Changes / Warehouses & lakehouses / Snowflake
End of supportmedium impact
Snowflake: new service users can no longer use passwords (LEGACY_SERVICE blocked)
After enforcement, new non-human users must be TYPE=SERVICE, and LEGACY_SERVICE is invalid in CREATE USER or ALTER USER.
Who’s affected
Snowflake accounts that create or alter non-human users (pipelines, ETL/ELT tools, BI connectors, scripts) as LEGACY_SERVICE or with password auth. After your account's enforcement date, new non-human users must be TYPE=SERVICE.
Not affected: Accounts that only use human users, or whose service users are already TYPE=SERVICE with key-pair or other strong authentication, and that create no new LEGACY_SERVICE users.
What it costs
No price change in the record. The cost is engineering effort: reworking user provisioning and rotating credentials in each tool that connects with a password.
When to act
Enforcement is rolling from May to July 2026 and already started, so start now by finding your account's notified date and the tools that still depend on password-based service users.
Blast radius: Provisioning scripts and Terraform that create service users will fail on CREATE USER or ALTER USER. Pipelines, dbt jobs, BI connectors and scheduled scripts that authenticate with a password may need new key-based credentials and secret updates.
What should you do? decision tree
- you don't know your account's enforcement dateCheck the notification Snowflake sent to your account admins and confirm the date, since dates are subject to change.
- your IaC, Terraform or provisioning scripts run CREATE USER or ALTER USER with LEGACY_SERVICEChange them to TYPE=SERVICE with strong authentication (e.g. key-pair) and test in a non-production account.
- third-party tools (ETL, BI, orchestration) connect with a password-based service userCheck each vendor's support for key-pair or other strong auth and plan a credential swap per tool.
- existing LEGACY_SERVICE users are not yet blocked and you only need to keep them runningInventory them now and schedule migration to TYPE=SERVICE so any later ALTER USER change doesn't fail.
- A tool can't support non-password auth for service usersEscalate to the vendor with a deadline, and consider replacing or isolating that connector.
Options
- OptimizeInventory all non-human users and flag LEGACY_SERVICE or password-auth ones using SHOW USERS and login history.
- OptimizeUpdate CREATE USER and ALTER USER templates to TYPE=SERVICE with key-pair auth; rotate keys through your secrets manager.
- Re-architectMove service credentials into a secrets manager and adopt per-tool service users so each integration can be migrated and revoked on its own.
- WaitIf you create no new service users, existing ones are unaffected for now; still plan the migration before you next touch them.
The facts straight from the source
Facts above are extracted from the source and checked word-for-word before publishing. The guidance sections are AI-assisted analysis based only on those facts: a starting point, not legal or procurement advice. Spotted an error? Tell us.
Related changes
- SnowflakeSnowpipe switches to a flat 0.0037 credits per GB
Snowpipe billing switches from per-second/per-core compute plus per-1,000-files fee to a fixed 0.0037 credits per GB ingested, applied automatically.
Billing - SnowflakeSnowflake signs agreement to acquire Observe
Snowflake announced a signed definitive agreement to acquire Observe, an AI-powered observability vendor, pending regulatory approval.
M&A - Amazon RedshiftAmazon Redshift DC2 nodes retired April 23, 2026
DC2 node type feature development stops at release P191, and DC2 clusters retire on April 23, 2026 on the LTM track; customers should move to Serverless or RA3.
End of support - SnowflakeSnowflake blocks password sign-in for all remaining legacy service users
Non-human users are blocked from password authentication, and existing LEGACY_SERVICE users are migrated to TYPE=SERVICE.
End of support - SAPSAP BW 7.5 mainstream maintenance ends
Mainstream maintenance for SAP BW 7.5 ends December 31, 2027, with extended maintenance available through 2030.
End of support - SAPSAP BW 7.5 extended maintenance ends
Extended maintenance for SAP BW 7.5, BI Java based Broadcasting and BEx Query Designer ends December 31, 2030.
End of support