password_policies

Creates, updates, deletes, gets or lists a password_policies resource.

Overview

Name	password_policies
Type	Resource
Id	snowflake.security.password_policies

Fields

The following fields are returned by SELECT queries:

get

successful

Name	Datatype	Description
name	string	Name of the password policy (pattern: ^"([^"]|"")+"|[a-zA-Z_][a-zA-Z0-9_$]*$)
database_name	string	Database in which the password policy is stored (pattern: ^"([^"]|"")+"|[a-zA-Z_][a-zA-Z0-9_$]*$)
schema_name	string	Schema in which the password policy is stored (pattern: ^"([^"]|"")+"|[a-zA-Z_][a-zA-Z0-9_$]*$)
comment	string	Comment for the password policy
created_on	string (date-time)	Date and time when the password policy was created.
owner	string	Role that owns the password policy (pattern: ^"([^"]|"")+"|[a-zA-Z_][a-zA-Z0-9_$]*$)
owner_role_type	string	The type of role that owns the password policy
password_history	integer	Number of distinct passwords that a user must create before re-using a previous password
password_lockout_time_mins	integer	Period of time for which users will be locked after entering their password incorrectly many times (specified by MAX_RETRIES), in minutes
password_max_age_days	integer	Period after which password must be changed, in days.
password_max_length	integer	Maximum length of new password.
password_max_retries	integer	Number of attempts users have to enter the correct password before their account is locked.
password_min_age_days	integer	Period after a password is changed during which a password cannot be changed again, in days.
password_min_length	integer	Minimum length of new password.
password_min_lower_case_chars	integer	Minimum number of lowercase characters in new password.
password_min_numeric_chars	integer	Minimum number of numeric characters in new password.
password_min_special_chars	integer	Minimum number of special characters in new password.
password_min_upper_case_chars	integer	Minimum number of uppercase characters in new password.

list

A Snowflake password policy

Name	Datatype	Description
name	string	Name of the password policy (pattern: ^"([^"]|"")+"|[a-zA-Z_][a-zA-Z0-9_$]*$)
database_name	string	Database in which the password policy is stored (pattern: ^"([^"]|"")+"|[a-zA-Z_][a-zA-Z0-9_$]*$)
schema_name	string	Schema in which the password policy is stored (pattern: ^"([^"]|"")+"|[a-zA-Z_][a-zA-Z0-9_$]*$)
comment	string	Comment for the password policy
created_on	string (date-time)	Date and time when the password policy was created.
owner	string	Role that owns the password policy (pattern: ^"([^"]|"")+"|[a-zA-Z_][a-zA-Z0-9_$]*$)
owner_role_type	string	The type of role that owns the password policy
password_history	integer	Number of distinct passwords that a user must create before re-using a previous password
password_lockout_time_mins	integer	Period of time for which users will be locked after entering their password incorrectly many times (specified by MAX_RETRIES), in minutes
password_max_age_days	integer	Period after which password must be changed, in days.
password_max_length	integer	Maximum length of new password.
password_max_retries	integer	Number of attempts users have to enter the correct password before their account is locked.
password_min_age_days	integer	Period after a password is changed during which a password cannot be changed again, in days.
password_min_length	integer	Minimum length of new password.
password_min_lower_case_chars	integer	Minimum number of lowercase characters in new password.
password_min_numeric_chars	integer	Minimum number of numeric characters in new password.
password_min_special_chars	integer	Minimum number of special characters in new password.
password_min_upper_case_chars	integer	Minimum number of uppercase characters in new password.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	database_name, schema_name, name, endpoint		Fetch a password policy
list	select	database_name, schema_name, endpoint	like, startsWith, showLimit	List password policies
create	insert	database_name, schema_name, endpoint, name	createMode	Create a password policy
delete	delete	database_name, schema_name, name, endpoint	ifExists	Delete a password policy
rename	exec	database_name, schema_name, name, targetName, endpoint	ifExists, targetDatabase, targetSchema	Rename a password policy with a new identifier

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
database_name	string	Identifier (i.e. name) for the database to which the resource belongs. You can use the /api/v2/databases GET request to get a list of available databases.
endpoint	string	Organization and account identifier (orgname-accountname) (default: orgname-accountname)
name	string	Identifier (i.e. name) for the resource.
schema_name	string	Identifier (i.e. name) for the schema to which the resource belongs. You can use the /api/v2/databases/{database}/schemas GET request to get a list of available schemas for the specified database.
targetName	string	Name of the target resource.
createMode	string	Parameter allowing support for different modes of resource creation. Possible values include: - errorIfExists: Throws an error if you try to create a resource that already exists. - orReplace: Automatically replaces the existing resource with the current one. - ifNotExists: Creates a new resource when an alter is requested for a non-existent resource.
ifExists	boolean	Parameter that specifies how to handle the request for a resource that does not exist: - true: The endpoint does not throw an error if the resource does not exist. It returns a 200 success response, but does not take any action on the resource. - false: The endpoint throws an error if the resource doesn't exist.
like	string	Parameter to filter the command output by resource name. Uses case-insensitive pattern matching, with support for SQL wildcard characters.
showLimit	integer	Parameter to limit the maximum number of rows returned by a command.
startsWith	string	Parameter to filter the command output based on the string of characters that appear at the beginning of the object name. Uses case-sensitive pattern matching.
targetDatabase	string	Database of the target resource. Defaults to the source's database
targetSchema	string	Schema of the target resource. Defaults to the source's schema

SELECT examples

get

Fetch a password policy

SELECT
name,
database_name,
schema_name,
comment,
created_on,
owner,
owner_role_type,
password_history,
password_lockout_time_mins,
password_max_age_days,
password_max_length,
password_max_retries,
password_min_age_days,
password_min_length,
password_min_lower_case_chars,
password_min_numeric_chars,
password_min_special_chars,
password_min_upper_case_chars
FROM snowflake.security.password_policies
WHERE database_name = '{{ database_name }}' -- required
AND schema_name = '{{ schema_name }}' -- required
AND name = '{{ name }}' -- required
AND endpoint = '{{ endpoint }}' -- required
;

list

List password policies

SELECT
name,
database_name,
schema_name,
comment,
created_on,
owner,
owner_role_type,
password_history,
password_lockout_time_mins,
password_max_age_days,
password_max_length,
password_max_retries,
password_min_age_days,
password_min_length,
password_min_lower_case_chars,
password_min_numeric_chars,
password_min_special_chars,
password_min_upper_case_chars
FROM snowflake.security.password_policies
WHERE database_name = '{{ database_name }}' -- required
AND schema_name = '{{ schema_name }}' -- required
AND endpoint = '{{ endpoint }}' -- required
AND "like" = '{{ like }}'
AND startsWith = '{{ startsWith }}'
AND showLimit = '{{ showLimit }}'
;

INSERT examples

create

Create a password policy

INSERT INTO snowflake.security.password_policies (
comment,
password_min_length,
password_max_length,
password_min_upper_case_chars,
password_min_lower_case_chars,
password_min_numeric_chars,
password_min_special_chars,
password_min_age_days,
password_max_age_days,
password_max_retries,
password_lockout_time_mins,
password_history,
name,
database_name,
schema_name,
endpoint,
createMode
)
SELECT 
'{{ comment }}',
{{ password_min_length }},
{{ password_max_length }},
{{ password_min_upper_case_chars }},
{{ password_min_lower_case_chars }},
{{ password_min_numeric_chars }},
{{ password_min_special_chars }},
{{ password_min_age_days }},
{{ password_max_age_days }},
{{ password_max_retries }},
{{ password_lockout_time_mins }},
{{ password_history }},
'{{ name }}' /* required */,
'{{ database_name }}',
'{{ schema_name }}',
'{{ endpoint }}',
'{{ createMode }}'
RETURNING
status
;

Manifest

# Description fields are for documentation purposes
- name: password_policies
props:
  - name: database_name
    value: "{{ database_name }}"
    description: Required parameter for the password_policies resource.
  - name: schema_name
    value: "{{ schema_name }}"
    description: Required parameter for the password_policies resource.
  - name: endpoint
    value: "{{ endpoint }}"
    description: Required parameter for the password_policies resource.
  - name: comment
    value: "{{ comment }}"
    description: |
      Comment for the password policy
  - name: password_min_length
    value: {{ password_min_length }}
    description: |
      Minimum length of new password.
  - name: password_max_length
    value: {{ password_max_length }}
    description: |
      Maximum length of new password.
  - name: password_min_upper_case_chars
    value: {{ password_min_upper_case_chars }}
    description: |
      Minimum number of uppercase characters in new password.
  - name: password_min_lower_case_chars
    value: {{ password_min_lower_case_chars }}
    description: |
      Minimum number of lowercase characters in new password.
  - name: password_min_numeric_chars
    value: {{ password_min_numeric_chars }}
    description: |
      Minimum number of numeric characters in new password.
  - name: password_min_special_chars
    value: {{ password_min_special_chars }}
    description: |
      Minimum number of special characters in new password.
  - name: password_min_age_days
    value: {{ password_min_age_days }}
    description: |
      Period after a password is changed during which a password cannot be changed again, in days.
  - name: password_max_age_days
    value: {{ password_max_age_days }}
    description: |
      Period after which password must be changed, in days.
  - name: password_max_retries
    value: {{ password_max_retries }}
    description: |
      Number of attempts users have to enter the correct password before their account is locked.
  - name: password_lockout_time_mins
    value: {{ password_lockout_time_mins }}
    description: |
      Period of time for which users will be locked after entering their password incorrectly many times (specified by MAX_RETRIES), in minutes
  - name: password_history
    value: {{ password_history }}
    description: |
      Number of distinct passwords that a user must create before re-using a previous password
  - name: name
    value: "{{ name }}"
    description: |
      Name of the password policy
  - name: createMode
    value: "{{ createMode }}"
    description: Parameter allowing support for different modes of resource creation. Possible values include: - `errorIfExists`: Throws an error if you try to create a resource that already exists. - `orReplace`: Automatically replaces the existing resource with the current one. - `ifNotExists`: Creates a new resource when an alter is requested for a non-existent resource.
    description: Parameter allowing support for different modes of resource creation. Possible values include: - `errorIfExists`: Throws an error if you try to create a resource that already exists. - `orReplace`: Automatically replaces the existing resource with the current one. - `ifNotExists`: Creates a new resource when an alter is requested for a non-existent resource.

DELETE examples

delete

Delete a password policy

DELETE FROM snowflake.security.password_policies
WHERE database_name = '{{ database_name }}' --required
AND schema_name = '{{ schema_name }}' --required
AND name = '{{ name }}' --required
AND endpoint = '{{ endpoint }}' --required
AND ifExists = '{{ ifExists }}'
;

Lifecycle Methods

rename

Rename a password policy with a new identifier

EXEC snowflake.security.password_policies.rename 
@database_name='{{ database_name }}' --required, 
@schema_name='{{ schema_name }}' --required, 
@name='{{ name }}' --required, 
@targetName='{{ targetName }}' --required, 
@endpoint='{{ endpoint }}' --required, 
@ifExists={{ ifExists }}, 
@targetDatabase='{{ targetDatabase }}', 
@targetSchema='{{ targetSchema }}'
;