{"id":21514833,"url":"https://github.com/getindata/terraform-snowflake-database-role","last_synced_at":"2026-01-03T22:41:51.675Z","repository":{"id":248498486,"uuid":"774325845","full_name":"getindata/terraform-snowflake-database-role","owner":"getindata","description":"Terraform Database role module for Snowflake","archived":false,"fork":false,"pushed_at":"2025-01-07T13:19:30.000Z","size":38,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-01-24T02:30:19.426Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/getindata.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-03-19T10:59:54.000Z","updated_at":"2025-01-07T13:19:13.000Z","dependencies_parsed_at":"2024-07-31T16:28:29.496Z","dependency_job_id":"909109d4-6e9a-4857-8682-3c93f958a13e","html_url":"https://github.com/getindata/terraform-snowflake-database-role","commit_stats":null,"previous_names":["getindata/terraform-snowflake-database-role"],"tags_count":6,"template":false,"template_full_name":"getindata/terraform-module-template","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getindata%2Fterraform-snowflake-database-role","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getindata%2Fterraform-snowflake-database-role/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getindata%2Fterraform-snowflake-database-role/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getindata%2Fterraform-snowflake-database-role/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/getindata","download_url":"https://codeload.github.com/getindata/terraform-snowflake-database-role/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244066190,"owners_count":20392407,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-23T23:53:08.772Z","updated_at":"2026-01-03T22:41:51.668Z","avatar_url":"https://github.com/getindata.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Snowflake Database Role Terraform Module\n\n![Snowflake](https://img.shields.io/badge/-SNOWFLAKE-249edc?style=for-the-badge\u0026logo=snowflake\u0026logoColor=white)\n![Terraform](https://img.shields.io/badge/terraform-%235835CC.svg?style=for-the-badge\u0026logo=terraform\u0026logoColor=white)\n\n![License](https://badgen.net/github/license/getindata/terraform-snowflake-database-role/)\n![Release](https://badgen.net/github/release/getindata/terraform-snowflake-database-role/)\n\n\u003cp align=\"center\"\u003e\n  \u003cimg height=\"150\" src=\"https://getindata.com/img/logo.svg\"\u003e\n  \u003ch3 align=\"center\"\u003eWe help companies turn their data into assets\u003c/h3\u003e\n\u003c/p\u003e\n\n---\n\nTerraform module for managing Snowflake Database roles.\n\n- Creates Snowflake database role with specific privileges on database and schemas.\n- Allows granting of privileges on future schemas in a database.\n- Allows granting of privileges on all existing schemas in a database.\n- Allows granting of privileges on specific schema objects like tables.\n- Supports granting of all privileges or specific ones based on the configuration.\n- Can be used to create a hierarchy of roles by assigning parent roles.\n- Can be used to grant roles to other roles.\n\n## USAGE\n\n```terraform\nresource \"snowflake_database\" \"this\" {\n  name = \"TEST_DB\"\n}\n\nresource \"snowflake_schema\" \"this\" {\n  database = snowflake_database.this.name\n  name     = \"BRONZE\"\n}\n\nmodule \"snowflake_database_role\" {\n  source = \"../../\"\n\n  database_name = snowflake_database.this.name\n  name          = \"TEST_DB_ROLE\"\n\n\n  schema_grants = [\n    {\n      future_schemas_in_database = true\n      all_schemas_in_database    = true\n      all_privileges             = true\n    },\n  ]\n\n  schema_objects_grants = {\n    \"TABLE\" = [\n      {\n        all_privileges = true\n        on_future      = true\n        on_all         = true\n        schema_name    = snowflake_schema.this.name\n      }\n    ]\n  }\n}\n```\n\n## EXAMPLES\n\n- [Simple](examples/simple) - Basic usage of the module\n- [Complete](examples/complete) - Advanced usage of the module\n\n## Breaking changes in v2.x of the module\n\nDue to replacement of nulllabel (`context.tf`) with context provider, some **breaking changes** were introduced in `v2.0.0` version of this module.\n\nList od code and variable (API) changes:\n\n- Removed `context.tf` file (a single-file module with additonal variables), which implied a removal of all its variables (except `name`):\n  - `descriptor_formats`\n  - `label_value_case`\n  - `label_key_case`\n  - `id_length_limit`\n  - `regex_replace_chars`\n  - `label_order`\n  - `additional_tag_map`\n  - `tags`\n  - `labels_as_tags`\n  - `attributes`\n  - `delimiter`\n  - `stage`\n  - `environment`\n  - `tenant`\n  - `namespace`\n  - `enabled`\n  - `context`\n- Remove support `enabled` flag - that might cause some backward compatibility issues with terraform state (please take into account that proper `move` clauses were added to minimize the impact), but proceed with caution\n- Additional `context` provider configuration\n- New variables were added, to allow naming configuration via `context` provider:\n  - `context_templates`\n  - `name_schema`\n\n## Breaking changes in v3.x of the module\n\nDue to rename of Snowflake terraform provider source, all `versions.tf` files were updated accordingly.\n\nPlease keep in mind to mirror this change in your own repos also.\n\nFor more information about provider rename, refer to [Snowflake documentation](https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/SNOWFLAKEDB_MIGRATION.md).\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n\n\n\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_comment\"\u003e\u003c/a\u003e [comment](#input\\_comment) | Database Role description | `string` | `null` | no |\n| \u003ca name=\"input_context_templates\"\u003e\u003c/a\u003e [context\\_templates](#input\\_context\\_templates) | Map of context templates used for naming conventions - this variable supersedes `naming_scheme.properties` and `naming_scheme.delimiter` configuration | `map(string)` | `{}` | no |\n| \u003ca name=\"input_database_grants\"\u003e\u003c/a\u003e [database\\_grants](#input\\_database\\_grants) | Grants on a database level | \u003cpre\u003eobject({\u003cbr/\u003e    all_privileges    = optional(bool)\u003cbr/\u003e    with_grant_option = optional(bool, false)\u003cbr/\u003e    privileges        = optional(list(string), null)\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_database_name\"\u003e\u003c/a\u003e [database\\_name](#input\\_database\\_name) | The name of the database to create the role in | `string` | n/a | yes |\n| \u003ca name=\"input_granted_database_roles\"\u003e\u003c/a\u003e [granted\\_database\\_roles](#input\\_granted\\_database\\_roles) | Database Roles granted to this role | `list(string)` | `[]` | no |\n| \u003ca name=\"input_granted_to_database_roles\"\u003e\u003c/a\u003e [granted\\_to\\_database\\_roles](#input\\_granted\\_to\\_database\\_roles) | Fully qualified Parent Database Role name (`DB_NAME.ROLE_NAME`), to create parent-child relationship | `list(string)` | `[]` | no |\n| \u003ca name=\"input_granted_to_roles\"\u003e\u003c/a\u003e [granted\\_to\\_roles](#input\\_granted\\_to\\_roles) | List of Snowflake Account Roles to grant this role to | `list(string)` | `[]` | no |\n| \u003ca name=\"input_granted_to_shares\"\u003e\u003c/a\u003e [granted\\_to\\_shares](#input\\_granted\\_to\\_shares) | List of Snowflake Shares to grant this role to | `list(string)` | `[]` | no |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | Name of the resource | `string` | n/a | yes |\n| \u003ca name=\"input_name_scheme\"\u003e\u003c/a\u003e [name\\_scheme](#input\\_name\\_scheme) | Naming scheme configuration for the resource. This configuration is used to generate names using context provider:\u003cbr/\u003e    - `properties` - list of properties to use when creating the name - is superseded by `var.context_templates`\u003cbr/\u003e    - `delimiter` - delimited used to create the name from `properties` - is superseded by `var.context_templates`\u003cbr/\u003e    - `context_template_name` - name of the context template used to create the name\u003cbr/\u003e    - `replace_chars_regex` - regex to use for replacing characters in property-values created by the provider - any characters that match the regex will be removed from the name\u003cbr/\u003e    - `extra_values` - map of extra label-value pairs, used to create a name\u003cbr/\u003e    - `uppercase` - convert name to uppercase | \u003cpre\u003eobject({\u003cbr/\u003e    properties            = optional(list(string), [\"environment\", \"name\"])\u003cbr/\u003e    delimiter             = optional(string, \"_\")\u003cbr/\u003e    context_template_name = optional(string, \"snowflake-database-role\")\u003cbr/\u003e    replace_chars_regex   = optional(string, \"[^a-zA-Z0-9_]\")\u003cbr/\u003e    extra_values          = optional(map(string))\u003cbr/\u003e    uppercase             = optional(bool, true)\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_parent_database_role\"\u003e\u003c/a\u003e [parent\\_database\\_role](#input\\_parent\\_database\\_role) | DEPRECATED variable - please use `granted_to_database_roles` instead | `string` | `null` | no |\n| \u003ca name=\"input_schema_grants\"\u003e\u003c/a\u003e [schema\\_grants](#input\\_schema\\_grants) | Grants on a schema level | \u003cpre\u003elist(object({\u003cbr/\u003e    all_privileges             = optional(bool)\u003cbr/\u003e    with_grant_option          = optional(bool, false)\u003cbr/\u003e    privileges                 = optional(list(string), null)\u003cbr/\u003e    all_schemas_in_database    = optional(bool, false)\u003cbr/\u003e    future_schemas_in_database = optional(bool, false)\u003cbr/\u003e    schema_name                = optional(string, null)\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_schema_objects_grants\"\u003e\u003c/a\u003e [schema\\_objects\\_grants](#input\\_schema\\_objects\\_grants) | Grants on a schema object level\u003cbr/\u003e\u003cbr/\u003e  Example usage:\u003cbr/\u003e\u003cbr/\u003e  schema\\_objects\\_grants = {\u003cbr/\u003e    \"TABLE\" = [\u003cbr/\u003e      {\u003cbr/\u003e        privileges  = [\"SELECT\"]\u003cbr/\u003e        object\\_name = snowflake\\_table.table\\_1.name\u003cbr/\u003e        schema\\_name = snowflake\\_schema.this.name\u003cbr/\u003e      },\u003cbr/\u003e      {\u003cbr/\u003e        all\\_privileges = true\u003cbr/\u003e        object\\_name    = snowflake\\_table.table\\_2.name\u003cbr/\u003e        schema\\_name    = snowflake\\_schema.this.name\u003cbr/\u003e      }\u003cbr/\u003e    ]\u003cbr/\u003e    \"ALERT\" = [\u003cbr/\u003e      {\u003cbr/\u003e        all\\_privileges = true\u003cbr/\u003e        on\\_future      = true\u003cbr/\u003e        on\\_all         = true\u003cbr/\u003e      }\u003cbr/\u003e    ]\u003cbr/\u003e  }\u003cbr/\u003e\u003cbr/\u003e  Note: If you don't provide a schema\\_name, the grants will be created for all objects of that type in the database.\u003cbr/\u003e        You can find a list of all object types [here](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/grant_privileges_to_database_role#object_type) | \u003cpre\u003emap(list(object({\u003cbr/\u003e    all_privileges    = optional(bool)\u003cbr/\u003e    with_grant_option = optional(bool)\u003cbr/\u003e    privileges        = optional(list(string))\u003cbr/\u003e    object_name       = optional(string)\u003cbr/\u003e    on_all            = optional(bool, false)\u003cbr/\u003e    schema_name       = optional(string)\u003cbr/\u003e    on_future         = optional(bool, false)\u003cbr/\u003e  })))\u003c/pre\u003e | `{}` | no |\n\n## Modules\n\nNo modules.\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_fully_qualified_name\"\u003e\u003c/a\u003e [fully\\_qualified\\_name](#output\\_fully\\_qualified\\_name) | Name of the database role in fully qualified format (\"DB\\_NAME\".\"ROLE\\_NAME\") |\n| \u003ca name=\"output_name\"\u003e\u003c/a\u003e [name](#output\\_name) | Name of the database role |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_context\"\u003e\u003c/a\u003e [context](#provider\\_context) | \u003e=0.4.0 |\n| \u003ca name=\"provider_snowflake\"\u003e\u003c/a\u003e [snowflake](#provider\\_snowflake) | \u003e= 0.97 |\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.3 |\n| \u003ca name=\"requirement_context\"\u003e\u003c/a\u003e [context](#requirement\\_context) | \u003e=0.4.0 |\n| \u003ca name=\"requirement_snowflake\"\u003e\u003c/a\u003e [snowflake](#requirement\\_snowflake) | \u003e= 0.97 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [snowflake_database_role.this](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/database_role) | resource |\n| [snowflake_grant_database_role.granted_database_roles](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_database_role) | resource |\n| [snowflake_grant_database_role.granted_to_database_roles](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_database_role) | resource |\n| [snowflake_grant_database_role.granted_to_role](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_database_role) | resource |\n| [snowflake_grant_database_role.granted_to_share](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_database_role) | resource |\n| [snowflake_grant_database_role.parent_database_role](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_database_role) | resource |\n| [snowflake_grant_privileges_to_database_role.database_grants](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_privileges_to_database_role) | resource |\n| [snowflake_grant_privileges_to_database_role.schema_grants](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_privileges_to_database_role) | resource |\n| [snowflake_grant_privileges_to_database_role.schema_objects_grants](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_privileges_to_database_role) | resource |\n| [context_label.this](https://registry.terraform.io/providers/cloudposse/context/latest/docs/data-sources/label) | data source |\n\u003c!-- END_TF_DOCS --\u003e\n\n## CONTRIBUTING\n\nContributions are very welcomed!\n\nStart by reviewing [contribution guide](CONTRIBUTING.md) and our [code of conduct](CODE_OF_CONDUCT.md). After that, start coding and ship your changes by creating a new PR.\n\n## LICENSE\n\nApache 2 Licensed. See [LICENSE](LICENSE) for full details.\n\n## AUTHORS\n\n\u003c!--- Replace repository name --\u003e\n\u003ca href=\"https://github.com/getindata/terraform-snowflake-database-role/graphs/contributors\"\u003e\n  \u003cimg src=\"https://contrib.rocks/image?repo=getindata/terraform-module-template\" /\u003e\n\u003c/a\u003e\n\nMade with [contrib.rocks](https://contrib.rocks).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgetindata%2Fterraform-snowflake-database-role","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgetindata%2Fterraform-snowflake-database-role","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgetindata%2Fterraform-snowflake-database-role/lists"}