TheCloud Services Layeris responsible for Snowflake’s global security, coordination, and metadata management. It orchestrates all authentication and authorization processes, including username/password login, MFA, OAuth, SSO, key-pair authentication, and integration with enterprise identity providers. It also manages role-based access control (RBAC), privilege enforcement, session management, and secure query orchestration.
This layer centralizes encryption policy enforcement, including the management of Snowflake-managed and customer-managed encryption keys (Tri-Secret Secure). While all data stored and transmitted in Snowflake is encrypted by default, it is the Cloud Services Layer that handles the key lifecycle, rotation, and hierarchy.
The Compute Layer only runs queries.
The Storage Layer keeps compressed, encrypted columnar data but does not manage security controls.
The Query Processing Layer executes SQL but does not manage authentication or RBAC.
Thus, the Cloud Services Layer is the authoritative control plane for Snowflake security.
====================================================