This workflow queries Snowflake's account usage data weekly to identify enabled user accounts that have been inactive for over 90 days and posts the results to Slack. It helps data platform and security teams maintain access hygiene by surfacing dormant credentials before they become a security risk or audit finding. The read-only, automated approach eliminates the need for manual quarterly access reviews.

Data platform and security teams struggle to maintain clean access hygiene as Snowflake accounts accumulate over time — contractors roll off, employees change teams, and service accounts created for one-off projects never get cleaned up. Every dormant-but-enabled account represents an unmonitored credential that attackers could exploit, yet no one logs into Snowflake specifically to hunt for stale users, and manual quarterly access reviews routinely slip. This workflow delivers a standing, automated view of inactive accounts by querying SNOWFLAKE.ACCOUNT_USAGE.USERS every Monday at 09:00 UTC for enabled accounts with no successful login in over 90 days, then posting the list — name, last login, days inactive — directly into a designated Slack channel so the team can review and remediate without leaving their daily tools.

The workflow transforms sporadic, easily-deferred access reviews into a reliable weekly habit that arrives in the team's existing communication channel. Security and data infrastructure teams gain early visibility into dormant credentials, shrinking the attack surface before auditors or incidents force the issue. Because the workflow is read-only against Snowflake and only alerts when it finds inactive users, it runs safely unattended with zero maintenance overhead, tightening access hygiene and simplifying compliance without adding toil.