Your most sensitive data is in Snowflake. How many people can query it?
PostQKey maps Snowflake role hierarchies, BigQuery IAM bindings, and Redshift grants. Surfaces tables with sensitive data that have broader access than they should.
Why warehouse access is hard to track manually.
Snowflake role hierarchies can have 10 or more levels of inheritance. A role granted VIEW access on a schema may inherit access to new tables added 18 months later. The analyst who needed one table for one project now has a path to every table added since.
PostQKey traverses the full role graph and shows effective access per identity: not just the explicit grants, but the inherited permissions that accumulate silently as schemas grow.
- Snowflake RBAC: full role hierarchy traversal
- BigQuery IAM: project, dataset, and table-level bindings
- Redshift: groups, roles, and schema-level grants
- Effective access computation, not just explicit grants
What PostQKey typically surfaces in warehouse environments.
| Finding | Details | Severity |
|---|---|---|
| 34 roles have SELECT on customer_pii schema | 18 of those roles have not queried it in 90 days. Access predates current team composition. | HIGH |
| Active Snowflake data share from 2024 | Originally shared with a partner account. Partner relationship ended. Share still active with no expiry set. | CRITICAL |
| Redshift cluster accessible from broad CIDR | Security group allows inbound 5439 from 10.0.0.0/8, which includes developer laptop subnet and guest WiFi range. | HIGH |
| BigQuery dataset with domain-wide viewer | analytics-prod dataset has allUsers on a schema that contains exported customer records from 2024 ETL run. | CRITICAL |
These are representative patterns from real DSPM deployments, not guaranteed findings. Your warehouse access history will be specific to your team's growth and offboarding practices. PostQKey surfaces the finding. It does not modify access, delete roles, or revoke grants. Remediation is always a human decision.
Map your warehouse access.
Connect your Snowflake account with read-only credentials. Access graph ready in under 24 hours.