Terraform module for Snowflake stage management.

• Creates Snowflake stage
• Can create custom Snowflake database-roles with role-to-role assignments
• Can create a set of default roles to simplify access management:
  • READONLY - granted USAGE or READ privilages
  • READWRITE - granted WRITE privileges
  • ADMIN - granted ALL PRIVILEGES

module "snowflake_stage" {
  source = "getindata/stage/snowflake"
  # version  = "x.x.x"

  name     = "my_stage"
  schema   = "my_schema"
  database = "my_db"
  
  url         = "s3://com.example.bucket/prefix"
  credentials = "AWS_KEY_ID='${var.example_aws_key_id}' AWS_SECRET_KEY='${var.example_aws_secret_key}'"
  
  create_default_database_roles = true
}

• Simple - Basic usage of the module
• Complete - Advanced usage of the module

Due to breaking changes in Snowflake provider and additional code optimizations, breaking changes were introduced in v2.0.0 version of this module.

List of code and variable (API) changes:

• Switched to snowflake_grant_ownership resource instead of provider-removed snowflake_role_ownership_grant

• Switched to snowflake_database_role module to leverage new database_roles mechanism

• default_roles and custom_roles are now combined and managed by single module

• roles variable map received following additions:

  • all_privileges - optional, bool
  • on_all - optional, bool, defaults to false
  • on_future - optional, bool, defaults to false
  • with_grant_option - optional, bool
  • granted_to_database_roles - optional, string
  • granted_database_roles - optional, list of strings

• and got following items removed:

  • enabled
  • comment
  • role_ownership_grant
  • granted_roles
  • granted_to_users

When upgrading from v1.x, expect most of the resources to be recreated - if recreation is impossible, then it is possible to import some existing resources.

For more information, refer to variables.tf, list of inputs below and Snowflake provider documentation

Due to replacement of nulllabel (context.tf) with context provider, some breaking changes were introduced in v3.0.0 version of this module.

List od code and variable (API) changes:

• Removed context.tf file (a single-file module with additonal variables), which implied a removal of all its variables (except name):
  • descriptor_formats
  • label_value_case
  • label_key_case
  • id_length_limit
  • regex_replace_chars
  • label_order
  • additional_tag_map
  • tags
  • labels_as_tags
  • attributes
  • delimiter
  • stage
  • environment
  • tenant
  • namespace
  • enabled
  • context
• Remove support enabled flag - that might cause some backward compatibility issues with terraform state (please take into account that proper move clauses were added to minimize the impact), but proceed with caution
• Additional context provider configuration
• New variables were added, to allow naming configuration via context provider:
  • context_templates
  • name_schema

object({
    properties            = optional(list(string), ["name"])
    delimiter             = optional(string, "_")
    context_template_name = optional(string, "snowflake-stage")
    replace_chars_regex   = optional(string, "[^a-zA-Z0-9_]")
    extra_values          = optional(map(string))
  })

map(object({
    name_scheme = optional(object({
      properties            = optional(list(string))
      delimiter             = optional(string)
      context_template_name = optional(string)
      replace_chars_regex   = optional(string)
      extra_labels          = optional(map(string))
    }))
    comment                   = optional(string)
    with_grant_option         = optional(bool)
    granted_to_roles          = optional(list(string))
    granted_to_database_roles = optional(list(string))
    granted_database_roles    = optional(list(string))
    stage_grants              = optional(list(string))
    all_privileges            = optional(bool)
  }))

Contributions are very welcomed!

Start by reviewing contribution guide and our code of conduct. After that, start coding and ship your changes by creating a new PR.

Apache 2 Licensed. See LICENSE for full details.

Made with contrib.rocks.