Snowflake_role_grants - grant multiple users to a single role?

[natashamathur]

With the new snowflake_grant_account_role, is it possible to grant a role to multiple users within one block?

I'm trying to update this code:

resource "snowflake_role_grants" "data_engineer_grant" {
provider = snowflake.security_admin
role_name = snowflake_role.data_engineer_role.name
users = [snowflake_user.user_A.name,
snowflake_user.user_B.name
]

Would I have to make a separate block for each user?

[sfc-gh-asawicki]

Hey @natashamathur. Thanks for reaching out to us.

Yes, you have to do multiple blocks or utilize builtin HCL for_each meta-argument. You can read more in thread #2668 (comment).

[natashamathur]

Can for_each be used for both users and roles within a single block?

resource "snowflake_role_grants" "reporter_grant" {
  provider  = snowflake.security_admin
  role_name = snowflake_role.reporter_role.name
  users = [
    snowflake_user.user_x.name,
    snowflake_user.user_y.name,
    snowflake_user.user_z.name
  ]
  roles = [
    snowflake_role.data_engineer_role.name,
    snowflake_role.dev_team_role.name
  ]
}

[sfc-gh-jcieslak]

Hey 👋
snowflake_role_grants is a deprecated resource and we don't do any support for deprecated resources. The best way would be to migrate to the latest grant resources to get support from our side. Also, it's worth upgrading, because of the discussion I sent you in the other thread (#2736). We're pushing new features and bug fixes in every version and because of that, we're recommending staying up to date (and that wouldn't be possible If you don't migrate).

[natashamathur]

Ah yes apologies - I am updating! I was trying to figure out how to update this block. For other blocks where its multiple users for one role, I used foreach. I was wondering if its possible to basically loop through twice in one block.

Thank you so much!

[sfc-gh-jcieslak]

You can create a local variable that you could for_each on. That variable would be a list where each element would be an object holding a list of needed users and roles. As an example, see the first answer here (second point).