Named workload identity management for users in Snowflake

Snowflake now allows managing workload identities (Workload Identity Federation) directly via SQL commands for service users, moving beyond the limitation of a single default identity. Each user can have up to 10 identities with individual names and provider settings.

Use cases

Imagine you need to authenticate multiple services and applications to Snowflake using cloud identity providers without managing long-lived passwords or keys.

• Register new workload identities tied to specific providers.
• Modify parameters like comments or disable existing identities.
• List configured authentication methods.

How to use

Add a new workload identity to an existing service user using dedicated SQL commands.

ALTER USER my_service_user ADD WORKLOAD IDENTITY aws_identity (
  TYPE = AWS,
  ARN = 'arn:aws:iam::123456789012:role/MyAWSRole'
);

What happens in this code:

1. The ALTER USER command targets the specified service user.
2. The ADD WORKLOAD IDENTITY clause sets the unique name for the new identity (aws_identity).
3. Provider-specific parameters configure the integration via AWS IAM.

Modify an existing identity to update configurations or add a comment:

ALTER USER my_service_user MODIFY WORKLOAD IDENTITY aws_identity SET COMMENT = 'Updated for testing';

What happens in this code:

1. The command points to the already existing named identity on the user.
2. The SET COMMENT parameter applies a new description for auditing and tracking.

Limitations and requirements

• Each user can have up to 10 workload identities by default.
• Properties like TYPE, ARN, ISSUER, SUBJECT, or OIDC_AUDIENCE_LIST cannot be changed directly after creation; to change them, you must remove the identity and add it again.
• Named commands cannot manage the DEFAULT identity created by the legacy WORKLOAD_IDENTITY property.
• Requires OWNERSHIP or MODIFY PROGRAMMATIC AUTHENTICATION METHODS privilege on the service user.