Access history and audit logging in Snowflake - Mini Project: Build & Apply

Access History and Audit Logging in Snowflake

📖 Scenario: You are a data engineer working with Snowflake. Your manager wants you to track who accessed the data warehouse and what actions they performed. This helps keep the data safe and shows accountability.

🎯 Goal: You will create a query to view access history and audit logs in Snowflake. This will help you understand who accessed the system and what they did.

📋 What You'll Learn

Use the SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY view to get access records

Filter records by a specific user

Select important columns like USER_NAME, ACTION_NAME, and START_TIME

Order the results by START_TIME descending

💡 Why This Matters

🌍 Real World

Access history and audit logging help companies track who accessed their data and what actions were taken. This is important for security and compliance.

💼 Career

Data engineers and security analysts often write queries like this to monitor data warehouse usage and investigate suspicious activity.

1

Create a variable for the user name

Create a variable called user_name and set it to the string 'JOHN_DOE' to filter access history for this user.

Snowflake

# Create a variable called user_name and set it to 'JOHN_DOE'
# Your code here

Hint

Use = to assign the string 'JOHN_DOE' to the variable user_name.

2

Write the base query to select access history

Write a SQL query string called query that selects USER_NAME, ACTION_NAME, and START_TIME from SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY.

Snowflake

user_name = 'JOHN_DOE'
# Write a SQL query string called query to select USER_NAME, ACTION_NAME, START_TIME from SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY
# Your code here

Hint

Use double quotes to create the SQL query string and select the three columns from the access history view.

3

Add a WHERE clause to filter by user and order results

Update the query string to add a WHERE USER_NAME = '{user_name}' clause using an f-string, and order the results by START_TIME in descending order.

Snowflake

user_name = 'JOHN_DOE'
query = "SELECT USER_NAME, ACTION_NAME, START_TIME FROM SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY"
# Update query to filter by user_name and order by START_TIME DESC
# Your code here

Hint

Use an f-string to insert the variable user_name inside the SQL query string.

4

Print the final query string

Write a print statement to display the query string.

Snowflake

user_name = 'JOHN_DOE'
query = f"SELECT USER_NAME, ACTION_NAME, START_TIME FROM SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY WHERE USER_NAME = '{user_name}' ORDER BY START_TIME DESC"
# Print the query string
# Your code here

Hint

Use print(query) to show the final SQL query string.

Practice

1. What does the ACCESS_HISTORY view in Snowflake primarily provide?

easy

A. Information about who accessed data and when

B. Details about Snowflake account billing

C. List of all database tables and schemas

D. Performance metrics of queries

Solution

1. Step 1: Understand the purpose of ACCESS_HISTORY

   The ACCESS_HISTORY view records user activity related to data access in Snowflake.

2. Step 2: Identify what ACCESS_HISTORY tracks

   It tracks who accessed what data and when, useful for audit and compliance.

3. Final Answer:

   Information about who accessed data and when -> Option A

4. Quick Check:

   ACCESS_HISTORY = Data access logs [OK]

Hint: ACCESS_HISTORY logs user data access events only [OK]

Common Mistakes:

• Confusing ACCESS_HISTORY with billing or performance views
• Thinking it shows database structure
• Assuming it tracks query performance

2. Which of the following is the correct syntax to query the ACCESS_HISTORY view for all accesses in the last 7 days?

easy

A. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME = CURRENT_DATE - 7;

B. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME < CURRENT_DATE + 7;

C. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7;

D. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME BETWEEN CURRENT_DATE AND CURRENT_DATE + 7;

Solution

1. Step 1: Understand date filtering in Snowflake SQL

   To get records from the last 7 days, filter where ACCESS_TIME is greater than current date minus 7 days.

2. Step 2: Check each option's date condition

   SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7; correctly uses ACCESS_TIME > CURRENT_DATE - 7 to get recent records.

3. Final Answer:

   SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7; -> Option C

4. Quick Check:

   Date filter for last 7 days = SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7; [OK]

Hint: Use > CURRENT_DATE - 7 for last 7 days filter [OK]

Common Mistakes:

• Using < instead of > for recent dates
• Using = which matches only one day
• Using BETWEEN with future dates incorrectly

3. What will be the result of this query?

SELECT USER_NAME, COUNT(*) AS ACCESS_COUNT
FROM ACCESS_HISTORY
WHERE OBJECT_NAME = 'CUSTOMERS'
GROUP BY USER_NAME
ORDER BY ACCESS_COUNT DESC
LIMIT 3;

medium

A. All users who accessed any object named CUSTOMERS

B. An error because OBJECT_NAME is not a valid column

C. The total number of accesses to all objects

D. Top 3 users who accessed the CUSTOMERS object most frequently

Solution

1. Step 1: Analyze the query components

   The query counts accesses per user filtered by OBJECT_NAME = 'CUSTOMERS'.

2. Step 2: Understand GROUP BY and ORDER BY

   It groups by USER_NAME, orders by count descending, and limits to top 3 users.

3. Final Answer:

   Top 3 users who accessed the CUSTOMERS object most frequently -> Option D

4. Quick Check:

   GROUP BY USER_NAME with LIMIT 3 = Top 3 users who accessed the CUSTOMERS object most frequently [OK]

Hint: GROUP BY user and LIMIT 3 shows top 3 users [OK]

Common Mistakes:

• Thinking it lists all users without limit
• Assuming OBJECT_NAME is invalid
• Confusing total accesses with per-user counts

4. You run this query but get an error:

SELECT * FROM ACCESS_HISTORY WHERE USER = 'JOHN';

What is the likely cause and fix?

medium

A. Column USER does not exist; use USER_NAME instead

B. ACCESS_HISTORY view is not accessible to your role

C. Syntax error due to missing semicolon

D. USER is a reserved keyword; enclose in double quotes

Solution

1. Step 1: Check column names in ACCESS_HISTORY

   The correct column for user is USER_NAME, not USER.

2. Step 2: Correct the query column name

   Replace USER with USER_NAME to fix the error.

3. Final Answer:

   Column USER does not exist; use USER_NAME instead -> Option A

4. Quick Check:

   Use USER_NAME column, not USER [OK]

Hint: Use USER_NAME, not USER, as column name [OK]

Common Mistakes:

• Using USER instead of USER_NAME
• Assuming missing semicolon causes error
• Thinking ACCESS_HISTORY is inaccessible

5. You want to audit all SELECT queries on the SALES table in the last 30 days. Which query correctly retrieves this from ACCESS_HISTORY?

hard

A. SELECT QUERY_TEXT, USER_NAME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'INSERT' AND ACCESS_TIME > CURRENT_DATE - 30;

B. SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30;

C. SELECT * FROM ACCESS_HISTORY WHERE TABLE_NAME = 'SALES' AND QUERY_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30;

D. SELECT QUERY_TEXT, USER_NAME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TIME < CURRENT_DATE - 30;

Solution

1. Step 1: Identify correct column names and filters

   ACCESS_HISTORY uses OBJECT_NAME for table, ACCESS_TYPE for operation, and ACCESS_TIME for timestamp.

2. Step 2: Check filter conditions for SELECT and last 30 days

   SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30; filters OBJECT_NAME = 'SALES', ACCESS_TYPE = 'SELECT', and ACCESS_TIME > CURRENT_DATE - 30 correctly.

3. Final Answer:

   SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30; -> Option B

4. Quick Check:

   Correct columns and filters = SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30; [OK]

Hint: Filter by OBJECT_NAME, ACCESS_TYPE, and recent ACCESS_TIME [OK]

Common Mistakes:

• Using TABLE_NAME or QUERY_TYPE which don't exist
• Filtering for INSERT instead of SELECT
• Using ACCESS_TIME < CURRENT_DATE - 30 (old data)