Snowflake account usage views are system views that record metadata about activity, resource consumption, and configuration within a Snowflake account. They are queried for auditing, monitoring, and charge analysis, and they help security teams review usage patterns, access behaviour, and administrative changes.
What the views are for in practice
Snowflake account usage views are not application data tables, they are operational evidence. Teams use them to understand what happened in an account, who did it, what was consumed, and which configuration changes may explain a cost spike, access anomaly, or security event.
The practical value is that the views create a shared audit trail across administration, workload activity, and billing-style analysis. That makes them useful for both finance and security teams, especially when usage patterns need to be tied back to specific users, roles, sessions, or jobs.
What they typically show
These views usually expose metadata rather than business content. The useful signals are activity history, warehouse and query consumption, login or access patterns, role and privilege changes, object usage, and other account-level events that help reconstruct behaviour over time.
Because they are system views, they are best thought of as a reporting surface over the platform itself. They help answer questions such as whether a workload ran unusually, whether an admin change landed unexpectedly, or whether a resource was accessed in a way that does not match the normal operating pattern.
Why they matter for audit and monitoring
Account usage views are often the first place analysts look when they need to correlate control signals. They can connect suspicious access behaviour with administrative action, or connect cost growth with a specific team, query pattern, or integration path.
They also support after-the-fact review. When an investigation starts late, usage views can still help reconstruct scope, timing, and sequence, which is especially important for cloud data platforms where several layers of access and automation may be involved in one event.
In Snowflake-focused operational work, strong monitoring usually pairs these views with broader account review, and NHIMG’s Snowflake Security Guide is a useful companion for that wider control picture.
How to use them without over-reading them
Account usage views are powerful, but they are still metadata views, so they need context. A spike in usage may be legitimate batch processing, and an unusual login may be an approved service path, so the data should be interpreted alongside ownership, change records, and known workload schedules.
They are also a control input, not the control itself. The views help you detect, explain, and investigate behaviour, but they do not prevent misuse on their own. To get value from them, organisations need defined review ownership, baselines for normal activity, and a clear path from anomaly to investigation.
Risk and Threat Considerations
When account usage data is weakly reviewed, organisations can miss credential abuse, overbroad access, or unexpected administrative change inside the Snowflake account. The danger is not the views themselves, but the false confidence that logging exists even when nobody is actually analysing the signals.
Failure mechanism: Attackers or insiders can blend malicious access into ordinary platform activity, especially when they use legitimate accounts, approved roles, or scheduled jobs that look normal in isolation. If the review process is shallow, the usage trail becomes post-incident evidence instead of early warning.
Impact: Missed detections can lead to data exposure, prolonged dwell time, hidden cost abuse, and incomplete incident reconstruction. In a data platform, that can also obscure which identities, roles, or automations should be revoked or reset after compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Account usage views exist to be reviewed and correlated into actionable audit findings. |
| AU-12 — Audit Record Generation | The term describes generated account telemetry that supports reconstruction of activity and changes. | |
| Recommendation — Establish routine review of Snowflake usage logs and escalate anomalies through your audit workflow. Ensure Snowflake account events are captured at sufficient detail for investigation and charge analysis. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The views are an account telemetry source used for monitoring, investigation, and accountability. |
| Recommendation — Centralise, retain, and review Snowflake account usage telemetry as part of log management. | ||
| ISO/IEC 27001:2022 | A.8.15 — Logging | These system views provide logging evidence over account activity and administrative change. |
| Recommendation — Define which Snowflake usage records must be logged, retained, and reviewed for control evidence. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Usage views help spot excessive or abnormal access patterns by service-style accounts and automations. |
| Recommendation — Review Snowflake account usage for signs that non-human accounts have more access than they need. | ||
Practitioner Guidance
Why practitioners should care: Treat account usage views as an operational telemetry layer that needs ownership and routine review, not as passive background logging. The main governance question is whether someone is accountable for spotting deviations and following them through to action.
What to watch for: Focus on unexplained changes in query volume, administrative activity, warehouse consumption, access paths, or role usage that do not match approved workloads. The most valuable review is usually comparative, where current behaviour is checked against the account’s own normal pattern.
Practitioner takeaway: Use the views to support investigation and charge analysis, but anchor them to baselines, change records, and access governance if you want them to materially improve security.
Related resources from NHI Mgmt Group
- How should organisations account for AI usage in insider risk governance?
- What breaks when rate limits do not account for token usage in generative AI systems?
- How should security teams investigate service account key usage in Google Cloud?
- How do security and governance teams maintain control as AI usage expands across Snowflake and external LLMs?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org