Sign Up
Docs
All Guides

Step-by-step Atlas walkthroughs

Databases

Database-specific Atlas guides

Setting up CI/CD

Wire Atlas into your pipeline

ORMs and Frameworks

Integrate Atlas with any ORM

Shift Left Database Security

Roles, permissions, and policies as code

Seed Data as Code

Lookup tables and reference data

Deploying on Kubernetes

Run via the Atlas Operator

Terraform Provider

Manage schemas via Terraform

Database Governance

End-to-end control and compliance

Schema Drift Detection

Block drift before and after deploys

AI-Safe Database Changes

Safe schema changes at machine speed

Modernize Schema Migrations

Apply modern CI/CD to schema changes

Standardize Schema Migrations

One migration tool to rule them all

Database per tenant

Manage thousands of databases as one

PRICING
Sign InSign Up
Back to changelog
New
•2 minute read

Snowflake: Network Rules

Atlas now manages Snowflake network rules as a schema object. Declare the type, mode, and value list in HCL or SQL, and Atlas inspects, diffs, and plans them with CREATE, ALTER, and DROP NETWORK RULE.

A network rule is a schema-level object holding a list of network identifiers, IP ranges, private endpoints, or host and port pairs, that a network policy or an external access integration then allows or blocks. Atlas now manages its full lifecycle: rules are inspected, diffed, and planned like any other schema object.

Declaring a Network Rule

The new network_rule block takes a type, a mode, and an optional value_list and comment:

network_rule "allowed_ips" {  schema     = schema.public  type       = IPV4  mode       = INGRESS  value_list = ["192.168.1.0/24", "10.0.0.1"]  comment    = "office network"}
network_rule "outbound" {  schema = schema.public  type   = HOST_PORT  mode   = EGRESS}
  • type is one of IPV4, IPV6, AWSVPCEID, AZURELINKID, GCPPSCID, HOST_PORT, PRIVATE_HOST_PORT, or COMPUTE_POOL.
  • mode is one of INGRESS, INTERNAL_STAGE, SNOWFLAKE_MANAGED_STORAGE_VOLUME, EGRESS, DATA_CONNECTIVITY_PROXY_EGRESS, POSTGRES_INGRESS, or POSTGRES_EGRESS. Which modes a type accepts is decided by Snowflake, since the combinations depend on the cloud provider hosting the account.
  • value_list may be omitted, which creates the rule with an empty list.

Generated SQL

migration.sql
-- Create network rule "allowed_ips"CREATE NETWORK RULE "public"."allowed_ips" TYPE = IPV4  VALUE_LIST = ('192.168.1.0/24', '10.0.0.1') MODE = INGRESS COMMENT = 'office network';-- Create network rule "outbound"CREATE NETWORK RULE "public"."outbound" TYPE = HOST_PORT VALUE_LIST = () MODE = EGRESS;

The value list and the comment are changed in place. Everything else is fixed at creation time, so a change to type or mode is planned as a drop and a create. Every statement carries its inverse, so migrate down works.

migration.sql
-- Modify network rule "allowed_ips"ALTER NETWORK RULE "public"."allowed_ips" SET VALUE_LIST = ('2.2.2.2', '3.3.3.3') COMMENT = 'new';-- Modify network rule "outbound"ALTER NETWORK RULE "public"."outbound" UNSET COMMENT;

Inspection

Snowflake has no INFORMATION_SCHEMA view for network rules, and SHOW NETWORK RULES reports only the size of the value list, not its contents. Atlas describes every rule the SHOW returns and unions the DESCRIBE outputs through RESULT_SCAN, so a whole database is read in a single round trip and an existing account round-trips into HCL.

Getting Started

Network rules are opt-in. Enable them in the mode "snowflake" block of your env:

atlas.hcl
env "snow" {  schema {    mode "snowflake" {      network_rules = true    }  }}

Snowflake support is part of Atlas Pro. Run atlas login to get started.

featuresnowflakenetwork-rulesecuritydeclarative
Back to changelog