> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/SaaS/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/SaaS/configuration/integrations/snowflake/reference-guides/snowflake-overview/security-and-compliance.md).
# Security and Compliance
{% hint style="info" %}
**New connections**
The [new connections flow](/SaaS/configuration/integrations/data-and-integrations/registering-a-connection/reference-guides/new-connections-reference-guide.md) documented here is available and released to select tenants.
{% endhint %}
## Authentication
### Registering the connection
The Snowflake integration supports the following authentication methods to register a connection. The credentials provided must be for an account with the permissions listed in the [Register a Snowflake connection guide](/SaaS/configuration/integrations/snowflake/how-to-guides/connect-snowflake.md#set-up-the-immuta-system-account).
* **Key pair**
* **Snowflake External OAuth**
#### **Snowflake External OAuth**
Immuta's OAuth authentication method uses the [Client Credentials Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow) to integrate with Snowflake External OAuth. When a user configures the Snowflake integration, Immuta uses the token credentials (obtained using a certificate or passing a client secret) to craft an authenticated access token to connect with Snowflake. This allows organizations that already use Snowflake External OAuth to use that secure authentication with Immuta.
This is what will happen if you use Snowflake External OAuth to authenticate your Snowflake connection:
1. An Immuta application administrator registers the Snowflake connection.
2. Immuta creates a custom token and sends it to the authorization server.
3. The authorization server confirms the information sent from Immuta and issues an access token to Immuta.
4. Immuta sends the access token it received from the authorization server to Snowflake.
5. Snowflake authenticates the token and grants access to the requested resources from Immuta.
6. The integration is connected and users can query data.
### Identity providers for user authentication
The built-in Immuta IAM can be used as a complete solution for authentication and user entitlement. However, you can connect your existing identity management provider to Immuta to use that system for authentication and user entitlement instead.
Each of the supported identity providers includes a specific set of configuration options that enable Immuta to communicate with the IAM system and map the users, permissions, groups, and attributes into Immuta.
See the [Identity managers guide](/SaaS/configuration/people/section-contents/reference-guides/index.md) for a list of supported providers and details.
See the [Snowflake integration reference guide](/SaaS/configuration/integrations/snowflake/reference-guides/snowflake-overview.md#user-registration-and-id-mapping) for details about user provisioning and mapping user accounts to Immuta.
## Auditing and compliance
Immuta provides auditing features and governance reports so that data owners and governors can monitor users' access to data and detect anomalies in behavior.
You can view the information in these audit logs on [dashboards](/SaaS/govern/detect-your-data/detection/detect-concept.md) or export the full audit logs to S3 and ADLS for long-term backup and processing with log data processors and tools. This capability fosters convenient integrations with log monitoring services and data pipelines.
See the [Audit documentation](/SaaS/govern/detect-your-data/audit/reference-guides/index.md) for details about these capabilities and how they work with the Snowflake integration.
### Snowflake query audit
Immuta captures queries in Snowflake, making audit records more useful in assessing what users are doing. To audit Snowflake queries, Immuta runs a query in Snowflake to retrieve user query histories. Those histories are then populated into comprehensive audit logs. Immuta will only audit queries from Immuta users on objects registered as Immuta data sources.
Query audit can be [enabled through the connection](/SaaS/configuration/integrations/snowflake/how-to-guides/connect-snowflake.md). Audit ingestion will run at the schedule set on the [app settings page](/SaaS/configuration/application-configuration/how-to-guides/config-builder-guide.md#snowflake-audit-sync-schedule). Audit ingestion can be manually requested at any time from the Immuta audit page. When manually requested, it will only search for new queries that were created since the last query that had been audited. The job is run in the background, so the new queries will not be immediately available.
See the [Snowflake audit page](/SaaS/govern/detect-your-data/audit/reference-guides/query-audit-logs/snowflake.md) for details about the contents of the logs and an example of the resulting audit record.
### Governance reports
Immuta governance reports allow users with the `GOVERNANCE` Immuta permission to use a natural language builder to instantly create reports that delineate user activity across Immuta. These reports can be based on various entity types, including users, groups, projects, data sources, purposes, policy types, or connection types.
See the [Governance report types](/SaaS/govern/detect-your-data/audit/reference-guides/reports.md) page for a list of report types and guidance.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://documentation.immuta.com/SaaS/configuration/integrations/snowflake/reference-guides/snowflake-overview/security-and-compliance.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.