Security overview for Streamlit in Snowflake

This topic provides a security overview for system administrators managing Streamlit in Snowflake in their Snowflake accounts. Understanding the security model and implementing proper controls ensures that developers can build secure applications while administrators maintain governance over sensitive data and resources.

安全模型

Streamlit in Snowflake follows Snowflake’s comprehensive security model, which includes authentication, role-based access control, network policies, and data governance features. Apps are first-class Snowflake objects that integrate with existing security infrastructure.

所有者权限执行

默认情况下，Streamlit 应用程序以所有者权限运行，其行为类似于存储过程。这会带来以下影响：

  • 应用程序执行查询时使用的是应用程序所有者的权限，而非查看者的权限。
  • 应用程序所有者的角色决定了应用程序可访问的数据和可执行的操作。
  • 查看者无需直接访问基础表或视图，即可与应用程序进行交互。

This model eliminates the need for service account tokens and integrates seamlessly with Snowflake’s authentication and access control features. For more information, see Understanding owner’s rights and Streamlit in Snowflake apps.

As an alternative, you can configure a container-runtime app to use restricted caller’s rights (Preview), which allows the app to run with the viewer’s privileges instead of the owner’s. For more information, see Restricted caller’s rights and Streamlit in Snowflake.

责任共担模型

安全责任由 Snowflake、账户管理员和应用程序开发者共同承担：

  • Snowflake 提供安全的平台、身份验证、加密以及各类安全功能。
  • 管理员负责配置账户级安全策略、管理角色和权限，并审计应用程序的使用情况。
  • 应用程序开发者负责编写安全的代码、妥善处理密钥，并遵循安全最佳实践。

For more information about Snowflake’s security model, see Snowflake’s Shared Responsibility Model.

内容安全策略

All Streamlit apps run within a Content Security Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) (CSP) that restricts which resources can be loaded. This policy provides defense-in-depth protection against cross-site scripting (XSS) and other code injection attacks. The CSP is not configurable at this time.

该 CSP 会阻止以下外部资源：

  • 从外部域加载代码（脚本、样式、字体）
  • 在来自外部域的 iframe 中嵌入应用程序

该 CSP 允许以下外部资源：

  • Images and media from HTTPS sources: Apps can load images and media files from any HTTPS URL, including external image hosting services and APIs that return images. This doesn’t require an external access integration.
  • Data URIs and blob URLs: Apps can use embedded data (data URIs) and dynamically generated content (blob URLs) for images and media. This supports features like displaying charts, diagrams, or user-uploaded content.
  • Mapbox and Carto resources: A limited subset of resources from Mapbox and Carto are permitted to support mapping visualizations.

Note

  • For warehouse runtimes which use conda to manage dependencies, you must accept the Anaconda terms to use Mapbox. For more information, see Using third-party packages from Anaconda.
  • Loading images or media from external domains is supported in Streamlit in Snowflake, but not in Snowflake Native App Framework.
  • The CSP also blocks front-end calls that are generally considered unsafe, such as eval().

This restrictive policy means that most third-party JavaScript libraries and custom components that rely on external scripts won’t work in Streamlit apps. For more information about CSP limitations, see Loading external resources.

基本安全设置

The following security configurations are essential for a secure and well-functioning Streamlit in Snowflake environment.

网络访问配置

请配置网络访问，以确保应用程序能够与 Snowflake 通信。

适用于所有部署：

  • Add *.snowflakeapp.cn and *.snowflake.cn to your network allowlist.
  • 确保在您的网络配置中未阻止 WebSockets。

For more information, see You can’t load the Streamlit app.

对于专用连接：

If your organization requires private connectivity, configure AWS PrivateLink, Azure Private Link, or Google Cloud Private Service Connect for both Snowflake access and Streamlit app access. For more information, see Private connectivity for Streamlit in Snowflake.

基于角色的访问控制

建立用于管理 Streamlit 应用程序的角色层次结构。

推荐的角色结构：

  • 创建者角色：在将部署应用程序的架构上，具有 CREATESTREAMLIT 权限的角色。
  • 查看者角色：在应用程序上为最终用户授予 USAGE 权限的角色。

以下示例演示了如何为 Streamlit 应用程序创建角色层次结构。

-- Create dedicated roles for Streamlit
CREATE ROLE streamlit_developer;
CREATE ROLE streamlit_viewer;

-- Grant hierarchy
GRANT ROLE streamlit_viewer TO ROLE streamlit_developer;

-- Grant privileges for app creation
GRANT USAGE ON DATABASE streamlit_db TO ROLE streamlit_developer;
GRANT USAGE ON SCHEMA streamlit_db.apps TO ROLE streamlit_developer;
GRANT CREATE STREAMLIT ON SCHEMA streamlit_db.apps TO ROLE streamlit_developer;
GRANT USAGE ON COMPUTE_POOL streamlit_compute_pool TO ROLE streamlit_developer;
GRANT USAGE ON INTEGRATION python_package_index TO ROLE streamlit_developer;

-- Grant privileges for app viewing
GRANT USAGE ON WAREHOUSE streamlit_wh TO ROLE streamlit_viewer;
GRANT USAGE ON DATABASE streamlit_db TO ROLE streamlit_viewer;
GRANT USAGE ON SCHEMA streamlit_db.apps TO ROLE streamlit_viewer;
GRANT USAGE ON STREAMLIT streamlit_db.apps.my_app TO ROLE streamlit_viewer;

The app developer also needs USAGE on streamlit_wh, but this is inherited from the viewer role. For more information about required privileges, see Privileges required to create and use a Streamlit app.

密钥管理

为访问外部服务或敏感凭据的应用程序配置适当的密钥管理：

  1. 通过授予适当权限，为应用程序启用密钥访问：

    -- Grant privileges on secrets to app owner role
GRANT READ ON SECRET my_secret TO ROLE streamlit_developer;
GRANT USAGE ON INTEGRATION my_external_access_integration TO ROLE streamlit_developer;

  2. For container runtime apps, create SQL functions to wrap secret access rather than embedding secrets in app code.

For more information, see Manage secrets and configure your Streamlit app.

上下文函数与行级安全

In warehouse runtimes, if your apps use context functions (such as CURRENT_USER()) or access tables with row access policies, grant the global READ SESSION privilege to app owner roles:

USE ROLE ACCOUNTADMIN;
GRANT READ SESSION ON ACCOUNT TO ROLE streamlit_developer;

Note

Warehouse-runtime apps using CURRENT_ROLE() in row access policies will always return the app owner’s role, not the viewer’s role, because apps run with owner’s rights by default.

For more information and examples, see Row access policies in Streamlit in Snowflake.

In container runtimes, context functions on owner’s rights connections will return values from the owner role’s context and so are not appropriate for user-targeted row access policies. However, restricted caller’s rights connections return the viewer’s context. For more information, see Restricted caller’s rights and Streamlit in Snowflake.

仅限容器运行时：包存储库访问和安全性

为容器运行时配置一个或多个软件包索引。

容器运行时可以从外部存储库（例如 PyPI）安装软件包。您可以使用托管包索引（如 JFrog Artifactory）来管理软件包来源，或者使用默认软件包索引 PyPI。无论使用哪种软件包索引，都必须创建外部访问集成 (EAI)，以允许应用程序安装依赖项。

使用托管包索引具有以下优势：

  • 有助于防止供应链攻击，并确保软件包来自可信来源。
  • 允许您控制哪些软件包及其版本可供应用程序使用。
  • 它为软件包安装提供审计记录。

For more information about how developers use EAIs to manage dependencies, see Managing dependencies for container runtimes. For more information about setting up a managed package repository with authentication, see Example: Authenticate to a private JFrog Artifactory repository.

设置适用于应用程序开发者的 PyPI EAI

Container-runtime apps attempt to install dependencies from PyPI by default. Snowflake provides a managed network rule, SNOWFLAKE.EXTERNAL_ACCESS.PYPI_RULE, that allows egress to PyPI. You can use this rule to create a PyPI EAI without defining your own network rule. For more information about managed network rules, see Snowflake-managed egress network rules.

以下 SQL 命令使用 Snowflake 托管的网络规则创建 PyPI EAI，并将 USAGE 授予应用开发角色：

USE ROLE ACCOUNTADMIN;

CREATE OR REPLACE EXTERNAL ACCESS INTEGRATION pypi_access_integration
  ALLOWED_NETWORK_RULES = (snowflake.external_access.pypi_rule)
  ENABLED = true;

GRANT USAGE ON INTEGRATION pypi_access_integration TO ROLE app_developer_role;

仅限仓库运行时：外部产品条款

Warehouse runtimes use conda to manage your app’s dependencies. If you want to use Mapbox in your apps, you must acknowledge the External Offerings Terms.

For information about using this package, see Using third-party packages from Anaconda.

可用的安全功能

以下安全功能可用于增强应用程序的安全性和治理能力。

外部访问集成

控制应用程序可访问的外部网络和服务：

  • 创建网络规则以定义允许的端点，包括包索引。
  • 创建引用网络规则和身份验证密钥的外部访问集成。
  • 将外部访问集成分配给 Streamlit 应用程序。

可防止应用程序进行未经授权的出站连接，并提供外部访问的审计记录。

For more information, see External network access in Streamlit in Snowflake.

Git 集成

将 Streamlit 应用程序与 Git 仓库集成，实现版本控制和变更追踪：

  • 授予 Git 仓库对象（READ、WRITE 或 OWNERSHIP）的适当权限。
  • 使用 Git 集成记录代码变更的审计轨迹。
  • 在将变更部署到生产应用程序之前，执行代码审查流程。

For more information, see Sync Streamlit in Snowflake apps with a Git repository.

专用连接

For organizations with strict network security requirements, configure private connectivity to ensure all Streamlit traffic remains within your private network. Streamlit in Snowflake supports the following private connectivity options:

专用连接可消除对公共互联网的暴露，并提供额外的网络隔离。

For more information, see Private connectivity for Streamlit in Snowflake.

日志记录和跟踪

启用日志记录以监控应用程序行为并排除故障：

  • Configure an event table for your account. For more information, see Event table overview.
  • For warehouse runtimes, set appropriate log and trace levels for databases containing Streamlit apps. For more information, see Setting levels for logging, metrics, and tracing.
  • 定期查看日志，以发现安全事件、错误及异常行为。

对于容器运行时，Snowflake 会自动从容器中捕获标准输出和标准错误，并将它们存储在账户的事件表中。无需额外配置。

For more information, see Logging and tracing for Streamlit in Snowflake.

Limit a user’s access to only Streamlit in Snowflake

To restrict a user to only access Streamlit in Snowflake and prevent them from accessing other parts of Snowflake, an account administrator can add a custom user property via SQL or SCIM attribute.

  • To restrict a user, use the ALTER USER SQL command to set the ALLOWED_INTERFACES property to include STREAMLIT: 
    ALTER USER <user_name> SET ALLOWED_INTERFACES = (STREAMLIT);

If you’re provisioning users with SCIM APIs, you can set the same setting using the custom attribute allowedInterfaces. For more information about SCIM custom attributes, see SCIM user API reference.

After Streamlit-only access is configured, the user can’t access any part of Snowflake except the Streamlit in Snowflake apps for which they have permission. Additionally, they can only access the app-viewer URL for those apps. If a Streamlit-only user attempts to navigate anywhere in Snowflake, including any app-builder URL, it results in an access control error.

将应用程序查看者重定向到您的身份提供商

账户管理员可以配置所有应用程序查看器 URLs，以便在未经身份验证的查看者访问应用程序时重定向到您的身份提供商 (IdP)。此过程省去了用户登录流程中的一个步骤。

  • To redirect unauthenticated users from app-viewer URLs to your IdP, use the ALTER ACCOUNT SQL command to set the LOGIN_IDP_REDIRECT account property to include STREAMLIT: 
    ALTER ACCOUNT SET LOGIN_IDP_REDIRECT = (STREAMLIT = <your_security_integration>);

For a full overview of LOGIN_IDP_REDIRECT, including the procedure for reaching the Snowflake sign-in page when the IdP is unavailable, see Automatically redirecting users to your identity provider.

有关配置 Snowflake 账户以使用 IdP 的更多信息，请参阅以下主题：

管理员最佳实践

以下最佳实践可帮助维护安全的 Streamlit 环境。

使用专用角色和架构：

  • 为开发、测试和生产应用创建独立架构。
  • 为每个环境使用不同角色，以防止对生产应用的意外更改。
  • 将生产应用的所有权授予服务角色，而非单个用户账户。

实施最小权限访问：

  • 仅向每个角色授予所需的最低权限。
  • 定期审查并审计角色成员及权限。
  • 除非绝对必要，否则避免向应用所有者角色授予 ACCOUNTADMIN 或其他高权限角色。

管理应用生命周期：

  • 建立应用审批与部署流程。
  • 在将应用推广到生产环境前，需进行代码审查。
  • 记录访问敏感数据的应用，并对其进行额外审查。
  • 定期检查并删除未使用或已弃用的应用。

监控资源使用情况：

  • 为应用工作负载设置合适的仓库规模。
  • 监控计算成本，并针对异常使用模式设置警报。
  • 对于容器运行时，请为计算池配置合适的 MIN_NODES 和 MAX_NODES 设置。
  • 为不同应用环境使用独立仓库，以隔离成本和资源。

For more information about resource management, see Managing costs for Streamlit in Snowflake and Runtime environments for Streamlit apps.

使用安全的应用程序开发实践：

  • 切勿将凭据或 API 密钥直接嵌入应用程序代码中。
  • 使用 Snowflake 密钥存储敏感信息。
  • 验证并清理用户输入，以防止 SQL 注入攻击。
  • 通过应用程序公开的数据应仅限于查看者所需查看的内容。
  • 在与更广泛的用户共享应用程序之前，请进行彻底测试。

For more information about owner’s rights security considerations, see Owner’s rights and app security.

定期执行安全审计：

  • 检查哪些角色拥有 CREATE STREAMLIT 权限。
  • 审计各应用程序访问的数据源。
  • 检查外部访问集成及网络规则。
  • 检查前员工或非活跃账户拥有的应用程序。
  • 检查 Git 仓库访问权限及提交历史。

使用以下查询来审计您的 Streamlit 应用程序：

-- List all Streamlit apps and their owners
SHOW STREAMLITS;

-- Check privileges on a specific app
SHOW GRANTS ON STREAMLIT streamlit_db.apps.my_app;

-- List all roles with CREATE STREAMLIT privileges
SHOW GRANTS OF CREATE STREAMLIT;