docs: add skill for auditing Snowflake password users - #118
Open
jirkasemmler wants to merge 1 commit into
Open
Conversation
We have run this audit four times now (Carvago SUPPORT-16608, SLSP DMD-1565, Shoptet DMD-1929, FL Service DMD-1992) and the same things went wrong more than once, so the judgement is worth writing down rather than rediscovering. The central part is the component-lifecycle table. Whether a surviving workspace is our leftover or the customer's infrastructure depends on the component, not on whether it is a sandbox and not on how many workspaces its configuration owns: transformation workspaces are per-run and a survivor is a leftover, whereas a writer's staging workspace is permanent and dropping it breaks the writer. Both of those were got wrong in DMD-1992 before the data settled it. Also records the traps: a dump filtered to TYPE = 'LEGACY_SERVICE' makes absence meaningless, a tight cluster of user creation dates is a backend migration that truncates login history, and LAST_SUCCESS_LOGIN says nothing about a staging workspace because the unload runs as the storage role. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes:
.claude/skills/auditing-snowflake-password-users/capturing the workspace audit we have now run four times (Carvago SUPPORT-16608, SLSP DMD-1565, Shoptet DMD-1929, FL Service DMD-1992).What it actually encodes, beyond the happy path:
TYPE = 'LEGACY_SERVICE'makes absence meaningless (a missing workspace is on another auth type, not an orphan). A tight cluster of user creation dates is a backend migration re-provisioning them, which truncates login history - so "never logged in" means "unused since then".LAST_SUCCESS_LOGINsays nothing about a staging workspace, because the unload runs as the storage role.loginTypealone still answers the deprecation question, with a table of what is lost and what replaces it.Two things a reviewer should know:
loginTypefrommanage:describe-organization-workspacesas the backbone, and especially so in the no-Snowflake-access branch. That column only exists once feat: report workspaceId, backend and loginType in the organization workspace report #116 lands. Merge that first.writing-skillsmethodology wants baseline pressure scenarios run against fresh agents before the skill is written, to see how they fail without it. That was not done here - this is written from what we hit in practice. So it is a good starting point rather than a verified one, particularly the lifecycle table, which is exactly where I made both mistakes myself.Additional notes
Docs only - no PHP touched, so no effect on the pre-existing phpstan failures on
main.🤖 Generated with Claude Code