{"id":23104102,"url":"https://github.com/glueops/terraform-snowflake-foundation","last_synced_at":"2026-03-20T00:36:18.854Z","repository":{"id":107191245,"uuid":"549308634","full_name":"GlueOps/terraform-snowflake-foundation","owner":"GlueOps","description":null,"archived":false,"fork":false,"pushed_at":"2025-09-20T15:36:44.000Z","size":46,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-10-02T04:29:18.839Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GlueOps.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-10-11T01:49:25.000Z","updated_at":"2025-09-20T15:36:47.000Z","dependencies_parsed_at":null,"dependency_job_id":"94daefd0-555d-4c3f-9e02-65f57d1511fb","html_url":"https://github.com/GlueOps/terraform-snowflake-foundation","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/GlueOps/terraform-snowflake-foundation","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlueOps%2Fterraform-snowflake-foundation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlueOps%2Fterraform-snowflake-foundation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlueOps%2Fterraform-snowflake-foundation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlueOps%2Fterraform-snowflake-foundation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GlueOps","download_url":"https://codeload.github.com/GlueOps/terraform-snowflake-foundation/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlueOps%2Fterraform-snowflake-foundation/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28472624,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-15T20:50:13.584Z","status":"ssl_error","status_checked_at":"2026-01-15T20:49:17.379Z","response_time":62,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-17T00:31:23.805Z","updated_at":"2026-01-15T22:11:18.232Z","avatar_url":"https://github.com/GlueOps.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform snowflake foundation\n\nThis module offers an opinionated starting point for setting up a Snowflake account with affordances for the infrastructure and RBAC features generally found in \"the modern data stack.\"\n\nThe module leverages the [Snowflake Terraform Provider](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest).\n\nThe module can be used in conjunction with [terraform-snowflake-data-integrator](https://github.com/GlueOps/terraform-snowflake-data-integrator), which creates the infrastructure and access required by common data integrator tools, like [Hevo Data](https://hevodata.com/) and [Fivetran](https://www.fivetran.com/).\n\nSpecifically, the module creates and manages the following Snowflake resources:\n * Databases\n * Warehouses\n * Users (human and service)\n * RBAC (roles and policies)\n\n---\n\n## Overview\n\n### Databases\n\nBy default, this module creates three databases: `RAW`, `DEVELOPMENT`, and `PRODUCTION`.\n\n* **`RAW`** - Dropzone for data landed in Snowflake via first-party services, such as data copied from an object store datalake (e.g. GCS or S3).  Third-party data integration tools, like Airbyte are intended to be configured with the [terraform-snowflake-data-integrator](https://github.com/GlueOps/terraform-snowflake-data-integrator) so they receive their own warehouses and databases.\n* **`DEVELOPMENT`** - Testing area for creating derived data sets that is isolated from any production dependencies.\n* **`PRODUCTION`** - Final versions of databases that are expected to have production dependencies.\n\n### Warehouses\n\nTo ease resource contention and enable more granular tracking of compute usage, the module creates a number of warehouses, one for each `principal_role` and one for each `service_user`.\n\n### Users\n\nThe module creates two types of users: `human_users` and `service_users`, with the following characteristics.\n\n* **`human_users`**: Users assigned to humans.  These users are created without a password and a password must be set for each user in console to enable an initial login.  That password must be changed upon first login.  The following SQL will reset a user's password and enable that user to create a password.\n```sql\nALTER USER \u003cuser\u003e RESET PASSWORD;\n```\n\n* **`service_users`**: Users created for services that must access Snowflake and use a username/password combination.  The passwords for these users are declared in `variables.tf` and it is recommended that the passwords are protected, such as via encryption, so as to not store them as as plaintext in your VCS.  Each `service_user` is granted a role and a warehouse that have an identical name to the `service_user`.  The `privilege_roles` for each `service_user` are determined by the configuration in `variables.tf`.\n\n### RBAC\n\nThe module separates roles into two categories:\n\n* **`principal_roles`**: Roles to be assigned to entities using the roles, such as `human_users` and `service_users`.  These roles collect the various privileges required by a given principal to perform tasks in Snowflake.\n* **`privilege_roles`**: Roles that are logical groupings of privileges that are composably assigned to `principal_roles`.  By default, the module creates a `READ_ALL` privilege role that enables reading from all databases created using this module and a collection of `WRITE_*` roles, which enable writing to each database, respectively.\n\nThe relationships among roles can be visualized using the [Snowflake Inspector](http://snowflakeinspector.hashmapinc.com/), or in the convenient visualizer in Snowsight.\n\n## Usage\n\n```hcl\nmodule \"test_foundation\" {\n  source = \"github.com/GlueOps/terraform-snowflake-foundation\"\n\n  human_users = {\n    ADELINA_ANALYST = [\"REPORTER\"] \n    BELICIA_DATA_ENGINEER = [\"TRANSFORMER_DEVELOPMENT\"] \n  }\n\n  service_users = {\n    DBT           = {\n      privilege_roles = [\n        \"READ_ALL\",\n        \"WRITE_PRODUCTION\"\n      ]\n      password = \"\u003cyour-secret-password\u003e\"\n    }\n    PRESET = {\n      privilege_roles = [\n        \"READ_ALL\",\n      ]\n      password = \"\u003cyour-secret-password\u003e\"\n    }\n  }\n}\n```\n\nThe following variables defaults are set in `variables.tf` and not shown above.\n\n```hcl\ndatabases = [\n  \"RAW\",\n  \"DEVELOPMENT\",\n  \"PRODUCTION\",\n]\n\n# Values in this map can be used to override the settings of any Warehouse.\nwarehouse_overrides = {\n  \"TRANSFORMER_DEVELOPMENT\" = {\n    warehouse_size = \"x-small\"\n    auto_suspend   = \"60\"\n  }\n}\n\nprincipal_roles = {\n  \"REPORTER\" : [\n    \"READ_ALL\",\n  ]\n  \"TRANSFORMER_DEVELOPMENT\" : [\n    \"READ_ALL\",\n    \"WRITE_DEVELOPMENT\",\n  ]\n  \"TRANSFORMER_PRODUCTION\" : [\n    \"READ_ALL\",\n    \"WRITE_PRODUCTION\",\n  ]\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fglueops%2Fterraform-snowflake-foundation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fglueops%2Fterraform-snowflake-foundation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fglueops%2Fterraform-snowflake-foundation/lists"}