CS-05 — Cloud architecture · Data platforms
Multi-tenant security and isolation in Snowflake
Large-scale migration of applications to key-pair authentication in Snowflake with keys stored in AWS, and a proposed per-tenant user and role architecture with least privilege and credential rotation.
- My role
- Participation in the authentication migration and contribution to the design of the per-tenant proposal (Wizeline).
- Period
- Not documented
- Disclosure
- Restricted — high-level only
- Technologies
- SnowflakeAWS Secrets ManagerAWS Systems ManagerAWS IAMPython
- Last reviewed
- 13 November 2026
Context
The platform needed to strengthen service authentication against Snowflake and isolation between tenants: role-based access control, tenant-specific permissions, masking policies and secure credential management across several AWS regions.
Challenges
- 01Replacing legacy authentication mechanisms without disrupting services.
- 02Managing private keys securely and across several regions.
- 03Environment-specific permission and configuration issues.
Solution & architecture
Large-scale migration to key-pair: generation and management of key-pair configurations, integration of the private keys with AWS secrets storage, adaptation of the services and validation of authentication in each environment and region. In addition, contribution to a per-tenant Snowflake user and role architecture: automated provisioning, isolation, secure key handling, rotation, least privilege, secret distribution and health monitoring.
Key decisions
D-01
Key-pair authentication instead of legacy credentials
It allows service credentials to be managed as secrets and rotated without relying on passwords.
Trade-offs
Not documented yet
Results
Applications migrated to key-pair authentication in Snowflake across several environments and AWS regions.
Lessons learned
Not documented yet
Important: the key-pair migration is completed work; the per-tenant user and role architecture is, in part, an architecture proposal and investigation, not a solution already deployed to production. Security implementation details are not published.
Ask about this case study
Questions here are answered with the case study “Multi-tenant security and isolation in Snowflake” as context.