feat(snowflake): OAuth user impersonation support

[Will Graham (wlggraham)]

Summary

• Adds optional JWT-based OAuth impersonation to the Snowflake plugin
• When enabled, jobs execute as the authenticated user (via X-Heimdall-User header) rather than the Heimdall service account
• Uses RS256-signed JWTs minted by Heimdall against a Snowflake External OAuth security integration
• default_role can be set at the command level and overridden per job via job context

Configuration

Cluster (non-impersonation — unchanged)

- name: snowflake-heimdall-wh
  status: active
  version: 0.0.1
  context:
    account: pattern
    user: heimdall__app_user
    database: iceberg_db
    warehouse: heimdall_wh
    private_key: /etc/pattern.d/snowflake_key.pem
  tags:
    - type:snowflake

Cluster (impersonation)

- name: snowflake-impersonate-wh
  status: active
  version: 0.0.1
  context:
    account: pattern
    database: iceberg_db
    warehouse: heimdall_wh
    impersonate_user: true
    oauth_private_key: /etc/pattern.d/heimdall_oauth_private_key.pem
    oauth_issuer: heimdall         # must match EXTERNAL_OAUTH_ISSUER in Snowflake
    oauth_audience: https://pattern.snowflakecomputing.com
  tags:
    - type:snowflake-impersonate

Command

- name: snowflake-impersonate-0.0.1
  status: active
  plugin: snowflake
  version: 0.0.1
  description: Run a Snowflake query as the authenticated user
  context:
    default_role: PUBLIC   # overridable per job via context.role
  tags:
    - type:snowflake-impersonate
  cluster_tags:
    - type:snowflake-impersonate

Job submission

{
  "command_criteria": ["type:snowflake-impersonate"],
  "cluster_criteria": ["type:snowflake-impersonate"],
  "context": {
    "query": "SELECT CURRENT_USER(), CURRENT_ROLE()",
    "role": "optional_role_override"
  }
}

TODOs / Open Questions

• Confirm oauth_issuer value matches EXTERNAL_OAUTH_ISSUER configured on the production Snowflake security integration
• Add oauth_private_key, oauth_issuer, oauth_audience to production config (/etc/pattern.d/)
• Decide whether to add the impersonation cluster to test_local.yaml for prod config reference
• Token expiry is hardcoded to 1 hour — make configurable?
• Healthcheck for impersonation clusters currently uses the same key-pair path; should it use a separate check?

🤖 Generated with Claude Code

[wiz-55ccc8b716]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	1
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.