Network Policies / Rules

[BenKentzer]

Hello!
We've been using ACCOUNTADMIN for our network policies and hence managing them separately. However, we want to bring these into the SnowDDL world so we can include them within our template environment set up to ensure that all environments are set up the same. Clearly the application of the policy to the account will have to be done by ACCOUNTADMIN still, but if we easily track which rules are where via SnowDDL then this will help us massively.

Is there a way to specify rules within the policy yaml file in SnowDDL? The documentation suggests it's just IP addresses...
Thanks
Ben

[littleK0i]

Yes, it seems Snowflake implemented "network rules" for NETWORK_POLICIES recently. Originally it supported IP ranges only.

I am going to add it, but it might take a bit of extra work. Network rules are schema-level objects for some reason, but policies are account-level objects.

The plan is the following:

• Move NETWORK_POLICY lower in execution order, after schema objects, but before users.
• Add network rule parameters to NETWORK_POLICY.
• Potentially move account parameters to the last position in execution order.

As far as I know, you do not need NETWORK_POLICY to be created by ACCOUNTADMIN. SnowDDL admin can create policies and attach policies to specific users.

You may only need ACCOUNTADMIN to set account-level NETWORK_POLICY, but it can be created by SnowDDL first. It should be alright, unlike RESOURCE_MONITOR.

[BenKentzer]

Fantastic as always - thank you!

There's no massive rush on this at the moment from our point of view - more of a roadmap item that we are looking at to try to help us when we create new accounts. We can manage manually in the short term :-)

Cheers
Ben

[littleK0i]

@BenKentzer , please check version 0.33.0.

Updated docs for NETWORK_POLICY: https://docs.snowddl.com/basic/yaml-configs/network-policy

It can be assigned to account using new ACCOUNT_POLICY config: https://docs.snowddl.com/basic/yaml-configs/account-policy

It can be assigned to user using network_policy reference in USER object: https://docs.snowddl.com/basic/yaml-configs/user#policy-reference-parameters

[BenKentzer]

As always - thank you for the fast response on getting this change completed :-)