-
Notifications
You must be signed in to change notification settings - Fork 23
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* ⭐️ snowflake provider * disable debug messages from snowflake provider Signed-off-by: Ivan Milchev <ivan@mondoo.com> --------- Signed-off-by: Ivan Milchev <ivan@mondoo.com> Co-authored-by: Ivan Milchev <ivan@mondoo.com>
- Loading branch information
1 parent
0258b85
commit c402834
Showing
30 changed files
with
6,310 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,122 @@ | ||
| # Snowflake Provider | ||
|
|
||
| ```shell | ||
| cnquery shell snowflake | ||
| ``` | ||
|
|
||
| Required arguments: | ||
|
|
||
| - `--account` - The Snowflake account name. | ||
| - `--region` - The Snowflake region. | ||
| - `--user` - The Snowflake username. | ||
| - `--role` - The Snowflake role. | ||
|
|
||
| > The easiest way to get the account name and region is to look at the URL when you log in to the Snowflake web interface. When clicking on the account icon you can copy the account URL that included the account name and region. | ||
| **Password Authentication** | ||
|
|
||
| Arguments: | ||
|
|
||
| - `--password` - The Snowflake password. | ||
| - `--ask-pass` - Prompt for the Snowflake password. | ||
|
|
||
| ```shell | ||
| shell snowflake --account zi12345 --region us-central1.gcp --user CHRIS --role ACCOUNTADMIN --ask-pass | ||
| ``` | ||
|
|
||
| > To create a username and password, use [Snowsight](https://docs.snowflake.com/en/user-guide/admin-user-management#using-snowsight) or using [SQL](https://docs.snowflake.com/en/user-guide/admin-user-management#using-sql). | ||
| **Certificate Authentication** | ||
|
|
||
| Arguments: | ||
|
|
||
| - `--private-key` - The path to the private key file. | ||
|
|
||
| ```shell | ||
| shell snowflake --account zi12345 --region us-central1.gcp --user CHRIS --role ACCOUNTADMIN --private-key ~/.ssh/id_rsa | ||
| ``` | ||
|
|
||
| > You need to generate a RSA key pair and assign the public key to your user via [Snowsight](https://docs.snowflake.com/en/user-guide/key-pair-auth). | ||
| ## Examples | ||
|
|
||
| **Retrieve all users** | ||
|
|
||
| ```shell | ||
| cnquery> snowflake.account.users | ||
| snowflake.account.users: [ | ||
| 0: snowflake.user name="CHRIS" | ||
| 1: snowflake.user name="DATAUSER" | ||
| 2: snowflake.user name="SNOWFLAKE" | ||
| ] | ||
| ``` | ||
|
|
||
| **Retrieve all users that have no MFA** | ||
|
|
||
| ```shell | ||
| cnquery> snowflake.account.users.where(extAuthnDuo == false) | ||
| snowflake.account.users.where: [ | ||
| 0: snowflake.user name="CHRIS" | ||
| 1: snowflake.user name="DATAUSER" | ||
| 2: snowflake.user name="SNOWFLAKE" | ||
| ] | ||
| ``` | ||
|
|
||
| **Retrieve all users that have password authentication** | ||
|
|
||
| ```shell | ||
| cnquery> snowflake.account.users.where(hasPassword) | ||
| snowflake.account.users.where: [ | ||
| 0: snowflake.user name="CHRIS" | ||
| 1: snowflake.user name="DATAUSER" | ||
| 2: snowflake.user name="SNOWFLAKE" | ||
| ] | ||
|
|
||
| ``` | ||
|
|
||
| **Retrieve all users that have certificate authentication** | ||
|
|
||
| ```shell | ||
| cnquery> snowflake.account.users.where(hasRsaPublicKey) | ||
| snowflake.account.users.where: [ | ||
| 0: snowflake.user name="CHRIS" | ||
| ] | ||
| ``` | ||
|
|
||
| **Retrieve users that have not logged in for 30 days** | ||
|
|
||
| ```shell | ||
| cnquery> snowflake.account.users.where(time.now - lastSuccessLogin > time.day * 30) { lastSuccessLogin } | ||
| snowflake.account.users.where: [ | ||
| 0: { | ||
| lastSuccessLogin: 366 days | ||
| } | ||
| ] | ||
| ``` | ||
| **Check that SCIM is enabled** | ||
| ```shell | ||
| cnquery> snowflake.account.securityIntegrations.where(type == /SCIM/).any(enabled == true) | ||
| [failed] [].any() | ||
| actual: [] | ||
| ``` | ||
| **Check the retention time is greater 90 days** | ||
| ```shell | ||
| cnquery> snowflake.account.parameters.one(key == "DATA_RETENTION_TIME_IN_DAYS" && value >= 90) | ||
| ``` | ||
| **Retrieve all databases** | ||
| ```shell | ||
| cnquery> snowflake.account.databases | ||
| snowflake.account.databases: [ | ||
| 0: snowflake.database name="CNQUERY" | ||
| 1: snowflake.database name="SNOWFLAKE" | ||
| 2: snowflake.database name="SNOWFLAKE_SAMPLE_DATA" | ||
| ] | ||
| ``` | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| // Copyright (c) Mondoo, Inc. | ||
| // SPDX-License-Identifier: BUSL-1.1 | ||
|
|
||
| package config | ||
|
|
||
| import ( | ||
| "go.mondoo.com/cnquery/v11/providers-sdk/v1/plugin" | ||
| "go.mondoo.com/cnquery/v11/providers/snowflake/provider" | ||
| ) | ||
|
|
||
| var Config = plugin.Provider{ | ||
| Name: "snowflake", | ||
| ID: "go.mondoo.com/cnquery/v11/providers/snowflake", | ||
| Version: "11.0.0", | ||
| ConnectionTypes: []string{provider.DefaultConnectionType}, | ||
| Connectors: []plugin.Connector{ | ||
| { | ||
| Name: "snowflake", | ||
| Use: "snowflake", | ||
| Short: "a Snowflake account", | ||
| Discovery: []string{}, | ||
| Flags: []plugin.Flag{ | ||
| { | ||
| Long: "user", | ||
| Type: plugin.FlagType_String, | ||
| Default: "", | ||
| Desc: "Snowflake user name", | ||
| }, | ||
| { | ||
| Long: "ask-pass", | ||
| Type: plugin.FlagType_Bool, | ||
| Default: "false", | ||
| Desc: "Prompt for connection password", | ||
| ConfigEntry: "-", | ||
| }, | ||
| { | ||
| Long: "password", | ||
| Short: "p", | ||
| Type: plugin.FlagType_String, | ||
| Default: "", | ||
| Desc: "Set the connection password", | ||
| Option: plugin.FlagOption_Password, | ||
| ConfigEntry: "-", | ||
| }, | ||
| { | ||
| Long: "identity-file", | ||
| Short: "i", | ||
| Type: plugin.FlagType_String, | ||
| Default: "", | ||
| Desc: "Select a file from which to read the identity (private key) for public key authentication", | ||
| }, | ||
| { | ||
| Long: "account", | ||
| Type: plugin.FlagType_String, | ||
| Default: "", | ||
| Desc: "Snowflake account", | ||
| }, | ||
| { | ||
| Long: "region", | ||
| Type: plugin.FlagType_String, | ||
| Default: "", | ||
| Desc: "Snowflake region", | ||
| }, | ||
| { | ||
| Long: "role", | ||
| Type: plugin.FlagType_String, | ||
| Default: "", | ||
| Desc: "Snowflake role", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } |
Oops, something went wrong.