":"\u0019\u001bsnowflake.rowAccessPolicy","title":"Row-access policies in the database (row-level access control on tables and views)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemas":{"name":"schemas","type":"\u0019\u001bsnowflake.schema","title":"Schemas in the database","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"secrets":{"name":"secrets","type":"\u0019\u001bsnowflake.secret","title":"Snowflake-managed secrets in the database","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"tags":{"name":"tags","type":"\u0019\u001bsnowflake.tag","title":"Tags defined in the database (governance / classification)","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"transient":{"name":"transient","type":"\u0004","is_mandatory":true,"title":"Whether the database is transient","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Database","desc":"Logical container that holds schemas, tables, views, and other objects in a Snowflake account. Auditing databases surfaces ownership, Time Travel data retention, transient (non-fail-safe) status, and the database-scoped roles that grant access to its contents. The `origin` field identifies a database created from a share or replica, and `roles` enumerates the roles defined within the database. The database-scoped data-governance controls are reachable through `schemas`, `maskingPolicies`, `rowAccessPolicies`, `tags`, and `secrets`, mirroring the account-wide collections but limited to this database. Asset discovery emits each database as its own asset, so these fields also form the posture surface scanned per database.","min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.databaseRole":{"id":"snowflake.databaseRole","name":"snowflake.databaseRole","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the role was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database that owns the role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grantedDatabaseRoles":{"name":"grantedDatabaseRoles","type":"\u0005","is_mandatory":true,"title":"Number of database roles granted to this role (role chain depth)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grantedToDatabaseRoles":{"name":"grantedToDatabaseRoles","type":"\u0005","is_mandatory":true,"title":"Number of database roles this database role has been granted to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grantedToRoles":{"name":"grantedToRoles","type":"\u0005","is_mandatory":true,"title":"Number of account roles this database role has been granted to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isCurrent":{"name":"isCurrent","type":"\u0004","is_mandatory":true,"title":"Whether the role is the current session's active role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isInherited":{"name":"isInherited","type":"\u0004","is_mandatory":true,"title":"Whether the role is inherited via another granted role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name (not database-qualified)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Owner role type (ROLE | DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Database Role","desc":"Database-scoped role that grants privileges confined to a single database, used to model least-privilege access without account-wide reach. Audit these to see who owns each role (`owner` and `ownerRoleType`, where the owner is either a ROLE or a DATABASE_ROLE) and how roles nest into one another. The grant counts (`grantedToRoles`, `grantedToDatabaseRoles`, and `grantedDatabaseRoles`) reveal the depth of the role chain, which matters when reasoning about effective privilege escalation.","min_provider_version":"13.1.1","defaults":"databaseName name owner","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.externalAccessIntegration":{"id":"snowflake.externalAccessIntegration","name":"snowflake.externalAccessIntegration","fields":{"allowedApiAuthenticationIntegrations":{"name":"allowedApiAuthenticationIntegrations","type":"\u0019\u0007","title":"Names of the API authentication integrations the integration allows","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"allowedAuthenticationSecrets":{"name":"allowedAuthenticationSecrets","type":"\u0019\u0007","title":"Fully qualified names of the secrets the integration allows","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"allowedNetworkRules":{"name":"allowedNetworkRules","type":"\u0019\u0007","title":"Fully qualified names of the network rules the integration allows","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment on the integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the integration is enabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"External access integration name","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake external access integration","desc":"An external access integration in the account, keyed by name. External access integrations are the account's outbound-egress control: they whitelist which network rules (hostnames and ports), secrets, and API authentication integrations a function or procedure may reach, so they are central to preventing data exfiltration from user code. Covers whether the integration is enabled and the allowed network rules, secrets, and API authentication integrations. Select an integration by name, for example `snowflake.externalAccessIntegrations.where(enabled == true)`.","min_provider_version":"13.3.7","defaults":"name enabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.failoverGroup":{"id":"snowflake.failoverGroup","name":"snowflake.failoverGroup","fields":{"allowedAccounts":{"name":"allowedAccounts","type":"\u0019\u0007","is_mandatory":true,"title":"Account identifiers (org.account) allowed to host secondaries","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"allowedIntegrationTypes":{"name":"allowedIntegrationTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Integration types allowed for replication (e.g., SECURITY INTEGRATIONS, API INTEGRATIONS)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the group was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databases":{"name":"databases","type":"\u0019\u0007","title":"Fully-qualified names of databases included in the group","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isPrimary":{"name":"isPrimary","type":"\u0004","is_mandatory":true,"title":"True for the primary group, false for replicas","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Group name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"nextScheduledRefresh":{"name":"nextScheduledRefresh","type":"\u0007","is_mandatory":true,"title":"Next scheduled refresh time as reported by Snowflake (free-form)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"objectTypes":{"name":"objectTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Object types replicated by this group (e.g., DATABASES, SHARES, INTEGRATIONS)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning role","desc":"Deprecated in favor of ownerRole. The name of the role that owns the failover group.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"ownerRole":{"name":"ownerRole","type":"\u001bsnowflake.role","title":"Role that owns the failover group","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"primary":{"name":"primary","type":"\u0007","is_mandatory":true,"title":"Fully-qualified primary group identifier (org.account.name)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"regionGroup":{"name":"regionGroup","type":"\u0007","is_mandatory":true,"title":"Region group (for multi-region deployments)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"replicationSchedule":{"name":"replicationSchedule","type":"\u0007","is_mandatory":true,"title":"Cron-style replication schedule (empty if manual refresh)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"secondaryState":{"name":"secondaryState","type":"\u0007","is_mandatory":true,"title":"Secondary refresh state (e.g., SUSPENDED, STARTED)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"shares":{"name":"shares","type":"\u0019\u0007","title":"Fully-qualified names of shares included in the group","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflakeRegion":{"name":"snowflakeRegion","type":"\u0007","is_mandatory":true,"title":"Snowflake region (e.g., AWS_US_WEST_2)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Group type (ACCOUNT for failover, BUSINESS_CONTINUITY for replication)","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Failover Group","desc":"Failover or replication group that copies account-level objects to secondary accounts for disaster recovery and business continuity. The `type` field distinguishes a failover group (ACCOUNT) from a replication group (BUSINESS_CONTINUITY), and `isPrimary` marks whether this account holds the source group or a read-only replica. Auditing these groups confirms that critical databases and shares are replicated to the intended target accounts and, via `replicationSchedule` and `secondaryState`, that replicas are refreshing on the expected cadence rather than drifting or sitting suspended.","min_provider_version":"13.1.1","defaults":"name type isPrimary secondaryState","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.function":{"id":"snowflake.function","name":"snowflake.function","fields":{"arguments":{"name":"arguments","type":"\u0007","is_mandatory":true,"title":"Argument signature of the function","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database the function belongs to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the function","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"externalAccessIntegrations":{"name":"externalAccessIntegrations","type":"\u0019\u001bsnowflake.externalAccessIntegration","title":"External access integrations the function is allowed to use","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isAggregate":{"name":"isAggregate","type":"\u0004","is_mandatory":true,"title":"Whether the function is an aggregate function","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isBuiltin":{"name":"isBuiltin","type":"\u0004","is_mandatory":true,"title":"Whether the function is built into Snowflake","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isDataMetric":{"name":"isDataMetric","type":"\u0004","is_mandatory":true,"title":"Whether the function is a data metric function","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isExternalFunction":{"name":"isExternalFunction","type":"\u0004","is_mandatory":true,"title":"Whether the function is an external function that calls an HTTP endpoint through an API integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isMemoizable":{"name":"isMemoizable","type":"\u0004","is_mandatory":true,"title":"Whether the function caches its results (memoizable)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isSecure":{"name":"isSecure","type":"\u0004","is_mandatory":true,"title":"Whether the function is secure, hiding its definition from users without ownership","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isTableFunction":{"name":"isTableFunction","type":"\u0004","is_mandatory":true,"title":"Whether the function is a table function","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"language":{"name":"language","type":"\u0007","is_mandatory":true,"title":"Implementation language (such as SQL, JAVASCRIPT, PYTHON, JAVA, or SCALA)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Function name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema the function belongs to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"secrets":{"name":"secrets","type":"\u0019\u001bsnowflake.secret","title":"Secrets the function is allowed to reference","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake user-defined function","desc":"A user-defined function (UDF) in a schema, keyed by name. UDFs run custom logic (SQL, JavaScript, Python, Java, or Scala) with the caller's or owner's rights, and can reach outside Snowflake through external access integrations and secrets, so they are a code-execution and data-egress surface. Covers the implementation language, whether the function is secure (its definition is hidden), whether it is an external function that calls an HTTP endpoint, the argument signature, and the bound external access integrations and secrets. Select a function by name, for example `snowflake.functions.where(language == \"PYTHON\")`.","min_provider_version":"13.3.7","defaults":"name schemaName language","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.grant":{"id":"snowflake.grant","name":"snowflake.grant","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the grant was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grantOption":{"name":"grantOption","type":"\u0004","is_mandatory":true,"title":"Whether the grantee may further grant this privilege (WITH GRANT OPTION)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grantedBy":{"name":"grantedBy","type":"\u0007","is_mandatory":true,"title":"Role that issued the grant","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grantedOn":{"name":"grantedOn","type":"\u0007","is_mandatory":true,"title":"Object type the privilege is on (e.g., DATABASE, SCHEMA, TABLE, ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grantedTo":{"name":"grantedTo","type":"\u0007","is_mandatory":true,"title":"Type of grantee (ROLE, USER, SHARE, DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"granteeName":{"name":"granteeName","type":"\u0007","is_mandatory":true,"title":"Name of the grantee (role name, user name, share name, etc.)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the object the privilege is on","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"privilege":{"name":"privilege","type":"\u0007","is_mandatory":true,"title":"Privilege granted (e.g., USAGE, SELECT, OWNERSHIP, MODIFY)","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Grant","desc":"Single privilege granted on a Snowflake object to a role, user, or share, as returned by SHOW GRANTS. Grants are the core of Snowflake access control, so auditing them reveals who holds which privileges on which objects and whether a grantee can re-grant them. The `grantedTo` field discriminates the grantee kind (ROLE, USER, SHARE, or DATABASE_ROLE), `grantedOn` identifies the object type (such as DATABASE or TABLE), and `grantOption` flags whether the grantee holds WITH GRANT OPTION.","min_provider_version":"13.0.7","defaults":"privilege grantedOn name granteeName","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.managedAccount":{"id":"snowflake.managedAccount","name":"snowflake.managedAccount","fields":{"accountLocatorUrl":{"name":"accountLocatorUrl","type":"\u0007","is_mandatory":true,"title":"Locator-based URL for the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"cloud":{"name":"cloud","type":"\u0007","is_mandatory":true,"title":"Cloud provider hosting the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the account was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isReader":{"name":"isReader","type":"\u0004","is_mandatory":true,"title":"Whether the account is a reader account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"locator":{"name":"locator","type":"\u0007","is_mandatory":true,"title":"Account locator (unique identifier within the region)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the managed account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Region the account is provisioned in","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"URL used to connect to the account","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Managed Account","desc":"Reader account provisioned by a provider account to share data with a consumer who has no Snowflake account of their own. Auditing managed accounts surfaces every reader account created for data sharing, where it lives (`cloud`, `region`), how it is reached (`url`, `accountLocatorUrl`, `locator`), and whether it is a reader account (`isReader`). Accounts are selected by `name`.","min_provider_version":"13.3.7","defaults":"name cloud region","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.maskingPolicy":{"id":"snowflake.maskingPolicy","name":"snowflake.maskingPolicy","fields":{"body":{"name":"body","type":"\u0007","title":"SQL body that implements the masking","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the policy was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database that owns the policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"exemptOtherPolicies":{"name":"exemptOtherPolicies","type":"\u0004","is_mandatory":true,"title":"Whether this policy is exempt from other policies","desc":"When true, a column protected by this masking policy can still be referenced by the conditions of other row-access or conditional masking policies.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Policy kind classifier (e.g., MASKING_POLICY)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name (not database-qualified)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Owner role type (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"references":{"name":"references","type":"\u0019\u001bsnowflake.policyReference","title":"Entities (tables/views/columns) this policy is attached to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"returnType":{"name":"returnType","type":"\u0007","title":"Data type the masking expression returns","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema that owns the policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"signature":{"name":"signature","type":"\u0019\u0007","title":"Input column signature: list of `name:type` pairs","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Masking Policy","desc":"Snowflake masking policy that redacts or transforms column values at query time based on the executing role or context. Auditing these policies reveals where sensitive data is protected and how: `body` holds the SQL CASE expression that implements the masking, `signature` gives the input columns and types the policy operates on (each as a `name:type` pair like `val:STRING`), and `references` enumerates every table, view, or column the policy is currently attached to. Policies are schema-scoped and selected by `name`, `databaseName`, and `schemaName`.","min_provider_version":"13.2.7","defaults":"name databaseName schemaName","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.networkPolicy":{"id":"snowflake.networkPolicy","name":"snowflake.networkPolicy","fields":{"allowedIpList":{"name":"allowedIpList","type":"\u0019\u0007","title":"List of IP addresses that are allowed access","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"allowedNetworkRules":{"name":"allowedNetworkRules","type":"\u0019\u0007","title":"List of network rules that contain the network identifiers that are allowed access","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"blockedIpList":{"name":"blockedIpList","type":"\u0019\u0007","title":"List of IP addresses that are denied access","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"blockedNetworkRules":{"name":"blockedNetworkRules","type":"\u0019\u0007","title":"List of network rules that contain the network identifiers that are denied access","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the network policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the network policy was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"entriesInAllowedIpList":{"name":"entriesInAllowedIpList","type":"\u0005","is_mandatory":true,"title":"Number of entries in the allowed IP list","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"entriesInAllowedNetworkRules":{"name":"entriesInAllowedNetworkRules","type":"\u0005","is_mandatory":true,"title":"Number of entries in the allowed network rules","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"entriesInBlockedIpList":{"name":"entriesInBlockedIpList","type":"\u0005","is_mandatory":true,"title":"Number of entries in the blocked IP list","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"entriesInBlockedNetworkRules":{"name":"entriesInBlockedNetworkRules","type":"\u0005","is_mandatory":true,"title":"Number of entries in the blocked network rules","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the network policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Network Policy","desc":"Access control rule that restricts inbound access to the account, or to individual users, by source IP address and network rule. Audit network policies to confirm that access is limited to trusted ranges: allowed and blocked IP addresses are exposed through `allowedIpList` and `blockedIpList`, and the referenced network rules through `allowedNetworkRules` and `blockedNetworkRules`, while the corresponding `entriesIn*` counts give the size of each list at a glance. The `name` field selects the policy, for example `snowflake.networkPolicy(name: \"corp_ip_allowlist\")`.","min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.networkRule":{"id":"snowflake.networkRule","name":"snowflake.networkRule","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the rule was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"database":{"name":"database","type":"\u001bsnowflake.database","title":"Database that owns the rule","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Name of the database that owns the rule","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"entriesInValueList":{"name":"entriesInValueList","type":"\u0005","is_mandatory":true,"title":"Number of identifiers in the rule's value list","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Traffic direction the rule governs","desc":"One of INGRESS (inbound to Snowflake), EGRESS (outbound to external targets), or INTERNAL_STAGE (access to an internal stage).","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name (not database-qualified)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Owner role type (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schema":{"name":"schema","type":"\u001bsnowflake.schema","title":"Schema that owns the rule","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Name of the schema that owns the rule","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Kind of identifier the rule holds","desc":"One of HOST_PORT (hostnames or host:port pairs), AWSVPCEID (AWS VPC endpoint IDs), or AZURELINKID (Azure private-link IDs).","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"valueList":{"name":"valueList","type":"\u0019\u0007","title":"Network identifiers the rule matches (IP ranges, endpoint IDs, or host:port entries)","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Network Rule","desc":"Named set of network identifiers (IP ranges, cloud private-link endpoints, or host:port pairs) that network policies and external-access integrations reference to allow or block traffic. The `type` field reports which kind of identifier the rule holds (HOST_PORT, AWSVPCEID, or AZURELINKID), and `mode` reports the traffic direction it governs (INGRESS, EGRESS, or INTERNAL_STAGE). The `valueList` field returns the actual identifiers, and `entriesInValueList` gives their count. Rules are schema-scoped and selected by `name`, `databaseName`, and `schemaName`.","min_provider_version":"13.3.7","defaults":"name type mode","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.notificationIntegration":{"id":"snowflake.notificationIntegration","name":"snowflake.notificationIntegration","fields":{"awsSnsRoleArn":{"name":"awsSnsRoleArn","type":"\u0007","title":"AWS IAM role ARN Snowflake assumes to publish to SNS","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"awsSnsTopicArn":{"name":"awsSnsTopicArn","type":"\u0007","title":"Amazon SNS topic ARN messages are published to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"azureEventGridTopicEndpoint":{"name":"azureEventGridTopicEndpoint","type":"\u0007","title":"Azure Event Grid topic endpoint messages are published to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"azureStorageQueuePrimaryUri":{"name":"azureStorageQueuePrimaryUri","type":"\u0007","title":"Azure storage queue URI that carries the notifications","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"azureTenantId":{"name":"azureTenantId","type":"\u0007","title":"Azure tenant ID that owns the integration app","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Category of the integration (always \"NOTIFICATION\")","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the integration was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"direction":{"name":"direction","type":"\u0007","title":"Message flow direction (INBOUND or OUTBOUND)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the integration is enabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"gcpPubsubSubscriptionName":{"name":"gcpPubsubSubscriptionName","type":"\u0007","title":"Google Pub/Sub subscription name Snowflake reads from","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"gcpPubsubTopicName":{"name":"gcpPubsubTopicName","type":"\u0007","title":"Google Pub/Sub topic name Snowflake publishes to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the notification integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"notificationProvider":{"name":"notificationProvider","type":"\u0007","title":"Backing messaging service (AWS_SNS, AWS_SQS, GCP_PUBSUB, or AZURE_EVENT_GRID)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","title":"DESCRIBE NOTIFICATION INTEGRATION output","desc":"Every property Snowflake reports for the integration, keyed by its raw uppercase property name. Common keys are DIRECTION, NOTIFICATION_PROVIDER, AWS_SNS_TOPIC_ARN, AWS_SNS_ROLE_ARN, GCP_PUBSUB_SUBSCRIPTION_NAME, GCP_PUBSUB_TOPIC_NAME, AZURE_STORAGE_QUEUE_PRIMARY_URI, AZURE_EVENT_GRID_TOPIC_ENDPOINT, and AZURE_TENANT_ID. The set of keys depends on the backing provider.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Notification integration subtype (e.g., QUEUE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Notification Integration","desc":"Account-level object that connects Snowflake to an external messaging or queue service (Amazon SNS/SQS, Google Pub/Sub, or Azure Event Grid) for event notifications and auto-ingest pipelines. Auditing notification integrations surfaces the trust edge to external messaging: `enabled` gates whether it is live, `direction` reports inbound versus outbound flow, `notificationProvider` names the backing service, and the provider-specific fields expose the topics, subscriptions, and roles involved. The `properties` map returns the complete DESCRIBE NOTIFICATION INTEGRATION output for any field not surfaced individually.","min_provider_version":"13.3.7","defaults":"name notificationProvider enabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.parameter":{"id":"snowflake.parameter","name":"snowflake.parameter","fields":{"defaultValue":{"name":"defaultValue","type":"\u0007","is_mandatory":true,"title":"Default value of the parameter","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the parameter","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Name of the parameter","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"level":{"name":"level","type":"\u0007","is_mandatory":true,"title":"Scope at which the effective value was set","desc":"One of ACCOUNT, USER, SESSION, or OBJECT. An empty value means the parameter is unset at any scope and resolves to its system default (`defaultValue`).","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Value of the parameter","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Parameter","desc":"Configuration parameter governing account, session, or object behavior, such as session timeouts, network policy binding, and data-governance defaults. Auditing parameters surfaces settings that weaken security posture when left at unsafe values. The `key` field selects the parameter by name, for example `snowflake.account.parameters.where(key == \"STATEMENT_TIMEOUT_IN_SECONDS\")`. The `level` field reports the scope at which the effective value was set, letting you distinguish an explicit override from an inherited default.","min_provider_version":"11.0.0","defaults":"key","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.passwordPolicy":{"id":"snowflake.passwordPolicy","name":"snowflake.passwordPolicy","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the password policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the password policy was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Name of the database","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Policy kind classifier (e.g., PASSWORD)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the password policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Name of the owner","desc":"Deprecated in favor of ownerRole. The name of the role that owns the password policy.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"ownerRole":{"name":"ownerRole","type":"\u001bsnowflake.role","title":"Role that owns the password policy","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordHistory":{"name":"passwordHistory","type":"\u0005","title":"Number of recent passwords to retain","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordLockoutTimeMins":{"name":"passwordLockoutTimeMins","type":"\u0005","title":"How long (in minutes) to lock out the user account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordMaxAgeDays":{"name":"passwordMaxAgeDays","type":"\u0005","title":"Maximum number of days before password must be changed","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordMaxLength":{"name":"passwordMaxLength","type":"\u0005","title":"Maximum number of characters for password","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordMaxRetries":{"name":"passwordMaxRetries","type":"\u0005","title":"Maximum number of attempts to enter a password before locking out the user account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordMinAgeDays":{"name":"passwordMinAgeDays","type":"\u0005","title":"Minimum number of days before password can be changed","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordMinLength":{"name":"passwordMinLength","type":"\u0005","title":"Minimum number of characters for password","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordMinLowerCaseChars":{"name":"passwordMinLowerCaseChars","type":"\u0005","title":"Minimum number of lowercase characters for password","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordMinNumericChars":{"name":"passwordMinNumericChars","type":"\u0005","title":"Minimum number of numeric characters for password","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordMinSpecialChars":{"name":"passwordMinSpecialChars","type":"\u0005","title":"Minimum number of special characters for password","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"passwordMinUpperCaseChars":{"name":"passwordMinUpperCaseChars","type":"\u0005","title":"Minimum number of uppercase characters for password","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Name of the schema","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Password Policy","desc":"Password policy governing complexity and rotation rules for user passwords in the account, letting you audit whether length, character-class, age, reuse, and lockout requirements meet your baseline. Complexity controls surface as integers such as `passwordMinLength`, `passwordMinSpecialChars`, `passwordMaxAgeDays`, `passwordMaxRetries`, and `passwordHistory`. Password policies are scoped to a schema, so `databaseName` and `schemaName` identify where the policy lives.","min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.policyReference":{"id":"snowflake.policyReference","name":"snowflake.policyReference","fields":{"policyDatabase":{"name":"policyDatabase","type":"\u0007","is_mandatory":true,"title":"Database that owns the policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"policyKind":{"name":"policyKind","type":"\u0007","is_mandatory":true,"title":"Policy kind (MASKING_POLICY, ROW_ACCESS_POLICY, AUTHENTICATION_POLICY, etc.)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"policyName":{"name":"policyName","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"policySchema":{"name":"policySchema","type":"\u0007","is_mandatory":true,"title":"Schema that owns the policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"policyStatus":{"name":"policyStatus","type":"\u0007","is_mandatory":true,"title":"Status of the attachment (e.g., ACTIVE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"refArgColumnNames":{"name":"refArgColumnNames","type":"\u0007","is_mandatory":true,"title":"Arg column names for table-function references","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"refColumnName":{"name":"refColumnName","type":"\u0007","is_mandatory":true,"title":"Column the policy applies to (for column-level masking)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"refDatabaseName":{"name":"refDatabaseName","type":"\u0007","is_mandatory":true,"title":"Database of the entity the policy is attached to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"refEntityDomain":{"name":"refEntityDomain","type":"\u0007","is_mandatory":true,"title":"Domain of the entity the policy is attached to (one of ACCOUNT, INTEGRATION, TABLE, TAG, USER, VIEW)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"refEntityName":{"name":"refEntityName","type":"\u0007","is_mandatory":true,"title":"Name of the entity the policy is attached to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"refSchemaName":{"name":"refSchemaName","type":"\u0007","is_mandatory":true,"title":"Schema of the entity the policy is attached to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"tagDatabase":{"name":"tagDatabase","type":"\u0007","is_mandatory":true,"title":"Database of the tag, when the policy is attached via a tag","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"tagName":{"name":"tagName","type":"\u0007","is_mandatory":true,"title":"Name of the tag, when the policy is attached via a tag","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"tagSchema":{"name":"tagSchema","type":"\u0007","is_mandatory":true,"title":"Schema of the tag, when the policy is attached via a tag","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Policy Reference","desc":"Single attachment of a governance policy (masking, row-access, password, projection, aggregation, or authentication) to a Snowflake entity, as reported by INFORMATION_SCHEMA.POLICY_REFERENCES. Each reference pairs the policy identity (policyDatabase, policySchema, policyName, policyKind) with the protected entity (refDatabaseName, refSchemaName, refEntityName, and refEntityDomain, one of ACCOUNT, INTEGRATION, TABLE, TAG, USER, or VIEW). refColumnName names the column for column-level masking, and tagName is populated when the policy is attached indirectly through a tag. Audit these to see where a policy is enforced across an account and whether each attachment is currently active (policyStatus).","private":true,"min_provider_version":"13.2.7","defaults":"policyName refEntityDomain refEntityName refColumnName","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.procedure":{"id":"snowflake.procedure","name":"snowflake.procedure","fields":{"arguments":{"name":"arguments","type":"\u0007","is_mandatory":true,"title":"Comma-separated argument signature with type information","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"catalogName":{"name":"catalogName","type":"\u0007","is_mandatory":true,"title":"Catalog name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the procedure's purpose and behavior","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isAggregate":{"name":"isAggregate","type":"\u0004","is_mandatory":true,"title":"Whether the procedure is an aggregate function","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isAnsi":{"name":"isAnsi","type":"\u0004","is_mandatory":true,"title":"Whether the procedure is an ANSI procedure","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isBuiltin":{"name":"isBuiltin","type":"\u0004","is_mandatory":true,"title":"Whether the procedure is built in","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isSecure":{"name":"isSecure","type":"\u0004","is_mandatory":true,"title":"Whether the procedure is secure","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isTableFunction":{"name":"isTableFunction","type":"\u0004","is_mandatory":true,"title":"Whether the procedure is a table function","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"maxNumberOfArguments":{"name":"maxNumberOfArguments","type":"\u0005","is_mandatory":true,"title":"Maximum number of arguments","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"minNumberOfArguments":{"name":"minNumberOfArguments","type":"\u0005","is_mandatory":true,"title":"Minimum number of arguments","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the procedure","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"validForClustering":{"name":"validForClustering","type":"\u0004","is_mandatory":true,"title":"Whether the procedure is for clustering","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Procedure","desc":"Stored procedure or built-in system procedure available in a Snowflake account. Procedures run custom logic with the caller's or owner's rights, so their definition and security posture matter for audits. The `isSecure` flag marks a procedure whose definition is hidden from users without ownership, and `isBuiltin` distinguishes account-defined procedures from Snowflake's system procedures.","min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.resourceMonitor":{"id":"snowflake.resourceMonitor","name":"snowflake.resourceMonitor","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the resource monitor was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"creditQuota":{"name":"creditQuota","type":"\u0006","is_mandatory":true,"title":"Total credit quota","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"endTime":{"name":"endTime","type":"\u0007","is_mandatory":true,"title":"When the current period ends (Snowflake-formatted string)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"frequency":{"name":"frequency","type":"\u0007","is_mandatory":true,"title":"Refresh frequency for the credit quota (DAILY, WEEKLY, MONTHLY, YEARLY, NEVER)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"level":{"name":"level","type":"\u0007","is_mandatory":true,"title":"Scope at which the monitor applies (ACCOUNT or WAREHOUSE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource monitor name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"notifyAt":{"name":"notifyAt","type":"\u0019\u0005","is_mandatory":true,"title":"Usage percentages at which Snowflake sends notifications","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"notifyUsers":{"name":"notifyUsers","type":"\u0019\u0007","is_mandatory":true,"title":"Users notified when notification thresholds are crossed","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning role","desc":"Deprecated in favor of ownerRole. The name of the role that owns the resource monitor.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"ownerRole":{"name":"ownerRole","type":"\u001bsnowflake.role","title":"Role that owns the resource monitor","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"remainingCredits":{"name":"remainingCredits","type":"\u0006","is_mandatory":true,"title":"Credits remaining in the current period","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"startTime":{"name":"startTime","type":"\u0007","is_mandatory":true,"title":"When the current period started (Snowflake-formatted string)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"suspendAt":{"name":"suspendAt","type":"\u0005","title":"Percentage at which the monitor suspends warehouses (allows running queries to finish); null if unset","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"suspendImmediateAt":{"name":"suspendImmediateAt","type":"\u0005","title":"Percentage at which the monitor immediately suspends warehouses; null if unset","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"usedCredits":{"name":"usedCredits","type":"\u0006","is_mandatory":true,"title":"Credits consumed in the current period","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Resource Monitor","desc":"Resource monitor that caps credit consumption for one or more warehouses, the primary control for preventing runaway compute spend. A monitor tracks credit usage against a quota and can trigger notifications or suspend warehouses once configured thresholds are crossed. The `level` field indicates whether the monitor applies at the ACCOUNT or WAREHOUSE scope. `notifyAt` lists the usage percentages that trigger notifications, while `suspendAt` and `suspendImmediateAt` give the percentages at which warehouses are suspended (null when not configured).","min_provider_version":"13.2.7","defaults":"name creditQuota usedCredits level","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.role":{"id":"snowflake.role","name":"snowflake.role","fields":{"assignedToUsers":{"name":"assignedToUsers","type":"\u0005","is_mandatory":true,"title":"Number of users assigned to the role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grantedRoles":{"name":"grantedRoles","type":"\u0005","is_mandatory":true,"title":"Number of roles granted to this role (this role's privileges)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grantedToRoles":{"name":"grantedToRoles","type":"\u0005","is_mandatory":true,"title":"Number of other roles to which this role is granted (this role's grantees)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grantees":{"name":"grantees","type":"\u0019\u001bsnowflake.grant","title":"Names of grantees (users and roles) this role is granted to (SHOW GRANTS OF ROLE)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grants":{"name":"grants","type":"\u0019\u001bsnowflake.grant","title":"Privileges granted to this role (SHOW GRANTS TO ROLE)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isCurrent":{"name":"isCurrent","type":"\u0004","is_mandatory":true,"title":"Whether the role is a current role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether the role is the default role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isInherited":{"name":"isInherited","type":"\u0004","is_mandatory":true,"title":"Whether the role is a shared role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owner of the role","desc":"Deprecated in favor of ownerRole. The name of the role that owns this role.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"ownerRole":{"name":"ownerRole","type":"\u001bsnowflake.role","title":"Role that owns the role","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Role","desc":"Role in the account's access-control model, the unit that privileges are granted to and that users and other roles inherit. Auditing roles reveals who holds which privileges and how they chain through the role hierarchy, which is central to least-privilege review. The `owner` holds administrative control over the role, `grants` lists the privileges granted to the role (SHOW GRANTS TO ROLE), and `grantees` lists the users and roles the role has in turn been granted to (SHOW GRANTS OF ROLE). The `assignedToUsers`, `grantedToRoles`, and `grantedRoles` counts summarize the role's reach and its position in the hierarchy.","min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.rowAccessPolicy":{"id":"snowflake.rowAccessPolicy","name":"snowflake.rowAccessPolicy","fields":{"body":{"name":"body","type":"\u0007","title":"SQL body that implements the row-access predicate","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the policy was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"database":{"name":"database","type":"\u001bsnowflake.database","title":"Database that owns the policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Name of the database that owns the policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Policy kind classifier (e.g., ROW_ACCESS_POLICY)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name (not database-qualified)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"options":{"name":"options","type":"\u0007","is_mandatory":true,"title":"Additional policy options reported by SHOW","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Owner role type (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"references":{"name":"references","type":"\u0019\u001bsnowflake.policyReference","title":"Entities (tables/views) this policy is attached to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"returnType":{"name":"returnType","type":"\u0007","title":"Data type the policy expression returns (typically BOOLEAN)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schema":{"name":"schema","type":"\u001bsnowflake.schema","title":"Schema that owns the policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Name of the schema that owns the policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"signature":{"name":"signature","type":"\u0019\u0007","title":"Input column signature: list of `name:type` pairs the policy evaluates","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Row-Access Policy","desc":"Row-level access-control policy that filters which rows a query returns based on the executing role or context. Auditing row-access policies surfaces the columns each policy inspects (`signature` as `name:type` pairs), the SQL predicate it enforces (`body`), and every table or view it is attached to (`references`), so you can verify sensitive datasets are gated as intended. Policies are schema-scoped and selected by `name`, `databaseName`, and `schemaName`.","min_provider_version":"13.3.7","defaults":"name databaseName schemaName","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.schema":{"id":"snowflake.schema","name":"snowflake.schema","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the schema was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"database":{"name":"database","type":"\u001bsnowflake.database","title":"Database that owns the schema","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Name of the database that owns the schema","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"droppedAt":{"name":"droppedAt","type":"\t","is_mandatory":true,"title":"When the schema was dropped (empty when active)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isCurrent":{"name":"isCurrent","type":"\u0004","is_mandatory":true,"title":"Whether this is the current session schema","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether this is the default schema","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Schema name (not database-qualified)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"options":{"name":"options","type":"\u0007","is_mandatory":true,"title":"Additional schema options reported by SHOW (e.g., MANAGED ACCESS, TRANSIENT)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Owner role type (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"retentionTime":{"name":"retentionTime","type":"\u0007","is_mandatory":true,"title":"Time Travel data-retention window in days","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Schema","desc":"Logical container within a database that groups tables, views, and other objects and carries its own retention and ownership settings. Schemas are enumerated across every database in the account, each reporting its parent `databaseName`, and are selected by `name`. `retentionTime` gives the Time Travel data-retention window in days, `isDefault` and `isCurrent` mark the session's active schema, and `ownerRoleType` distinguishes a standard role owner from a database role.","min_provider_version":"13.3.7","defaults":"name databaseName owner","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.secret":{"id":"snowflake.secret","name":"snowflake.secret","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the secret was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database that owns the secret","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"integrationName":{"name":"integrationName","type":"\u0007","title":"Name of the security or API integration the secret is bound to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Secret name (not database-qualified)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"oauthAccessTokenExpiryTime":{"name":"oauthAccessTokenExpiryTime","type":"\t","title":"When the OAuth access token expires","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"oauthRefreshTokenExpiryTime":{"name":"oauthRefreshTokenExpiryTime","type":"\t","title":"When the OAuth refresh token expires","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"oauthScopes":{"name":"oauthScopes","type":"\u0019\u0007","is_mandatory":true,"title":"OAuth scopes granted to the secret","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Owner role type (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema that owns the secret","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"secretType":{"name":"secretType","type":"\u0007","is_mandatory":true,"title":"Secret type (PASSWORD, OAUTH2, GENERIC_STRING)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"username":{"name":"username","type":"\u0007","title":"Username stored in the secret (PASSWORD secrets only)","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Secret","desc":"Snowflake-managed secret that stores the credentials Snowflake objects use to authenticate to external systems, referenced by external functions, notification integrations, and similar objects. Auditing secrets surfaces what kind of credential is held (`secretType` is PASSWORD, OAUTH2, or GENERIC_STRING), which security or API integration a secret is bound to, and the expiry deadlines on OAuth access and refresh tokens, so stale or over-scoped credentials can be flagged. The `oauthScopes` field records the OAuth scopes granted to the secret, and ownership is captured by `owner` and `ownerRoleType`.","min_provider_version":"13.2.7","defaults":"name secretType databaseName schemaName","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.securityIntegration":{"id":"snowflake.securityIntegration","name":"snowflake.securityIntegration","fields":{"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Category of the security integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the security integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the security integration was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the security integration is enabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the security integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","title":"All properties returned by DESCRIBE SECURITY INTEGRATION (includes SAML2_X509_CERT, SAML2_ISSUER, OAUTH_*, etc.)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"saml2ForceAuthn":{"name":"saml2ForceAuthn","type":"\u0004","title":"SAML2_FORCE_AUTHN property (only set for SAML2 integrations)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"saml2Issuer":{"name":"saml2Issuer","type":"\u0007","title":"SAML2_ISSUER property (only set for SAML2 integrations)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"saml2Provider":{"name":"saml2Provider","type":"\u0007","title":"SAML2_PROVIDER property (only set for SAML2 integrations)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"saml2SignRequest":{"name":"saml2SignRequest","type":"\u0004","title":"SAML2_SIGN_REQUEST property (only set for SAML2 integrations)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"saml2SsoUrl":{"name":"saml2SsoUrl","type":"\u0007","title":"SAML2_SSO_URL property (only set for SAML2 integrations)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"saml2X509Cert":{"name":"saml2X509Cert","type":"\u0007","title":"SAML2_X509_CERT property (only set for SAML2 integrations)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type of the security integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Security Integration","desc":"Security integration that configures how the account interoperates with external identity providers and authorization services, such as SAML2 single sign-on, OAuth clients, SCIM user provisioning, and external OAuth token validation. Auditing these integrations reveals which federation and delegated-authentication paths are trusted for account access, whether each is enabled, and how single sign-on is configured. The `type` field distinguishes the integration kind (for example SAML2 or OAUTH), and `properties` returns the full DESCRIBE SECURITY INTEGRATION result as a key/value map keyed by property name (SAML2_X509_CERT, SAML2_ISSUER, OAUTH_CLIENT_ID, and so on). The `saml2*` fields pull the corresponding single-sign-on settings out of that map for integrations of type SAML2.","min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.sessionPolicy":{"id":"snowflake.sessionPolicy","name":"snowflake.sessionPolicy","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the session policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind of policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the session policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"options":{"name":"options","type":"\u0007","is_mandatory":true,"title":"Comma-separated list of options","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owner of the session policy","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Type of the role that owns the resource (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"sessionIdleTimeoutMins":{"name":"sessionIdleTimeoutMins","type":"\u0005","title":"Time in minutes a session can remain idle before being terminated (Snowflake default 240)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"sessionUiIdleTimeoutMins":{"name":"sessionUiIdleTimeoutMins","type":"\u0005","title":"Time in minutes a UI (Snowsight) session can remain idle before being terminated (Snowflake default 240)","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake session policy","desc":"Session policy that controls how long a session may remain idle before Snowflake terminates it, a lever for limiting the window in which an unattended or hijacked session stays usable. The `sessionIdleTimeoutMins` value (Snowflake default 240) applies to all session types, while `sessionUiIdleTimeoutMins` applies specifically to Snowsight browser sessions, so the two can enforce a tighter bound on interactive UI logins.","min_provider_version":"13.0.7","defaults":"name sessionIdleTimeoutMins","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.share":{"id":"snowflake.share","name":"snowflake.share","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the share","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the share was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"database":{"name":"database","type":"\u001bsnowflake.database","title":"Database backing the share","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database backing the share","desc":"Deprecated in favor of database, the typed snowflake.database reference.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind of share: INBOUND or OUTBOUND","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Fully qualified share name (account.share for INBOUND, share name for OUTBOUND)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owner of the share","desc":"Deprecated in favor of ownerRole. The name of the role that owns the share.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"ownerRole":{"name":"ownerRole","type":"\u001bsnowflake.role","title":"Role that owns the share","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"to":{"name":"to","type":"\u0019\u0007","is_mandatory":true,"title":"For OUTBOUND shares, list of accounts the share has been granted to","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Share","desc":"Snowflake data share, the mechanism for exposing a database to other accounts. Auditing shares matters because they cross account boundaries: an OUTBOUND share grants external accounts read access to your data, so its `to` list is the set of accounts that can consume `databaseName`. The `kind` field distinguishes an OUTBOUND share (created by this account) from an INBOUND share (consumed from another account); for INBOUND shares `name` is fully qualified as account.share, and for OUTBOUND shares it is the bare share name.","min_provider_version":"13.0.7","defaults":"name kind","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.stage":{"id":"snowflake.stage","name":"snowflake.stage","fields":{"cloud":{"name":"cloud","type":"\u0007","is_mandatory":true,"title":"Cloud provider of the stage","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the stage","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the stage was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"directoryEnabled":{"name":"directoryEnabled","type":"\u0004","is_mandatory":true,"title":"Whether a directory table is enabled for the stage","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"endpoint":{"name":"endpoint","type":"\u0007","is_mandatory":true,"title":"Endpoint of the stage","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"hasCredentials":{"name":"hasCredentials","type":"\u0004","is_mandatory":true,"title":"Whether the stage has credentials","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"hasEncryptionKey":{"name":"hasEncryptionKey","type":"\u0004","is_mandatory":true,"title":"Whether the stage has encryption key","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the stage","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owner of the stage","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Type of the role that owns the resource (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"storageIntegration":{"name":"storageIntegration","type":"\u001bsnowflake.storageIntegration","title":"Storage integration backing an external stage","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"storeIntegration":{"name":"storeIntegration","type":"\u0007","is_mandatory":true,"title":"Storage integration of the stage","desc":"Deprecated in favor of storageIntegration. The name of the storage integration backing an external stage.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Stage type","desc":"Either INTERNAL for Snowflake-managed storage or EXTERNAL for a stage backed by an external cloud bucket.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"URL of the stage","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Stage","desc":"Named location where Snowflake loads and unloads bulk data, either an internal stage backed by Snowflake-managed storage or an external stage pointing at a cloud bucket. The `type` field distinguishes INTERNAL from EXTERNAL, and for external stages `cloud`, `url`, `endpoint`, and `storeIntegration` describe the backing object store. Audit `hasCredentials` and `hasEncryptionKey` to find stages that embed inline credentials or a customer-supplied encryption key rather than relying on a storage integration, and `directoryEnabled` to see whether a directory table exposes file metadata over the staged contents.","min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.storageIntegration":{"id":"snowflake.storageIntegration","name":"snowflake.storageIntegration","fields":{"azureConsentUrl":{"name":"azureConsentUrl","type":"\u0007","title":"Azure consent URL an admin visits to grant Snowflake access","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"azureMultiTenantAppName":{"name":"azureMultiTenantAppName","type":"\u0007","title":"Name of the Azure multi-tenant app registered for Snowflake","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"azureTenantId":{"name":"azureTenantId","type":"\u0007","title":"Azure tenant ID that owns the consent application","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Category of the integration (always \"STORAGE\")","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the integration was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the integration is enabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the storage integration","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","title":"DESCRIBE STORAGE INTEGRATION output","desc":"Every property Snowflake reports for the integration, keyed by its raw uppercase property name. Common keys are STORAGE_PROVIDER, STORAGE_ALLOWED_LOCATIONS, STORAGE_BLOCKED_LOCATIONS, STORAGE_AWS_ROLE_ARN, STORAGE_AWS_IAM_USER_ARN, STORAGE_AWS_EXTERNAL_ID, STORAGE_GCP_SERVICE_ACCOUNT, AZURE_TENANT_ID, AZURE_CONSENT_URL, and AZURE_MULTI_TENANT_APP_NAME. The set of keys depends on the cloud provider.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"storageAllowedLocations":{"name":"storageAllowedLocations","type":"\u0019\u0007","title":"Cloud storage locations that stages using this integration may access","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"storageAwsExternalId":{"name":"storageAwsExternalId","type":"\u0007","title":"External ID Snowflake presents when assuming the AWS role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"storageAwsIamUserArn":{"name":"storageAwsIamUserArn","type":"\u0007","title":"AWS IAM user ARN that Snowflake uses to assume the role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"storageAwsRoleArn":{"name":"storageAwsRoleArn","type":"\u0007","title":"AWS IAM role ARN that Snowflake assumes for S3 access","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"storageBlockedLocations":{"name":"storageBlockedLocations","type":"\u0019\u0007","title":"Cloud storage locations that stages using this integration are blocked from","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"storageGcpServiceAccount":{"name":"storageGcpServiceAccount","type":"\u0007","title":"Google Cloud service account Snowflake uses for GCS access","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"storageProvider":{"name":"storageProvider","type":"\u0007","title":"Cloud provider backing the integration (S3, GCS, or AZURE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Storage integration subtype (e.g., EXTERNAL_STAGE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Storage Integration","desc":"Account-level object that grants Snowflake access to external cloud storage (Amazon S3, Google Cloud Storage, or Azure Blob) without exposing static credentials, referenced by external stages. Auditing storage integrations matters because they define a trust boundary to external buckets: `enabled` gates whether it is live, `storageAllowedLocations` and `storageBlockedLocations` constrain which URLs stages may reach, and the provider-specific fields (`storageAwsRoleArn`, `storageAwsIamUserArn`, `storageGcpServiceAccount`, `azureTenantId`, `azureConsentUrl`) expose the assumed identity on each cloud. The `properties` map returns the complete DESCRIBE STORAGE INTEGRATION output for any field not surfaced individually.","min_provider_version":"13.3.7","defaults":"name storageProvider enabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.tag":{"id":"snowflake.tag","name":"snowflake.tag","fields":{"allowedValues":{"name":"allowedValues","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed string values for the tag (empty if unrestricted)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Optional comment","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the tag was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database that owns the tag","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tag name (object name, not database-qualified)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning role","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Owner role type (ROLE | DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema that owns the tag","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Tag","desc":"Schema-level label used for governance, data classification, and policy attachment across Snowflake objects. A tag is identified by `name` within its `databaseName` and `schemaName`. When `allowedValues` is non-empty, the tag is constrained to that set of permitted string values, letting you audit whether sensitive-data tagging follows an approved vocabulary; an empty list means the tag accepts any value. `ownerRoleType` distinguishes a standard role owner from a database role.","min_provider_version":"13.1.1","defaults":"name databaseName schemaName","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.task":{"id":"snowflake.task","name":"snowflake.task","fields":{"allowOverlappingExecution":{"name":"allowOverlappingExecution","type":"\u0004","is_mandatory":true,"title":"Whether overlapping runs of the task are allowed","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment on the task","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"condition":{"name":"condition","type":"\u0007","is_mandatory":true,"title":"Boolean SQL expression that gates whether a run proceeds","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database the task belongs to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"definition":{"name":"definition","type":"\u0007","is_mandatory":true,"title":"SQL statement the task runs","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Task name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u001bsnowflake.role","title":"Role that owns the task","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Type of the owning role (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"predecessors":{"name":"predecessors","type":"\u0019\u001bsnowflake.task","title":"Predecessor tasks that trigger this task","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schedule":{"name":"schedule","type":"\u0007","is_mandatory":true,"title":"Schedule that triggers the task, empty for a task triggered by a predecessor","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema the task belongs to","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Run state (started or suspended)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"warehouse":{"name":"warehouse","type":"\u001bsnowflake.warehouse","title":"Warehouse the task runs on, null for a serverless task","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake task","desc":"A scheduled or triggered unit of SQL in a schema, keyed by name. Tasks run with the owner's rights on a warehouse and a schedule, which makes them a common automation surface and a persistence or privilege-escalation vector. Covers the warehouse the task runs on, the schedule and predecessor relationships that form a task graph, the run state, the SQL definition and its gating condition, and whether overlapping runs are allowed. Select a task by name, for example `snowflake.tasks.where(name == \"REFRESH_SALES\")`.","min_provider_version":"13.3.7","defaults":"name schemaName state","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.user":{"id":"snowflake.user","name":"snowflake.user","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the user","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the user was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"daysSinceLastLogin":{"name":"daysSinceLastLogin","type":"\u0005","title":"Number of days since the user last successfully logged in (-1 if never logged in)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"defaultNamespace":{"name":"defaultNamespace","type":"\u0007","is_mandatory":true,"title":"Namespace that is active by default","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"defaultRole":{"name":"defaultRole","type":"\u0007","is_mandatory":true,"title":"Default role for the user","desc":"Deprecated in favor of defaultRoleRef. The name of the user's default role.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"defaultRoleRef":{"name":"defaultRoleRef","type":"\u001bsnowflake.role","title":"User's default role","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"defaultSecondaryRoles":{"name":"defaultSecondaryRoles","type":"\u0019\u0007","is_mandatory":true,"title":"Secondary roles activated by default in a session","desc":"Contains ALL when the user automatically activates every role granted to them, which broadens the privileges available in a session beyond the primary role. Empty when no secondary roles activate by default.","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"defaultWarehouse":{"name":"defaultWarehouse","type":"\u0007","is_mandatory":true,"title":"Virtual warehouse that is active by default","desc":"Deprecated in favor of defaultWarehouseRef. The name of the user's default virtual warehouse.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"defaultWarehouseRef":{"name":"defaultWarehouseRef","type":"\u001bsnowflake.warehouse","title":"Virtual warehouse that is active by default for the user","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"disabled":{"name":"disabled","type":"\u0004","is_mandatory":true,"title":"Whether the user is disabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"When the user expires","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"extAuthnDuo":{"name":"extAuthnDuo","type":"\u0004","is_mandatory":true,"title":"Whether the user is enrolled in Duo MFA via Snowflake's external authenticator","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"extAuthnUid":{"name":"extAuthnUid","type":"\u0007","is_mandatory":true,"title":"Duo external-authentication user ID linking the Snowflake user to their Duo account","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"firstName":{"name":"firstName","type":"\u0007","is_mandatory":true,"title":"First name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"grants":{"name":"grants","type":"\u0019\u001bsnowflake.grant","title":"Roles granted directly to this user (SHOW GRANTS TO USER)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"hasMfa":{"name":"hasMfa","type":"\u0004","is_mandatory":true,"title":"Whether the user has multi-factor authentication enrolled","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"hasPassword":{"name":"hasPassword","type":"\u0004","is_mandatory":true,"title":"Whether the user has a password","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"hasRsaPublicKey":{"name":"hasRsaPublicKey","type":"\u0004","is_mandatory":true,"title":"Whether the user has an RSA public key registered for key-pair authentication","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"lastName":{"name":"lastName","type":"\u0007","is_mandatory":true,"title":"Last name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"lastSuccessLogin":{"name":"lastSuccessLogin","type":"\t","is_mandatory":true,"title":"Last time the user logged in","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"lockedUntil":{"name":"lockedUntil","type":"\t","is_mandatory":true,"title":"Time until the user is locked","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"login":{"name":"login","type":"\u0007","is_mandatory":true,"title":"Login name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"minsToBypassMfa":{"name":"minsToBypassMfa","type":"\u0007","is_mandatory":true,"title":"Minutes remaining in a temporary MFA bypass window","desc":"Non-empty while an administrator has temporarily allowed the user to sign in without MFA. Empty when no bypass window is active.","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"mustChangePassword":{"name":"mustChangePassword","type":"\u0004","is_mandatory":true,"title":"Whether the user is forced to change their password","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"User name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u001bsnowflake.role","title":"Role that owns the user","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"parameters":{"name":"parameters","type":"\u0019\u001bsnowflake.parameter","title":"Parameters for the user","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflakeLock":{"name":"snowflakeLock","type":"\u0004","is_mandatory":true,"title":"Whether Snowflake has temporarily locked the user after repeated failed sign-in attempts","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"User type","desc":"One of PERSON, SERVICE, or LEGACY_SERVICE. SERVICE and LEGACY_SERVICE users cannot sign in with a password or MFA and authenticate with a key pair or OAuth, so this field separates human users from machine identities during access review.","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake User","desc":"Snowflake user account, covering login identity, authentication state (password, RSA key-pair, and Duo external authentication), access controls (disabled status, forced password change, default role and default warehouse), and lifecycle timestamps. Auditing users surfaces dormant or stale accounts, missing credential hygiene, and over-broad default roles. `daysSinceLastLogin` is derived from the last successful login and returns -1 when the user has never logged in. `grants` lists the roles granted directly to this user, and `parameters` lists user-level parameter overrides.","min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.view":{"id":"snowflake.view","name":"snowflake.view","fields":{"changeTracking":{"name":"changeTracking","type":"\u0007","is_mandatory":true,"title":"Change tracking state (ON or OFF)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the view","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Database name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isMaterialized":{"name":"isMaterialized","type":"\u0004","is_mandatory":true,"title":"Whether the view is materialized","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isSecure":{"name":"isSecure","type":"\u0004","is_mandatory":true,"title":"Whether the view is secure","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind of view","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the view","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owner of the view","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Type of the role that owns the resource (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"reserved":{"name":"reserved","type":"\u0007","is_mandatory":true,"title":"Reserved flag set by Snowflake (typically empty; reserved for future use)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"text":{"name":"text","type":"\u0007","is_mandatory":true,"title":"Text of the view","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake View","desc":"View or materialized view defined in a Snowflake schema, exposing a stored query over one or more underlying tables. The `text` field holds the view definition SQL, which reveals exactly what data the view surfaces, and `isSecure` reports whether it is a secure view that hides its definition and restricts what unauthorized roles can read. Materialized views (`isMaterialized`) persist query results for faster reads. Query views to review data exposure, ownership, and the SQL behind derived datasets.","min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"snowflake.warehouse":{"id":"snowflake.warehouse","name":"snowflake.warehouse","fields":{"autoResume":{"name":"autoResume","type":"\u0004","is_mandatory":true,"title":"Whether the warehouse, if suspended, automatically resumes","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"autoSuspend":{"name":"autoSuspend","type":"\u0005","is_mandatory":true,"title":"Period of inactivity, in seconds, after which a running warehouse automatically suspends and stops using credits","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"available":{"name":"available","type":"\u0006","is_mandatory":true,"title":"Percentage of the warehouse compute resources available","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment for the warehouse","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the warehouse was created","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"enableQueryAcceleration":{"name":"enableQueryAcceleration","type":"\u0004","is_mandatory":true,"title":"Whether query acceleration is enabled","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isCurrent":{"name":"isCurrent","type":"\u0004","is_mandatory":true,"title":"Whether the warehouse is a current warehouse","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether the warehouse is a default warehouse","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"maxClusterCount":{"name":"maxClusterCount","type":"\u0005","is_mandatory":true,"title":"Maximum cluster count","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"minClusterCount":{"name":"minClusterCount","type":"\u0005","is_mandatory":true,"title":"Minimum cluster count","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the warehouse","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"other":{"name":"other","type":"\u0006","is_mandatory":true,"title":"Percentage of the warehouse compute not in available, provisioning, or quiescing state","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Warehouse owner","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"ownerRoleType":{"name":"ownerRoleType","type":"\u0007","is_mandatory":true,"title":"Type of the role that owns the resource (ROLE or DATABASE_ROLE)","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"provisioning":{"name":"provisioning","type":"\u0006","is_mandatory":true,"title":"Percentage of the warehouse compute resources in provisioning","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"queryAccelerationMaxScaleFactor":{"name":"queryAccelerationMaxScaleFactor","type":"\u0005","is_mandatory":true,"title":"Query acceleration scale factor","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"queued":{"name":"queued","type":"\u0005","is_mandatory":true,"title":"Number of queued clusters","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"quiescing":{"name":"quiescing","type":"\u0006","is_mandatory":true,"title":"Percentage of the warehouse compute resources that execute queries","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"resourceMonitor":{"name":"resourceMonitor","type":"\u0007","is_mandatory":true,"title":"Resource monitor of the warehouse","desc":"Deprecated in favor of resourceMonitorRef. The name of the resource monitor governing this warehouse's credit usage.","provider":"go.mondoo.com/mql/v13/providers/snowflake","maturity":"deprecated"},"resourceMonitorRef":{"name":"resourceMonitorRef","type":"\u001bsnowflake.resourceMonitor","title":"Resource monitor governing the warehouse's credit usage","min_provider_version":"13.3.7","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"resumedAt":{"name":"resumedAt","type":"\t","is_mandatory":true,"title":"When the warehouse resumed","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"running":{"name":"running","type":"\u0005","is_mandatory":true,"title":"Number of running clusters","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"scalingPolicy":{"name":"scalingPolicy","type":"\u0007","is_mandatory":true,"title":"Scaling policy","desc":"Governs how a multi-cluster warehouse starts additional clusters under load, either STANDARD or ECONOMY.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"size":{"name":"size","type":"\u0007","is_mandatory":true,"title":"Warehouse size","desc":"Compute size, one of XSMALL, SMALL, MEDIUM, LARGE, XLARGE, XXLARGE, XXXLARGE, X4LARGE, X5LARGE, or X6LARGE.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"startedClusterCount":{"name":"startedClusterCount","type":"\u0005","is_mandatory":true,"title":"Number of started clusters","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Operational state","desc":"One of STARTED, SUSPENDED, SUSPENDING, RESUMING, or RESIZING.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Warehouse type","desc":"Either STANDARD or SNOWPARK-OPTIMIZED.","provider":"go.mondoo.com/mql/v13/providers/snowflake"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the warehouse was updated","provider":"go.mondoo.com/mql/v13/providers/snowflake"}},"title":"Snowflake Warehouse","desc":"Snowflake virtual warehouse that provides the compute resources for query execution and data loading. Warehouse size, multi-cluster counts, and auto-suspend behavior drive both credit consumption and performance, so these records support audits of idle-timeout hygiene, cluster scaling limits, and credit governance through the associated resource monitor. Live utilization is reported in available, provisioning, quiescing, and other, while running and queued reflect the current query load.","min_provider_version":"11.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/snowflake"}}}