Granting a database role to a share fails with "Root object was present, but now absent."

[kingalban]

Terraform CLI and Provider Versions

Terraform v1.7.0
on linux_amd64

• provider registry.terraform.io/hashicorp/aws v4.67.0
• provider registry.terraform.io/hashicorp/http v3.4.0
• provider registry.terraform.io/hashicorp/random v3.6.0
• provider registry.terraform.io/snowflake-labs/snowflake v0.84.1

Terraform Configuration

resource "snowflake_database" "example_database" {
  name = "EXAMPLE"
}

resource "snowflake_database_role" "exampled_database_role" {
  database = snowflake_database.example_database.name
  name = "EXAMPLE"
}

resource "snowflake_share" "example_share" {
  name     = "EXAMPLE_SHARE"
  accounts = ["<another>.<account>"]
}

resource "snowflake_database_grant" "share_use_database" {
  database_name = snowflake_database.example_database.name
  shares = [snowflake_share.example_share.name]
}

resource "snowflake_grant_database_role" "share_use_database_role" {
  database_role_name = "${snowflake_database_role.exampled_database_role.database}.${snowflake_database_role.exampled_database_role.name}"
  share_name         = snowflake_share.example_share.name
  depends_on = [snowflake_database_grant.share_use_database] # neglecting this results in a separate error
}

Expected Behavior

The share snowflake_share.example_share should be granted the privilege USAGE on the database snowflake_database.example_database and database role snowflake_database_role.exampled_database_role.

Actual Behavior

terraform apply produces a reasonable plan, but when it goes to apply it gives this error:

╷
│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to snowflake_grant_database_role.share_use_database_role, provider "provider[\"registry.terraform.io/snowflake-labs/snowflake\"]" produced an unexpected new value: Root object was present, but
│ now absent.
│
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵

Checking Snowflake, the share wasn't granted any privileges on the database role.

Repeating terraform apply, it shows that the snowflake_grant_database_role.share_use_database_role needs to be created. Trying to do that gives the same error.

Steps to Reproduce

1. terraform apply

How much impact is this issue causing?

High

Logs

No response

Additional Information

because of the depreciation of grants like snowflake_database_grant, and the fact that snowflake_grant_privileges_to_share doesn't exist yet, I don't see how I can use the provider to manage shares.

Specifically, I am already managing privileges on the database of interest using the snowflake_grant_privileges_to_role resource, and combining that resource with snowflake_database_grant results in nasty conflicts

[kingalban]

I found these related issues, 2209, 1683 , 1674 , and 754.
Looks like they are either related to schemas and schema grants, using an older version of the provider.

I forgot to note: the role terraform is using is ACCOUNTADMIN

[sfc-gh-asawicki]

Hey @kingalban . Thanks for reporting the issue.

As this is a new resource we will analyze it shortly.

[sfc-gh-jcieslak]

Hey @kingalban,
I found the root cause of the issue (wrong mapping of SHOW GRANTS result for shares). Here's the pr for it (it may be released today v0.86.0 or with the next version). Oh, and FYI snowflake_grant_privileges_to_share exists in 0.85.0 (docs). In use with your example:

resource "snowflake_database" "test" {
  name     = var.database
}

resource "snowflake_database_role" "test" {
  database = snowflake_database.test.name
  name     = var.database_role_name
}

resource "snowflake_share" "test" {
  name = var.share_name
}

resource "snowflake_grant_privileges_to_share" "test" {
  privileges = ["USAGE"]
  on_database = snowflake_database.test.name
  to_share = snowflake_share.test.name
}

resource "snowflake_grant_database_role" "test" {
  database_role_name = "\"${snowflake_database.test.name}\".\"${snowflake_database_role.test.name}\""
  share_name         = snowflake_share.test.name
}

[sfc-gh-jcieslak]

Hey @kingalban
Yesterday we released 0.86.0 which should fix the issue, could you confirm ?

[kingalban]

Yes, this resolved my issues!