https://github.com/getindata/terraform-snowflake-database-role

Terraform Database role module for Snowflake
https://github.com/getindata/terraform-snowflake-database-role
Last synced: 5 months ago
JSON representation
Terraform Database role module for Snowflake
Host: GitHub
URL: https://github.com/getindata/terraform-snowflake-database-role
Owner: getindata
License: apache-2.0
Created: 2024-03-19T10:59:54.000Z (about 2 years ago)
Default Branch: main
Last Pushed: 2025-01-07T13:19:30.000Z (over 1 year ago)
Last Synced: 2025-01-24T02:30:19.426Z (over 1 year ago)
Language: HCL
Size: 37.1 KB
Stars: 0
Watchers: 5
Forks: 0
Open Issues: 0
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Codeowners: CODEOWNERS
Awesome Lists containing this project

README

          # Snowflake Database Role Terraform Module

![Snowflake](https://img.shields.io/badge/-SNOWFLAKE-249edc?style=for-the-badge&logo=snowflake&logoColor=white)

![Terraform](https://img.shields.io/badge/terraform-%235835CC.svg?style=for-the-badge&logo=terraform&logoColor=white)

![License](https://badgen.net/github/license/getindata/terraform-snowflake-database-role/)

![Release](https://badgen.net/github/release/getindata/terraform-snowflake-database-role/)



  

  
We help companies turn their data into assets


---

Terraform module for managing Snowflake Database roles.

- Creates Snowflake database role with specific privileges on database and schemas.

- Allows granting of privileges on future schemas in a database.

- Allows granting of privileges on all existing schemas in a database.

- Allows granting of privileges on specific schema objects like tables.

- Supports granting of all privileges or specific ones based on the configuration.

- Can be used to create a hierarchy of roles by assigning parent roles.

- Can be used to grant roles to other roles.

## USAGE

```terraform

resource "snowflake_database" "this" {

  name = "TEST_DB"

}

resource "snowflake_schema" "this" {

  database = snowflake_database.this.name

  name     = "BRONZE"

}

module "snowflake_database_role" {

  source = "../../"

  database_name = snowflake_database.this.name

  name          = "TEST_DB_ROLE"

  schema_grants = [

    {

      future_schemas_in_database = true

      all_schemas_in_database    = true

      all_privileges             = true

    },

  ]

  schema_objects_grants = {

    "TABLE" = [

      {

        all_privileges = true

        on_future      = true

        on_all         = true

        schema_name    = snowflake_schema.this.name

      }

    ]

  }

}

```

## EXAMPLES

- [Simple](examples/simple) - Basic usage of the module

- [Complete](examples/complete) - Advanced usage of the module

## Breaking changes in v2.x of the module

Due to replacement of nulllabel (`context.tf`) with context provider, some **breaking changes** were introduced in `v2.0.0` version of this module.

List od code and variable (API) changes:

- Removed `context.tf` file (a single-file module with additonal variables), which implied a removal of all its variables (except `name`):

  - `descriptor_formats`

  - `label_value_case`

  - `label_key_case`

  - `id_length_limit`

  - `regex_replace_chars`

  - `label_order`

  - `additional_tag_map`

  - `tags`

  - `labels_as_tags`

  - `attributes`

  - `delimiter`

  - `stage`

  - `environment`

  - `tenant`

  - `namespace`

  - `enabled`

  - `context`

- Remove support `enabled` flag - that might cause some backward compatibility issues with terraform state (please take into account that proper `move` clauses were added to minimize the impact), but proceed with caution

- Additional `context` provider configuration

- New variables were added, to allow naming configuration via `context` provider:

  - `context_templates`

  - `name_schema`

## Breaking changes in v3.x of the module

Due to rename of Snowflake terraform provider source, all `versions.tf` files were updated accordingly.

Please keep in mind to mirror this change in your own repos also.

For more information about provider rename, refer to [Snowflake documentation](https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/SNOWFLAKEDB_MIGRATION.md).

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [comment](#input\_comment) | Database Role description | `string` | `null` | no |

|  [context\_templates](#input\_context\_templates) | Map of context templates used for naming conventions - this variable supersedes `naming_scheme.properties` and `naming_scheme.delimiter` configuration | `map(string)` | `{}` | no |

|  [database\_grants](#input\_database\_grants) | Grants on a database level | 
object({
    all_privileges    = optional(bool)
    with_grant_option = optional(bool, false)
    privileges        = optional(list(string), null)
  }) | `{}` | no |

|  [database\_name](#input\_database\_name) | The name of the database to create the role in | `string` | n/a | yes |

|  [granted\_database\_roles](#input\_granted\_database\_roles) | Database Roles granted to this role | `list(string)` | `[]` | no |

|  [granted\_to\_database\_roles](#input\_granted\_to\_database\_roles) | Fully qualified Parent Database Role name (`DB_NAME.ROLE_NAME`), to create parent-child relationship | `list(string)` | `[]` | no |

|  [granted\_to\_roles](#input\_granted\_to\_roles) | List of Snowflake Account Roles to grant this role to | `list(string)` | `[]` | no |

|  [granted\_to\_shares](#input\_granted\_to\_shares) | List of Snowflake Shares to grant this role to | `list(string)` | `[]` | no |

|  [name](#input\_name) | Name of the resource | `string` | n/a | yes |

|  [name\_scheme](#input\_name\_scheme) | Naming scheme configuration for the resource. This configuration is used to generate names using context provider:
    - `properties` - list of properties to use when creating the name - is superseded by `var.context_templates`
    - `delimiter` - delimited used to create the name from `properties` - is superseded by `var.context_templates`
    - `context_template_name` - name of the context template used to create the name
    - `replace_chars_regex` - regex to use for replacing characters in property-values created by the provider - any characters that match the regex will be removed from the name
    - `extra_values` - map of extra label-value pairs, used to create a name
    - `uppercase` - convert name to uppercase | object({
    properties            = optional(list(string), ["environment", "name"])
    delimiter             = optional(string, "_")
    context_template_name = optional(string, "snowflake-database-role")
    replace_chars_regex   = optional(string, "[^a-zA-Z0-9_]")
    extra_values          = optional(map(string))
    uppercase             = optional(bool, true)
  }) | `{}` | no |

|  [parent\_database\_role](#input\_parent\_database\_role) | DEPRECATED variable - please use `granted_to_database_roles` instead | `string` | `null` | no |

|  [schema\_grants](#input\_schema\_grants) | Grants on a schema level | list(object({
    all_privileges             = optional(bool)
    with_grant_option          = optional(bool, false)
    privileges                 = optional(list(string), null)
    all_schemas_in_database    = optional(bool, false)
    future_schemas_in_database = optional(bool, false)
    schema_name                = optional(string, null)
  })) | `[]` | no |

|  [schema\_objects\_grants](#input\_schema\_objects\_grants) | Grants on a schema object level

  Example usage:

  schema\_objects\_grants = {
    "TABLE" = [
      {
        privileges  = ["SELECT"]
        object\_name = snowflake\_table.table\_1.name
        schema\_name = snowflake\_schema.this.name
      },
      {
        all\_privileges = true
        object\_name    = snowflake\_table.table\_2.name
        schema\_name    = snowflake\_schema.this.name
      }
    ]
    "ALERT" = [
      {
        all\_privileges = true
        on\_future      = true
        on\_all         = true
      }
    ]
  }

  Note: If you don't provide a schema\_name, the grants will be created for all objects of that type in the database.
        You can find a list of all object types [here](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/grant_privileges_to_database_role#object_type) | map(list(object({
    all_privileges    = optional(bool)
    with_grant_option = optional(bool)
    privileges        = optional(list(string))
    object_name       = optional(string)
    on_all            = optional(bool, false)
    schema_name       = optional(string)
    on_future         = optional(bool, false)
  })))
 | `{}` | no |

## Modules

No modules.

## Outputs

| Name | Description |

|------|-------------|

|  [fully\_qualified\_name](#output\_fully\_qualified\_name) | Name of the database role in fully qualified format ("DB\_NAME"."ROLE\_NAME") |

|  [name](#output\_name) | Name of the database role |

## Providers

| Name | Version |

|------|---------|

|  [context](#provider\_context) | >=0.4.0 |

|  [snowflake](#provider\_snowflake) | >= 0.97 |

## Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 1.3 |

|  [context](#requirement\_context) | >=0.4.0 |

|  [snowflake](#requirement\_snowflake) | >= 0.97 |

## Resources

| Name | Type |

|------|------|

| [snowflake_database_role.this](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/database_role) | resource |

| [snowflake_grant_database_role.granted_database_roles](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_database_role) | resource |

| [snowflake_grant_database_role.granted_to_database_roles](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_database_role) | resource |

| [snowflake_grant_database_role.granted_to_role](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_database_role) | resource |

| [snowflake_grant_database_role.granted_to_share](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_database_role) | resource |

| [snowflake_grant_database_role.parent_database_role](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_database_role) | resource |

| [snowflake_grant_privileges_to_database_role.database_grants](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_privileges_to_database_role) | resource |

| [snowflake_grant_privileges_to_database_role.schema_grants](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_privileges_to_database_role) | resource |

| [snowflake_grant_privileges_to_database_role.schema_objects_grants](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/grant_privileges_to_database_role) | resource |

| [context_label.this](https://registry.terraform.io/providers/cloudposse/context/latest/docs/data-sources/label) | data source |

## CONTRIBUTING

Contributions are very welcomed!

Start by reviewing [contribution guide](CONTRIBUTING.md) and our [code of conduct](CODE_OF_CONDUCT.md). After that, start coding and ship your changes by creating a new PR.

## LICENSE

Apache 2 Licensed. See [LICENSE](LICENSE) for full details.

## AUTHORS



  



Made with [contrib.rocks](https://contrib.rocks).
ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/getindata/terraform-snowflake-database-role

Awesome Lists containing this project

README

We help companies turn their data into assets
