# US 2021/0344677 A1 · Auditing for remotely stored credentials > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344677 A1 - Document ID: US20210344677A1 - Status: Published application - Kind: A1 - Application number: 17/241,476 - Filed: 2021-04-27 - Published: 2021-11-04 - Earliest claimed: 2020-04-29 - Assignees: Snowflake Inc. - Applicants: Snowflake Inc. - Inventors: Derek Denny-Brown; Tyler Jones; Isaac Kunen - Web page: https://patentgrep.com/patent/US20210344677A1 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - G06F 21/31: User authentication - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/10: {for controlling access to devices or network resources} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A credentials store definition identifying a remote credential store is received. The credential store definition includes access information to enable access to the remote credentials store. A credentials object is created in an internal database based on a credentials object definition. The credentials object identifies a security credential to retrieve from the remote credentials store to access an external resource. At runtime, a request to access the external resource is received, and based on receiving the request, the security credentials identified by the credentials object are retrieved from the remote credential store using the access information. The retrieved security credential is provided to a processing component to access the external resource. ## Claims ### Claim 1 A system comprising: at least one hardware processor; and at least one memory storing instructions that cause the at least one hardware processor to perform operations comprising: receiving a request to access an external resource; in response to receiving the request, retrieving, from a remote credential store in a cloud credential store provider system that is external to the system, a security credential associated with the external resource using stored access information associated with the cloud credential store provider system; providing the security credential to a processing component for use in accessing the external resource; and generating a record, in an internal database of the system, based on use of the security credential by the processing component to access the external resource, the record including a first identifier corresponding to a cloud credential store provider that maintains the remote credential store, and a second identifier corresponding to an entity associated with the request. ### Claim 2 (depends on 1) The system of claim 1, wherein retrieving the security credential further comprises: using the access information to assume a proxy identity within the external system that has associated permissions to retrieve the security credential from the remote credential store. ### Claim 3 (depends on 1) The system of claim 1, wherein the operations further comprise: accessing a credential object associated with the external resource to identify the security credential to retrieve to access the external resource; and accessing a credential store definition that includes the access information associated with the cloud credential store provider system. ### Claim 4 (depends on 3) The system of claim 3, wherein the operations further comprise: creating, in the internal database, the credential object based on a credential object definition, the credential object including an identifier of the security credential. ### Claim 5 (depends on 3) The system of claim 3, wherein the operations further comprise: setting one or more usage permissions associated with the credential object. ### Claim 6 (depends on 5) The system of claim 5, wherein the one or more usage permissions associated with the credential object include at least one constraint on the use of the security credential. ### Claim 7 (depends on 5) The system of claim 5, wherein the operations further comprise: verifying the one or more usage permissions of an entity associated with the request before retrieving the security credential. ### Claim 8 (depends on 7) The system of claim 7, wherein the verifying of the one or more usage permissions includes: verifying that the entity has permission to use the credential object. ### Claim 9 (depends on 5) The system of claim 5, wherein: the setting of the one or more usage permissions associated with the credential object comprises granting permission to a user, role, or function to use the security credential associated with the credential object. ### Claim 10 (depends on 4) The system of claim 4, wherein the operations further comprise receiving the credential object definition comprising the identifier of the security credential to retrieve from the remote credential store. ### Claim 11 (depends on 1) The system of claim 1, further comprising: one or more execution nodes, wherein providing the security credential to the processing component comprises providing the security credential to the one or more execution nodes, wherein the one or more execution nodes store the security credential in volatile memory. ### Claim 12 (depends on 1) The system of claim 1, wherein the security credential comprises at least one of: a username and password. ### Claim 13 A method comprising: receiving a request to access an external resource; in response to receiving the request, retrieving, from a remote credential store in a cloud credential store provider system that is external to the system, a security credential associated with the external resource using stored access information associated with the cloud credential store provider system; providing the security credential to a processing component for use in accessing the external resource; and generating, by one or more hardware processors, a record, in an internal database of the system, based on use of the security credential by the processing component to access the external resource, the record including a first identifier corresponding to a cloud credential store provider that maintains the remote credential store, and a second identifier corresponding to an entity associated with the request. ### Claim 14 (depends on 13) The method of claim 13, wherein retrieving the security credential further comprises: using the access information to assume a proxy identity within the external system that has associated permissions to retrieve the security credential from the remote credential store. ### Claim 15 (depends on 13) The method of claim 13, further comprising: accessing a credential object associated with the external resource to identify the security credential to retrieve to access the external resource; and accessing a credential store definition that includes the access information associated with the cloud credential store provider system. ### Claim 16 (depends on 15) The method of claim 15, wherein the operations further comprise: creating, in the internal database, the credential object based on a credential object definition, the credential object including an identifier of the security credential. ### Claim 17 (depends on 15) The method of claim 15, wherein the operations further comprise: setting one or more usage permissions associated with the credential object, the one or more usage permissions including at least one constraint on the use of the security credential, wherein the setting of the one or more usage permissions associated with the credential object comprises granting permission to a user, role, or function to use the security credential associated with the credential object. ### Claim 18 (depends on 17) The method of claim 17, wherein the operations further comprise: verifying the one or more usage permissions of an entity associated with the request before retrieving the security credential. ### Claim 19 (depends on 13) The method of claim 13, wherein providing the security credential to the processing component comprises providing the security credential to one or more execution nodes, wherein the one or more execution nodes store the security credential in volatile memory. ### Claim 20 A computer-storage medium comprising instructions that, when executed by one or more processors of a machine, configure the machine to perform operations comprising: receiving a request to access an external resource; in response to receiving the request, retrieving, from a remote credential store in a cloud credential store provider system that is external to the system, a security credential associated with the external resource using stored access information associated with the cloud credential store provider system; providing the security credential to a processing component for use in accessing the external resource; and generating a record, in an internal database of the system, based on use of the security credential by the processing component to access the external resource, the record including a first identifier corresponding to a cloud credential store provider that maintains the remote credential store, and a second identifier corresponding to an entity associated with the request. ### Claim 21 (depends on 20) The computer-storage medium of claim 20, wherein retrieving the security credential further comprises: using the access information to assume a proxy identity within the external system that has associated permissions to retrieve the security credential from the remote credential store. ### Claim 22 (depends on 20) The computer-storage medium of claim 20, wherein the operations further comprise: accessing a credential object associated with the external resource to identify the security credential to retrieve to access the external resource; and accessing a credential store definition that includes the access information associated with the cloud credential store provider system. ### Claim 23 (depends on 22) The computer-storage medium of claim 22, wherein the operations further comprise: creating, in the internal database, the credential object based on a credential object definition, the credential object including an identifier of the security credential; and setting one or more usage permissions associated with the credential object, the one or more usage permissions including at least one constraint on the use of the security credential, wherein the setting of the one or more usage permissions associated with the credential object comprises granting permission to a user, role, or function to use the security credential associated with the credential object. ### Claim 24 (depends on 23) The computer-storage medium of claim 23, wherein the operations further comprise: verifying the one or more usage permissions of an entity associated with the request before retrieving the security credential.