3.5 Network Policies, Network Rules, External Access & Private Connectivity

Network Security in Two Directions

The blueprint's objective 1.3 lists network policies, network rules, external access, access control privileges, and private connectivity. Architects should separate the two directions of traffic:

Network Rules

A network rule is a schema-level object that groups network identifiers. It does not say whether traffic is allowed; the feature that uses it decides that.

CREATE NETWORK RULE security.rules.corp_vpn
  MODE = INGRESS TYPE = IPV4
  VALUE_LIST = ('198.51.100.0/24');

CREATE NETWORK RULE security.rules.prod_vpce
  MODE = INGRESS TYPE = AWSVPCEID
  VALUE_LIST = ('vpce-0a1b2c3d4e5f67890');

Network Policies

A network policy restricts inbound access using ALLOWED_NETWORK_RULE_LIST and BLOCKED_NETWORK_RULE_LIST (the older ALLOWED_IP_LIST and BLOCKED_IP_LIST still work, but Snowflake recommends network rules).

CREATE NETWORK POLICY corp_access
  ALLOWED_NETWORK_RULE_LIST = ('security.rules.corp_vpn', 'security.rules.prod_vpce');

ALTER ACCOUNT SET NETWORK_POLICY = corp_access;          -- SECURITYADMIN or higher
ALTER USER svc_loader SET NETWORK_POLICY = loader_only;  -- user-level override

Evaluation rules that are frequently tested:

1. Blocked before allowed. Blocked entries are applied first; if an identifier is in an allowed rule, other identifiers of the same type are implicitly blocked.
2. Most specific policy wins. A policy on a security integration (for example an OAuth or SAML integration) overrides a user policy, which overrides the account policy. The more general policy is not evaluated at all for that request.
3. Private endpoints win over IP rules. For a request arriving over private connectivity, AWSVPCEID/AZURELINKID rules in the allowed list take precedence, and IPv4/IPv6 rules are ignored.
4. Internal stages. On AWS, ENFORCE_NETWORK_RULES_FOR_INTERNAL_STAGES = TRUE lets network rules also protect internal stages.
5. Lockout protection. Snowflake prevents activating an account-level policy that would block the administrator's current IP address; check SELECT CURRENT_IP_ADDRESS(); first.

Outbound Access: External Access Integrations

UDFs and stored procedures cannot reach the internet by default. To let handler code call an approved API:

1. Create an egress network rule (MODE = EGRESS, TYPE = HOST_PORT) listing the allowed hosts.
2. Store credentials in a secret (for example TYPE = GENERIC_STRING or OAuth2).
3. Create an external access integration that references the network rules and allowed secrets.
4. Create the function or procedure with EXTERNAL_ACCESS_INTEGRATIONS = (...) and SECRETS = (...).

CREATE NETWORK RULE security.rules.fx_api
  MODE = EGRESS TYPE = HOST_PORT
  VALUE_LIST = ('api.exchangerates.example.com:443');

CREATE SECRET security.secrets.fx_key TYPE = GENERIC_STRING SECRET_STRING = '...';

CREATE EXTERNAL ACCESS INTEGRATION fx_api_access
  ALLOWED_NETWORK_RULES = (security.rules.fx_api)
  ALLOWED_AUTHENTICATION_SECRETS = (security.secrets.fx_key)
  ENABLED = TRUE;

Any call to a host that is not in an allowed rule is denied. Administrators audit calls in the EXTERNAL_ACCESS_HISTORY view. External access is available in all editions; routing it over private connectivity requires Business Critical Edition and ACCOUNTADMIN. External access integrations have largely replaced external functions (which route calls through a cloud API gateway) for new designs.

Access Control Privileges Behind These Objects

• Creating network policies and account-level integrations is an administrative task (SECURITYADMIN/ACCOUNTADMIN or roles granted CREATE NETWORK POLICY / CREATE INTEGRATION).
• Developers need USAGE on an external access integration and READ on the secrets it allows before they can reference them in a function.
• Network rules and secrets are schema objects, so ownership and USAGE on the governance schema decide who can change them.

Private Connectivity

AWS PrivateLink, Azure Private Link, and Google Cloud Private Service Connect let clients reach Snowflake through a private endpoint in the customer's own network instead of the public internet. They require Business Critical Edition (or higher).

• Clients connect to a privatelink hostname, such as <orgname>-<account_name>.privatelink.snowflakecomputing.com, which private DNS in the customer network resolves to the endpoint.
• Private connectivity can also cover internal stages, outbound traffic to external stages and external volumes, and the connection to the key management service used by Tri-Secret Secure.
• Combine private endpoints with a network policy that allows only the approved endpoint IDs, so traffic from any other path is rejected.
• SYSTEM$ALLOWLIST() (public endpoints) and SYSTEM$ALLOWLIST_PRIVATELINK() return the hostnames and ports that firewalls must allow; the SnowCD tool uses that output to test connectivity.

Worked Scenario: Layering Network Controls

A multinational bank has three access paths: employees on the corporate VPN, ETL services running in an AWS VPC connected by PrivateLink, and a partner analytics tool that authenticates with External OAuth.

Design checks that often appear as exam distractors:

• Only one network policy can be active on the account at a time; activating a new one replaces the old.
• A user-level policy replaces (does not add to) the account policy for that user, so it must include every path that user legitimately needs.
• Before activating any policy, confirm that the administrator's current IP or private endpoint is in the allowed list — Snowflake rejects activation otherwise.
• Monitor denied logins in LOGIN_HISTORY and inventory policies and rules with NETWORK_POLICIES, NETWORK_RULES, and NETWORK_RULE_REFERENCES views.