https://github.com/getindata/terraform-snowflake-schema

Terraform module for managing Snowflake schemas
https://github.com/getindata/terraform-snowflake-schema
schema snowflake terraform terraform-module
Last synced: 4 months ago
JSON representation
Terraform module for managing Snowflake schemas
Host: GitHub
URL: https://github.com/getindata/terraform-snowflake-schema
Owner: getindata
License: apache-2.0
Created: 2022-12-28T07:47:51.000Z (over 3 years ago)
Default Branch: main
Last Pushed: 2025-08-20T12:01:19.000Z (10 months ago)
Last Synced: 2025-08-20T14:18:45.478Z (10 months ago)
Topics: schema, snowflake, terraform, terraform-module
Language: HCL
Homepage:
Size: 138 KB
Stars: 2
Watchers: 6
Forks: 0
Open Issues: 3
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
Awesome Lists containing this project

README

          # Snowflake Schema Terraform Module

![Snowflake](https://img.shields.io/badge/-SNOWFLAKE-249edc?style=for-the-badge&logo=snowflake&logoColor=white)

![Terraform](https://img.shields.io/badge/terraform-%235835CC.svg?style=for-the-badge&logo=terraform&logoColor=white)

![License](https://badgen.net/github/license/getindata/terraform-snowflake-schema/)

![Release](https://badgen.net/github/release/getindata/terraform-snowflake-schema/)



  

  
We help companies turn their data into assets


---

Terraform module for Snowflake schema management.

- Creates Snowflake schema

- Can create custom Snowflake database roles with role-to-role assignments

- Can create a set of default database roles to simplify access management:

  - `READONLY` - granted select on all tables and views and usage on some objects in the schema

  - `READWRITE` - granted write type grants on tables and stages. Additionally, allows calling procedures and tasks in the schema

  - `TRANSFORMER` - Allows creating tables and views on top of the `READWRITE` role privileges

  - `ADMIN` - Full access, including setting schema options like `data_retention_days`

  - Each role can be disabled seperately by setting `enabled` to false - see [Complete example](examples/complete)

  - Each role can be additionally modified - see [Complete example](examples/complete)

## USAGE

```terraform

module "snowflake_schema" {

  source = "github.com/getindata/terraform-snowflake-schema"

  # version = "x.x.x"

  name     = "MY_SCHEMA"

  database = "MY_DB"

  is_managed          = false

  is_transient        = false

  data_retention_days = 1

  create_default_database_roles = true

}

```

## EXAMPLES

- [Complete](examples/complete) - Advanced usage of the module

- [Simple](examples/simple) - Basic usage of the module

## Breaking changes in v2.x of the module

Due to breaking changes in Snowflake provider and additional code optimizations, **breaking changes** were introduced in `v2.0.0` version of this module.

List of code and variable (API) changes:

- Switched to `snowflake_database_role` module to leverage new `database_roles` mechanism

- stage module version was updated (`v2.1.0`) to use newly introduced changes by Snowflake provider

- overhaul of `roles` and `stages` variables

- variable `add_grants_to_existing_objects` was removed as it is no longer needed

When upgrading from `v1.x`, expect most of the resources to be recreated - if recreation is impossible, then it is possible to import some existing resources.

For more information, refer to [variables.tf](variables.tf), list of inputs below and Snowflake provider documentation

## Breaking changes in v3.x of the module

Due to replacement of nulllabel (`context.tf`) with context provider, some **breaking changes** were introduced in `v3.0.0` version of this module.

List od code and variable (API) changes:

- Removed `context.tf` file (a single-file module with additonal variables), which implied a removal of all its variables (except `name`):

  - `descriptor_formats`

  - `label_value_case`

  - `label_key_case`

  - `id_length_limit`

  - `regex_replace_chars`

  - `label_order`

  - `additional_tag_map`

  - `tags`

  - `labels_as_tags`

  - `attributes`

  - `delimiter`

  - `stage`

  - `environment`

  - `tenant`

  - `namespace`

  - `enabled`

  - `context`

- Remove support `enabled` flag - that might cause some backward compatibility issues with terraform state (please take into account that proper `move` clauses were added to minimize the impact), but proceed with caution

- Additional `context` provider configuration

- New variables were added, to allow naming configuration via `context` provider:

  - `context_templates`

  - `name_schema`

## Breaking changes in v4.x of the module

- Due to rename of Snowflake terraform provider source, all `versions.tf` files were updated accordingly.

  Please keep in mind to mirror this change in your own repos also.

  For more information about provider rename, refer to [Snowflake documentation](https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/SNOWFLAKEDB_MIGRATION.md).

- Maximal version of supported provider was also unblocked (previosly locked in terraform-snowflake-stage module), so keep in mind that, starting with Snowflake provider version `1.x`, the `snowflake_stage` resource is considered a preview feature and must be explicitly enabled in the provider configuration.

  **Required Provider Configuration:**

  ```terraform

  provider "snowflake" {

    preview_features_enabled = ["snowflake_stage_resource"]

  }

  ```

  Without this configuration, you will encounter the following error:

  ```shell

  Error: snowflake_stage_resource is currently a preview feature, and must be enabled by adding snowflake_stage_resource to preview_features_enabled in Terraform configuration.

  ```

  For more information about preview features, refer to the [Snowflake provider documentation](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/stage#preview-features) and [Snowflake stage resource documentation](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/stage).

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [catalog](#input\_catalog) | Parameter that specifies the default catalog to use for Iceberg tables. | `string` | `null` | no |

|  [comment](#input\_comment) | Specifies a comment for the schema | `string` | `null` | no |

|  [context\_templates](#input\_context\_templates) | Map of context templates used for naming conventions - this variable supersedes `naming_scheme.properties` and `naming_scheme.delimiter` configuration | `map(string)` | `{}` | no |

|  [create\_default\_roles](#input\_create\_default\_roles) | Whether the default database roles should be created | `bool` | `false` | no |

|  [data\_retention\_time\_in\_days](#input\_data\_retention\_time\_in\_days) | Specifies the number of days for which Time Travel actions (CLONE and UNDROP) can be performed on the schema,
    as well as specifying the default Time Travel retention time for all tables created in the schema | `number` | `1` | no |

|  [database](#input\_database) | Database where the schema should be created | `string` | n/a | yes |

|  [default\_ddl\_collation](#input\_default\_ddl\_collation) | Specifies a default collation specification for all schemas and tables added to the database.
It can be overridden on schema or table level. | `string` | `null` | no |

|  [enable\_console\_output](#input\_enable\_console\_output) | Enables console output for user tasks. | `bool` | `null` | no |

|  [external\_volume](#input\_external\_volume) | Parameter that specifies the default external volume to use for Iceberg tables. | `string` | `null` | no |

|  [is\_transient](#input\_is\_transient) | Specifies a schema as transient.
    Transient schemas do not have a Fail-safe period so they do not incur additional storage costs once they leave Time Travel; 
    however, this means they are also not protected by Fail-safe in the event of a data loss. | `bool` | `false` | no |

|  [log\_level](#input\_log\_level) | Specifies the severity level of messages that should be ingested and made available in the active event table.
Valid options are: [TRACE DEBUG INFO WARN ERROR FATAL OFF].
Messages at the specified level (and at more severe levels) are ingested. | `string` | `null` | no |

|  [max\_data\_extension\_time\_in\_days](#input\_max\_data\_extension\_time\_in\_days) | Object parameter that specifies the maximum number of days for which Snowflake can extend the data retention period 
for tables in the database to prevent streams on the tables from becoming stale. | `number` | `null` | no |

|  [name](#input\_name) | Name of the resource | `string` | n/a | yes |

|  [name\_scheme](#input\_name\_scheme) | Naming scheme configuration for the resource. This configuration is used to generate names using context provider:
    - `properties` - list of properties to use when creating the name - is superseded by `var.context_templates`
    - `delimiter` - delimited used to create the name from `properties` - is superseded by `var.context_templates`
    - `context_template_name` - name of the context template used to create the name
    - `replace_chars_regex` - regex to use for replacing characters in property-values created by the provider - any characters that match the regex will be removed from the name
    - `extra_values` - map of extra label-value pairs, used to create a name
    - `uppercase` - convert name to uppercase | 
object({
    properties            = optional(list(string), ["name"])
    delimiter             = optional(string, "_")
    context_template_name = optional(string, "snowflake-schema")
    replace_chars_regex   = optional(string, "[^a-zA-Z0-9_]")
    extra_values          = optional(map(string))
    uppercase             = optional(bool, true)
  }) | `{}` | no |

|  [pipe\_execution\_paused](#input\_pipe\_execution\_paused) | Pauses the execution of a pipe. | `bool` | `null` | no |

|  [quoted\_identifiers\_ignore\_case](#input\_quoted\_identifiers\_ignore\_case) | If true, the case of quoted identifiers is ignored. | `bool` | `null` | no |

|  [replace\_invalid\_characters](#input\_replace\_invalid\_characters) | Specifies whether to replace invalid UTF-8 characters with the Unicode replacement character () in query results for an Iceberg table.
You can only set this parameter for tables that use an external Iceberg catalog. | `bool` | `null` | no |

|  [roles](#input\_roles) | Database roles created in the scheme scope | map(object({
    name_scheme = optional(object({
      properties            = optional(list(string))
      delimiter             = optional(string)
      context_template_name = optional(string)
      replace_chars_regex   = optional(string)
      extra_labels          = optional(map(string))
      uppercase             = optional(bool)
    }))
    role_ownership_grant      = optional(string)
    granted_to_roles          = optional(list(string))
    granted_to_database_roles = optional(list(string))
    granted_database_roles    = optional(list(string))
    schema_grants = optional(list(object({
      all_privileges    = optional(bool)
      with_grant_option = optional(bool, false)
      privileges        = optional(list(string), null)
    })))
    schema_objects_grants = optional(map(list(object({
      all_privileges    = optional(bool)
      with_grant_option = optional(bool)
      privileges        = optional(list(string), null)
      object_name       = optional(string)
      on_all            = optional(bool, false)
      on_future         = optional(bool, false)
    }))), {})
  })) | `{}` | no |

|  [skip\_schema\_creation](#input\_skip\_schema\_creation) | Should schema creation be skipped but allow all other resources to be created.
    Useful if schema already exsists but you want to add e.g. access roles." | `bool` | `false` | no |

|  [stages](#input\_stages) | Stages to be created in the schema | map(object({
    name_scheme = optional(object({
      properties            = optional(list(string))
      delimiter             = optional(string)
      context_template_name = optional(string)
      replace_chars_regex   = optional(string)
      extra_labels          = optional(map(string))
      uppercase             = optional(bool)
    }))
    aws_external_id      = optional(string)
    comment              = optional(string)
    copy_options         = optional(string)
    credentials          = optional(string)
    directory            = optional(string)
    encryption           = optional(string)
    file_format          = optional(string)
    snowflake_iam_user   = optional(string)
    storage_integration  = optional(string)
    url                  = optional(string)
    create_default_roles = optional(bool)
    roles = optional(map(object({
      name_scheme = optional(object({
        properties            = optional(list(string))
        delimiter             = optional(string)
        context_template_name = optional(string)
        replace_chars_regex   = optional(string)
        extra_labels          = optional(map(string))
        uppercase             = optional(bool)
      }))
      with_grant_option         = optional(bool)
      granted_to_roles          = optional(list(string))
      granted_to_database_roles = optional(list(string))
      granted_database_roles    = optional(list(string))
      stage_grants              = optional(list(string))
      all_privileges            = optional(bool)
    })), {})
  })) | `{}` | no |

|  [storage\_serialization\_policy](#input\_storage\_serialization\_policy) | The storage serialization policy for Iceberg tables that use Snowflake as the catalog.
Valid options are: [COMPATIBLE OPTIMIZED]. | `string` | `null` | no |

|  [suspend\_task\_after\_num\_failures](#input\_suspend\_task\_after\_num\_failures) | How many times a task must fail in a row before it is automatically suspended. 0 disables auto-suspending. | `number` | `null` | no |

|  [task\_auto\_retry\_attempts](#input\_task\_auto\_retry\_attempts) | Maximum automatic retries allowed for a user task. | `number` | `null` | no |

|  [trace\_level](#input\_trace\_level) | Controls how trace events are ingested into the event table.
Valid options are: [ALWAYS ON\_EVENT OFF]." | `string` | `null` | no |

|  [user\_task\_managed\_initial\_warehouse\_size](#input\_user\_task\_managed\_initial\_warehouse\_size) | The initial size of warehouse to use for managed warehouses in the absence of history. | `string` | `null` | no |

|  [user\_task\_minimum\_trigger\_interval\_in\_seconds](#input\_user\_task\_minimum\_trigger\_interval\_in\_seconds) | Minimum amount of time between Triggered Task executions in seconds. | `number` | `null` | no |

|  [user\_task\_timeout\_ms](#input\_user\_task\_timeout\_ms) | User task execution timeout in milliseconds. | `number` | `null` | no |

|  [with\_managed\_access](#input\_with\_managed\_access) | Specifies a managed schema. Managed access schemas centralize privilege management with the schema owner | `bool` | `false` | no |

## Modules

| Name | Source | Version |

|------|--------|---------|

|  [roles\_deep\_merge](#module\_roles\_deep\_merge) | Invicton-Labs/deepmerge/null | 0.1.5 |

|  [snowflake\_custom\_role](#module\_snowflake\_custom\_role) | getindata/database-role/snowflake | 3.0.0 |

|  [snowflake\_default\_role](#module\_snowflake\_default\_role) | getindata/database-role/snowflake | 3.0.0 |

|  [snowflake\_stage](#module\_snowflake\_stage) | getindata/stage/snowflake | 4.1.0 |

## Outputs

| Name | Description |

|------|-------------|

|  [database](#output\_database) | Database where the schema is deployed to |

|  [database\_roles](#output\_database\_roles) | Snowflake Database Roles |

|  [name](#output\_name) | Name of the schema |

|  [schema\_catalog](#output\_schema\_catalog) | Catalog for the schema |

|  [schema\_comment](#output\_schema\_comment) | Comment of the schema |

|  [schema\_data\_retention\_time\_in\_days](#output\_schema\_data\_retention\_time\_in\_days) | Data retention time in days for the schema |

|  [schema\_database](#output\_schema\_database) | Database where the schema is deployed to |

|  [schema\_default\_ddl\_collation](#output\_schema\_default\_ddl\_collation) | Default DDL collation for the schema |

|  [schema\_enable\_console\_output](#output\_schema\_enable\_console\_output) | Whether to enable console output for the schema |

|  [schema\_external\_volume](#output\_schema\_external\_volume) | External volume for the schema |

|  [schema\_is\_transient](#output\_schema\_is\_transient) | Is the schema transient |

|  [schema\_log\_level](#output\_schema\_log\_level) | Log level for the schema |

|  [schema\_max\_data\_extension\_time\_in\_days](#output\_schema\_max\_data\_extension\_time\_in\_days) | Maximum data extension time in days for the schema |

|  [schema\_pipe\_execution\_paused](#output\_schema\_pipe\_execution\_paused) | Whether to pause pipe execution for the schema |

|  [schema\_quoted\_identifiers\_ignore\_case](#output\_schema\_quoted\_identifiers\_ignore\_case) | Whether to ignore case for quoted identifiers for the schema |

|  [schema\_replace\_invalid\_characters](#output\_schema\_replace\_invalid\_characters) | Whether to replace invalid characters for the schema |

|  [schema\_storage\_serialization\_policy](#output\_schema\_storage\_serialization\_policy) | Storage serialization policy for the schema |

|  [schema\_suspend\_task\_after\_num\_failures](#output\_schema\_suspend\_task\_after\_num\_failures) | Number of task failures after which to suspend the task for the schema |

|  [schema\_task\_auto\_retry\_attempts](#output\_schema\_task\_auto\_retry\_attempts) | Number of task auto retry attempts for the schema |

|  [schema\_trace\_level](#output\_schema\_trace\_level) | Trace level for the schema |

|  [schema\_user\_task\_managed\_initial\_warehouse\_size](#output\_schema\_user\_task\_managed\_initial\_warehouse\_size) | User task managed initial warehouse size for the schema |

|  [schema\_user\_task\_minimum\_trigger\_interval\_in\_seconds](#output\_schema\_user\_task\_minimum\_trigger\_interval\_in\_seconds) | User task minimum trigger interval in seconds for the schema |

|  [schema\_user\_task\_timeout\_ms](#output\_schema\_user\_task\_timeout\_ms) | User task timeout in milliseconds for the schema |

|  [schema\_with\_managed\_access](#output\_schema\_with\_managed\_access) | Whether the schema has managed access |

|  [stages](#output\_stages) | Schema stages |

## Providers

| Name | Version |

|------|---------|

|  [context](#provider\_context) | >=0.4.0 |

|  [snowflake](#provider\_snowflake) | >= 0.95 |

## Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 1.3 |

|  [context](#requirement\_context) | >=0.4.0 |

|  [snowflake](#requirement\_snowflake) | >= 0.95 |

## Resources

| Name | Type |

|------|------|

| [snowflake_schema.this](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs/resources/schema) | resource |

| [context_label.this](https://registry.terraform.io/providers/cloudposse/context/latest/docs/data-sources/label) | data source |

## CONTRIBUTING

Contributions are very welcomed!

Start by reviewing [contribution guide](CONTRIBUTING.md) and our [code of conduct](CODE_OF_CONDUCT.md). After that, start coding and ship your changes by creating a new PR.

## LICENSE

Apache 2 Licensed. See [LICENSE](LICENSE) for full details.

## AUTHORS



  



Made with [contrib.rocks](https://contrib.rocks).
ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/getindata/terraform-snowflake-schema

Awesome Lists containing this project

README

We help companies turn their data into assets
