{"id":31482529,"url":"https://github.com/snowflake-labs/roleout","last_synced_at":"2025-10-02T07:53:22.284Z","repository":{"id":160775016,"uuid":"626595447","full_name":"Snowflake-Labs/roleout","owner":"Snowflake-Labs","description":null,"archived":false,"fork":false,"pushed_at":"2023-12-01T17:59:51.000Z","size":1474,"stargazers_count":24,"open_issues_count":4,"forks_count":3,"subscribers_count":9,"default_branch":"main","last_synced_at":"2023-12-01T18:49:58.481Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Snowflake-Labs.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-04-11T19:33:36.000Z","updated_at":"2023-11-13T14:26:45.000Z","dependencies_parsed_at":"2023-09-26T00:51:40.161Z","dependency_job_id":"282cb604-5fe6-413e-80e5-b5c59efa793f","html_url":"https://github.com/Snowflake-Labs/roleout","commit_stats":null,"previous_names":[],"tags_count":4,"template":null,"template_full_name":null,"purl":"pkg:github/Snowflake-Labs/roleout","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Snowflake-Labs%2Froleout","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Snowflake-Labs%2Froleout/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Snowflake-Labs%2Froleout/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Snowflake-Labs%2Froleout/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Snowflake-Labs","download_url":"https://codeload.github.com/Snowflake-Labs/roleout/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Snowflake-Labs%2Froleout/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":277974432,"owners_count":25908396,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-02T02:00:08.890Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-02T07:53:18.367Z","updated_at":"2025-10-02T07:53:22.278Z","avatar_url":"https://github.com/Snowflake-Labs.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Roleout\n\n## Table of Contents\n\n- [Legal](#legal)\n- [Installation](#installation)\n- [Concept](#concept)\n- [Functionality](#functionality)\n- [Usage](#usage)\n- [CLI Usage](#cli-usage)\n  - [Deployment](#generating-deployment-code)\n  - [Loading Objects from Snowflake](#loading-objects-from-snowflake)\n  - [Importing Objects to Terraform](#importing-existing-snowflake-objects-to-terraform)\n- [Terraform Deployment](#terraform-deployment)\n- [SQL Deployment](#sql-deployment)\n- [Development](#development)\n\n## Legal\n\nThis application is not part of the Snowflake Service and is governed by the terms in LICENSE, unless expressly\nagreed to in writing. You use this application at your own risk, and Snowflake has no obligation to support your use of\nthis application.\n\n## Installation\n\nDownload the appropriate installer/executable for your platform from\nthe [latest release page](https://github.com/Snowflake-Labs/roleout/releases/latest).\n\n#### Windows\n\nDownload and run the `Roleout Setup x.x.x.exe` installer.\n\n#### macOS\n\nDownload the `Roleout x.x.x.dmg` disk image and open it, then drag Roleout into the Applications folder. Because Roleout\nis not code-signed, on macOS you will need to unquaratine the app before you can run it. Open a terminal and run\nthe following:\n\n```shell\nsudo xattr -r -d com.apple.quarantine /Applications/Roleout.app\n```\n\n#### Linux\n\nDownload the `Roleout x.x.x.AppImage` [AppImage](https://appimage.org/) file and run it. You can also build Roleout from\nsource.\n\n## Concept\n\n- Accelerate the Snowflake environment design and deployment process.\n- Enable Infrastructure as Code for Snowflake environments with an easy-to-use interface.\n- Automatically apply best practices where it matters. Be moderately opinionated about these implementation details\n  while remaining flexible enough to support different use cases.\n- Don't reinvent functionality that existing mature tools provide; integrate with those tools instead.\n\n## Functionality\n\nA central tenet Roleout follows is that your Snowflake infrastructure should\nbe declared in code. A\ndeclarative [Infrastructure as Code](https://www.redhat.com/en/topics/automation/what-is-infrastructure-as-code-iac)\napproach provides numerous benefits such as accelerating development, reducing errors, and improving consistency. To\nthat end,\nRoleout defines your Snowflake project in a simple YAML file format and can generate deployment code in either SQL or\nTerraform\nbased on that file. Currently Roleout allows you to define your desired databases, schemas, virtual warehouses,\nfunctional roles,\nand RBAC with schema-level access. These stateless account objects are well-suited to an IaC approach, while the\nstateful objects\nlike tables should be created and managed with a database migration tool\nlike [Schemachange](https://github.com/Snowflake-Labs/schemachange).\n\nRoleout generates deployment code for the following:\n\n- Databases and schemas\n- Virtual warehouses\n- Functional roles\n- RBAC hierarchy of access roles to implement schema-level and virtual warehouse access\n\n## Usage\n\nRun Roleout and work through each page in the sidebar to design your environment. Make sure to save your project file;\nthis is the YAML file that defines your whole Snowflake project and is used to generate deployment code. You should\ncommit\nthis file to source control and treat it as you would any other IaC tool's code.\n\n### Environments\n\nDecide what environments you want to provision if any, e.g. PROD, DEV, TEST. If you enable the environments feature,\nRoleout\nwill generate a separate set of objects for each environment with the appropriate names. For example, with a PROD and\nDEV\nenvironment and a database called MAIN, Roleout would create deployment code for `PROD_MAIN_DB` and `DEV_MAIN_DB`.\n\nWith environments enabled you can design different access levels for each environment on the Access page.\n\nIf you do not enable the environments feature, Roleout will only generate deployment code for exactly the objects you\ndefine.\n\n### Databases, Schema, Virtual Warehouses\n\nSimply use the editors in the GUI to enter your desired databases, schemas, and virtual warehouses. Roleout will\ngenerate\ndeployment code for these with the following properties:\n\n- Schemas will all be MANAGED ACCESS\n- Virtual warehouses are currently set to MEDIUM size and other parameters are left to the defaults\n\n### Schema Object Groups\n\nAlthough not generally recommended, sometimes you might have a hard requirement to control access to individual tables and views, rather than at the schema level. Enable Schema Object Groups to create groups of tables and views across schemas and databases that should share an access level, and manage that access from the Access page.\n\nOn the \"Schema Object Groups\" page, you can create one or more groups. Clicking the group name will take you to the edit page\nwhere you can add tables and views from one or more schemas across databases to the group.\n\n### Functional Roles\n\nDetermine what groups of people and programs that will use Snowflake exist in your organization, and make functional\nroles\nfor them. For example, many organizations would have roles like `ANALYST`, `DATA_SCIENTIST`, `ELT_TOOL`. Note that if\nenvironments are enabled Roleout will generate a version of your functional roles for each environment,\ne.g. `PROD_ANALYST_FR`.\n\n### Access Control\n\nOn the Access page you can choose a level of access each functional role should have to each schema and virtual\nwarehouse\nin each environment. Simply click in a cell to cycle through available access levels.\n\nRoleout implements a layered access model which means that all access levels are grouped at the schema level,\nso a given role will either have Read, ReadWrite, or Full access to all objects in a schema. That includes tables,\nviews,\nfunctions, stages, streams, etc.\n\nTo consolidate the privileges for each access level on each schema and warehouse, Roleout generates \"access roles\".\nThese are roles\nnamed like `PROD_DB_RAW_RW_AR` which have all the privileges that make up Read, ReadWrite, or Full access to a\nschema/warehouse.\nThese access roles are then granted to the appropriate functional roles to implement the access control matrix you have\nspecified.\n\n### Naming Convention\n\nRoleout comes with a default naming convention for the various objects it creates, and you can tweak that convention to\nyour liking on the Naming Convention page.\n\n## CLI Usage\n\n### Generating Deployment Code\n\n#### SQL\n\n`roleout sql deploy -c my_config.yml -o output_dir`\n\n#### Terraform\n\n`roleout terraform deploy -c my_config.yml -o output_dir`\n\n### Loading Objects from Snowflake\nIf you already have a Snowflake environment, you can use the CLI to load your existing databases, schemas, roles, and warehouses\ninto your Roleout project. To start a new Roleout project by loading those objects from your Snowflake account:\n1) Setup your connection. roleout-cli will use the same environment variables for authentication as the Terraform provider,\n  so follow [these Authentication instructions](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs#authentication)\n  to export the appropriate environment variables. For example:\n  ```\nexport SNOWFLAKE_USER=\"\u003cyour user\u003e\"\nexport SNOWFLAKE_PRIVATE_KEY_PATH=\"\u003cyour private key path\u003e\"\nexport SNOWFLAKE_ACCOUNT=\"\u003corg-account\u003e\"\nexport SNOWFLAKE_WAREHOUSE=\"\u003cyour warehouse\u003e\"\nexport SNOWFLAKE_ROLE=\"ACCOUNTADMIN\"\n```\n2) Run `roleout-cli snowflake populateProject -o 'Your New Project Name.yml'`\n\nYou can also update an existing Roleout project with objects from your Snowflake account like so:\n`roleout-cli snowflake populateProject -c 'My Existing Project.yml' -o 'Your New Project Name.yml'`\n\n### Importing Existing Snowflake Objects to Terraform\n\nThis command will run `terraform import` for all database, schema, virtual warehouse, and functional role resources in\nyour project.\n\n`roleout terrform import -c my_config.yml `\n\nTo write the `terraform import` commands to a file rather than running them, use the `-o --output` flag.\n\n## Terraform Deployment\n\nIf you are using Terraform as your deployment tool, you should select the Terraform deployment backend on the Deploy\npage in Roleout and click the download button. This will save a .zip file of all the .tf files for your defined\nSnowflake\nresources.\n\nYou need to create a user in your Snowflake account that Terraform can connect with. This user needs to be\ngranted `ACCOUNTADMIN`\nand will need access to a virtual warehouse where it will run SQL commands.\n\nThe `snowflake.tf` file will tell Terraform to install and use\nthe [Snowflake Terraform provider](https://registry.terraform.io/providers/Snowflake-Labs/snowflake).\n\nSpecify your Snowflake connection properties via environment variables as shown in\nthe [Snowflake provider documentation](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs)\nor edit the `snowflake.tf` file to include them. For example:\n\n```shell\nexport SNOWFLAKE_USER=\"TERRAFORM\"\nexport SNOWFLAKE_PRIVATE_KEY_PATH=\"rsa_key.p8\"\nexport SNOWFLAKE_ACCOUNT=\"\u003cyour account name\u003e\"\nexport SNOWFLAKE_WAREHOUSE=\"TERRAFORM_WH\"\n```\n\n## SQL Deployment\n\nFor your convenience, shell scripts are provided in your deployment SQL files to automatically run the .sql scripts\nagainst your Snowflake account. The `deploy.{sh,ps1}` and `teardown/teardown.{sh,ps1}` scripts use SnowSQL to run their\nrespective\n.sql files in batch mode against the connection of your choice. The `.sh` scripts are suitable for Mac OS and Linux, and\nthe `.ps1` scripts are for Windows.\n\nExample usages:\n\n```./deploy.sh -c my_snowsql_connection```\n\n```./teardown.ps1 -a ab12345.us-east-2.aws -u MY_USER```\n\n### SQL Limitations\n\n* If you delete objects or roles from your Roleout project, the SQL deployment .sql scripts do not drop or revoke\n  anything\n  from your Snowflake account.\n  You will need to manually drop objects and roles in Snowflake after removing them in Roleout.\n* Changing or revoking access in your Roleout project does not revoke that access in Snowflake. If you make changes to\n  the\n  access grants in Roleout, you should run the prior version of `teardown/01 - Teardown RBAC.sql` script to remove the\n  old grants, and then run\n  your new deployment .sql scripts as usual to put the new grants in place. Note that this process will result in a (\n  short) period of time where the\n  old grants have been deleted but the new grants are not yet in place.\n* Databases and schemas cannot change from transient to non-transient or vice versa. You would need to manually drop and\n  recreate the\n  database/schema in order to change the transience.\n\n## Development\n\n1. Clone this repository\n2. Install [Node.js](https://nodejs.org/en/download/) if you don't have it already. Recommend\n   using [nvm](https://github.com/nvm-sh/nvm).\n3. Install requirements:\n    1. `$ npm install`\n\n### Electron App\n\nTo run the Electron app in development, run `npm run start -w app`.\n\nTo build executables for your local platform, run `npm run package -w app`.\n\nTo build executables of the Electron app for all platforms,\nrun:\n\n`npm exec electron-builder -w app -- --publish never --win --mac --linux`.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsnowflake-labs%2Froleout","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsnowflake-labs%2Froleout","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsnowflake-labs%2Froleout/lists"}