Snowflake kills passwords for service accounts. The cleanup starts now.
The cloud data giant is retiring password logins for machine accounts. Working out what those accounts actually do is the real headache.
Key points
- Snowflake, a cloud data platform used by thousands of large companies, is ending password logins for its legacy service accounts.
- Service accounts are logins used by software, not people, to move data between systems automatically.
- Customers must switch these accounts to passwordless methods such as key pairs or short-lived tokens.
- The technical switch is the easy bit; finding out what each account does and who owns it is harder.
- Identity firm Token Security says most companies do not have a clean inventory of their machine accounts.
Snowflake is pulling the plug on a very old habit: letting software log in with a username and a password.
The company, whose platform stores and crunches data for thousands of large businesses, is retiring password authentication for legacy service accounts. Service accounts are the logins that programs, scripts and pipelines use to talk to each other without a human at the keyboard. Think of the overnight job that copies sales figures from a shop's till system into a reporting dashboard. That job needs a login too.
Until now, many of those logins were protected by a single static password sitting in a config file. Snowflake wants them moved to passwordless methods instead, mainly key-pair authentication (a pair of mathematically linked files, one kept secret) and short-lived tokens issued through OAuth, the standard defined in RFC 6749 that lets one system grant another temporary access.
The direction of travel is sensible. Static passwords on machine accounts are one of the most reliably stolen secrets in cloud breaches. And no, MFA would not have helped here, because there is no human to tap a phone.
Why is Snowflake doing this now?
Because its own customers keep getting hit through exactly this weakness. In 2024, attackers used stolen passwords from unrelated infostealer malware to log into more than 100 Snowflake customer tenants, including Ticketmaster and AT&T. None of the affected accounts had multi-factor authentication turned on. Killing password logins for machine accounts closes off a large part of that path.
The company has spelled out the deprecation timetable and the recommended replacements in its official service user documentation.
So what's the hard part?
Working out which account does what. First reported in detail by BleepingComputer, the migration is technically simple: generate a key pair, update the client, done. The problem, as identity firm Token Security lays out, is that most large organisations have no clean list of their service accounts, no clear owner for each one, and no idea what would break if they turned one off.
A typical Snowflake customer might have hundreds of these logins. Some belong to a data pipeline that still runs every night. Some belonged to a contractor who left in 2022. Some were created for a proof of concept nobody ever switched off. All of them have real database access.
| Task | What it involves | Why it is hard |
|---|---|---|
| Inventory | List every service account and where it logs in from | Accounts get created ad hoc, often outside change control |
| Ownership | Assign a named human owner to each account | Original creators have often left the company |
| Right-sizing | Cut each account's permissions to what it actually needs | Requires reading query logs, not just role assignments |
| Rotation | Move from static password to key pair or OAuth token | Every dependent script and tool must be updated in lockstep |
This is the split between authentication (proving who is logging in) and authorisation (deciding what they are allowed to touch). Snowflake is fixing the first. The second is still the customer's job, and it is where most of the mess lives.
What should ordinary customers take from this?
If you are a Snowflake customer, your admins already know. If you are not, the lesson still travels. Any business running cloud services has machine logins quietly doing work in the background. They rarely appear on security dashboards. They almost never have someone's name attached. They are, statistically, how attackers get in.
The password is dying for humans. It is taking rather longer to die for the software they wrote.
