Data
1 check against Snowflake, verifying MFA enrollment across every non-disabled user in an account.
snowflake-mfa-enforced
Checks whether every non-disabled Snowflake user has MFA enrolled. Calls Snowflake's SQL API at POST https://{accountIdentifier}.snowflakecomputing.com/api/v2/statements to query user MFA status, authenticated with a short-lived JWT signed by a registered RSA key pair rather than a static bearer token.
- accountIdentifier
- the Snowflake account identifier, used to build both the API host and the target, and to derive the JWT's issuer and subject claims.
- username
- the Snowflake user the JWT authenticates as.
- privateKeyPem
- the RSA private key registered against that user with
ALTER USER ... SET RSA_PUBLIC_KEY=....
The JWT's issuer claim embeds a SHA-256 fingerprint of the matching public key, computed from the supplied private key rather than accepted as a separate input, so it can never drift from the key signing the request. The JWT has a 1-hour lifetime, Snowflake's own documented maximum. Disabled users are excluded from the pass and fail determination. A 401 or 403 response is reported as needs-review, never fail.