Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

snowflake_masking_policy signature not matching when there are multiple columns #2706

Closed
coreywebber opened this issue Apr 13, 2024 · 4 comments
Labels
bug Used to mark issues with provider's incorrect behavior category:resource resource:masking_policy Issue connected to the snowflake_masking_policy resource

Comments

@coreywebber
Copy link

Terraform CLI and Provider Versions

I am using 0.87.2 and the terraform 1.8

Terraform Configuration

resource "snowflake_masking_policy" "mp_market_segment_user_string" {
    name                            = "MP_MARKET_SEGMENT_USER_STRING"
    comment                         = "Masking policy using the MARKET_SEGMENT column"
    provider                        = snowflake.sys_admin
    database                        = snowflake_database.governance.name
    schema                          = snowflake_schema.governance_masking.name
    signature {
        column {
            name                    = "VAL"
            type                    = "VARCHAR"
        }
        column {
            name                    = "SEGMENT"
            type                    = "VARCHAR"
        }
    }
    masking_expression              = <<-EOF
                                        case
                                            when segment in ('FED') then 
                                                case
                                                    when current_role() in ('DW_INGEST', 'DW_TRANSFORM') then val
                                                    when current_role() in ('DW_FEDRAMP_USER') then val
                                                    else '${var.fed_mask_user}'
                                                end
                                            else val
                                        end
                                    EOF
    return_data_type                = "VARCHAR"
}


### Expected Behavior

I expect there to be no differences detected after I deploy the masking policy

### Actual Behavior

```signature {
          + column {
              + name = "SEGMENT"
              + type = "VARCHAR" # forces replacement
            }

            # (1 unchanged block hidden)
        }
      - signature {
          - column {
              - name = "SEGMENT" -> null
              - type = "VARCHAR" -> null # forces replacement
            }
        }```

While I can add in the `if_not_exists`  to make the problem go away, I still feel its a bug since it detect some that's not changed. 
On a side note, I did assume maybe it was ordering the columns, but changing the order didn't work.

### Steps to Reproduce

1. `terraform apply -target module.data_warehouse.snowflake_masking_policy.mp_market_segment_user_string`
2. `terraform apply -target module.data_warehouse.snowflake_masking_policy.mp_market_segment_user_string`

### How much impact is this issue causing?

Medium

### Logs

_No response_

### Additional Information

_No response_
@coreywebber coreywebber added the bug Used to mark issues with provider's incorrect behavior label Apr 13, 2024
@sfc-gh-jcieslak
Copy link
Collaborator

sfc-gh-jcieslak commented Apr 15, 2024

Hey 👋
I believe we already merged a fix for that and It should work correctly in the next released version (link to the pr).

@sfc-gh-jcieslak
Copy link
Collaborator

Hey, we released a new provider version: https://github.com/Snowflake-Labs/terraform-provider-snowflake/releases/tag/v0.89.0. Please bump and confirm that it works.

@sfc-gh-jcieslak sfc-gh-jcieslak added resource:masking_policy Issue connected to the snowflake_masking_policy resource category:resource labels May 20, 2024
@sfc-gh-jcieslak
Copy link
Collaborator

Hey @coreywebber 👋
Could you confirm it works in the newer provider versions ?

@coreywebber
Copy link
Author

We are good

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Used to mark issues with provider's incorrect behavior category:resource resource:masking_policy Issue connected to the snowflake_masking_policy resource
Projects
None yet
Development

No branches or pull requests

2 participants