Breaking: Removing ALL grants

[edulop91]

tl;dr
We are dropping support for ALL grants directly through the provider. To fill this gap, we will make available Terraform Modules that grant each privilege in the ALL set.

---

Why?
The ALL grant (for tables, schemas, databases, etc..) is somewhat challenging to work with through a Terraform Provider. When you grant ALL privileges, Snowflake will "translate" this to the set of each individual privilege in the ALL set at that given point in time. Therefore, we can't reliably query Snowflake to know if x resource had an ALL grant. Some scenarios that are ill-defined:

• Is this an ALL grant or were you individually granted each of these privileges?
• What happens when the definition of ALL changes?

When?
Expect to ship this over the next couple of weeks. You can pin your provider version if you need more time to upgrade.

What can I do instead?
We will be publishing and maintaining Terraform modules that replicate the ALL grant functionality. An example module. We will be updating the documentation to reflect these changes.

We are now doing codegen for these ALL modules.

[ryanking]

Note that this was merged in #322 and just released in 0.19.0.

[ryanking]

We have some modules in our public modules repo that re-implement an approximation of ALL in pure-terraform. Example here. Docs coming soon.

[jhettler]

Hi @ryanking,
I have tried to implement https://github.com/chanzuckerberg/cztack/tree/main/snowflake-table-grant-all with the tf file content below

module "grant" {
  source = "github.com/chanzuckerberg/cztack//snowflake-table-grant-all?ref=main"

  database_name = "DEV"
  on_future     = true
  roles         = ["rking_test_role"]
  schema_name   = "TEST_SCHEMA"
  shares        = []
}

but if I try to run terraform plan I get the message

Error: ConflictsWith

  on .terraform/modules/grant/snowflake-table-grant-all/main.tf.json line 60, in resource.snowflake_table_grant.all:
  60:         "on_future": "${var.on_future}",

"on_future": conflicts with shares

it's fair, but if I try to remove shares, I get

Error: Invalid function argument

  on .terraform/modules/grant/snowflake-table-grant-all/main.tf.json line 65, in resource.snowflake_table_grant.all:
  64:         "shares": "${setunion(\n\t\t\t\tvar.shares,\n\t\t\t\tlookup(var.per_privilege_grants, each.value, { shares = [], roles = [] }).shares,\n\t\t\t\t)}",
    |----------------
    | var.shares is null

Invalid value for "first_set" parameter: argument must not be null.

I am sorry, I have never worked with modules in Terraform, so it could definitely be a mistake on my side. Could you please provide an example how to call a similar example?

Thank you!

[ryanking]

This is a bug in the module, can you raise it as an issue in the cztack repo?

[jhettler]

Yep, will do tomorrow, I have found the solution.

[ErikDolstraDPGMedia]

Hey, sorry to respond in an old thread, but I have the same problem. I can't find the issue, where you refer too in the cztack repo. @jhettler what was your solution?

[lundbird]

I am having the same issue and have created this issue: chanzuckerberg/cztack#282

[VickyWinner]

Did this module being used and official? I see not updates after an year.