Snowflake’s Cortex AI Gateway reaches Azure and Google Cloud—but its default access deserves a review

Snowflake has expanded Cortex AI Gateway to accounts in Microsoft Azure and Google Cloud commercial regions, plus AWS Asia Pacific (New Zealand). The first-party release note is short, but the linked product documentation makes the operational consequence clearer: more Snowflake accounts can now put coding agents, third-party clients and SDKs behind one governed inference endpoint. Snowflake release note

Availability is not the same as a secure default

Snowflake automatically provisions one gateway object named SNOWFLAKE per account. Its documentation says USAGE is granted to PUBLIC by default, allowing roles to send traffic without extra gateway setup; administrators can revoke that privilege when they want a narrower boundary. Gateway access does not grant model access by itself—the caller still needs the underlying model privileges—but it does determine who can use the governed route. Snowflake gateway documentation

That distinction matters for platform teams rolling the gateway into existing agent deployments. The practical review is two-part: verify model entitlements, then separately decide which roles should retain gateway USAGE. Snowflake exposes MONITOR as a distinct privilege for reading usage data without sending inference requests. Snowflake gateway documentation

Logging has its own data boundary

The gateway can record request metadata including caller, model, token counts and timing. Prompt and response bodies are not captured unless payload capture is explicitly enabled. Snowflake warns that the trace table becomes sensitive when request-and-response capture is on. The configuration is replaced as a whole rather than patched field by field, so omitted fields return to defaults when an administrator submits an updated specification. Snowflake gateway documentation

For teams adopting the newly available regions, the rollout checklist is therefore broader than changing an endpoint: inspect the generated gateway, remove default PUBLIC access if it is too broad, separate send and monitor roles, confirm model-level permissions, and choose whether operational debugging justifies retaining prompts and responses. The release expands where the control plane is available; it does not make those policy choices on the customer’s behalf. Snowflake release note Snowflake gateway documentation