Snowflake Support page: Access requirements changes (Preview)¶

When this behavior change bundle is enabled, the following changes to access to the Snowflake Support page occur:

Before the change:

• Any user with a valid Snowflake account and a role with Support privileges could view the Snowflake Support page.

• Users with a role that includes Support privileges could access the page regardless of which role was active in their session. This access was allowed even when a session policy prevented the Support-privileged role from being activated as a secondary role.

After the change:

• To access the page, a Support-privileged role must be active in the current session, either as the primary role or as an allowed secondary role.

• Access is denied if a session policy blocks the Support-privileged role from being activated as a secondary role and that role isn’t currently active as the primary role.

• If access is denied, users see a warning that instructs them to switch to a Support-privileged role or contact their administrator.

Benefits:

• Improved performance, security, and reliability when loading and navigating the Support page.

• Consistent enforcement of administrator-defined session policies for secondary role activation.

To verify if your Support-privileged roles are currently restricted from being activated as secondary roles by a session policy, run the following queries.

To identify the active session policies in your account, run this query:

SHOW SESSION POLICIES;

To inspect the BLOCKED_SECONDARY_ROLES and ALLOWED_SECONDARY_ROLES fields for each active policy, run this query:

DESC SESSION POLICY <policy_name>;

Verify if any of your Support-privileged roles are explicitly blocked or are excluded from the allowed list. If your Support roles are restricted by a session policy, we recommend that you take one of the following actions:

• Communicate to affected users that they must switch to the Support-privileged role to access the Support page.

• Adjust your session policy to allow your Support-privileged roles to be activated as secondary roles.

• Create a new role with Support privileges that isn’t restricted by the session policy and grant this role to your users.

Ref: 2188