-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsnowflake-non-managed-apache-iceberg-table-privileges-setup.tf
122 lines (107 loc) · 5.66 KB
/
snowflake-non-managed-apache-iceberg-table-privileges-setup.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
provider "snowflake" {
alias = "security_admin"
role = "SECURITYADMIN"
# Snowflake Terraform Provider 1.0.0 requires the `organization_name` and
# `account_name` to be set, whereas the previous versions did not require
# this. That is why we are setting these values here. Plus, `account` as
# been deprecated in favor of `account_name`.
organization_name = "${split("-", jsondecode(data.aws_secretsmanager_secret_version.admin_public_keys.secret_string)["account"])[0]}"
account_name = "${split("-", jsondecode(data.aws_secretsmanager_secret_version.admin_public_keys.secret_string)["account"])[1]}"
user = jsondecode(data.aws_secretsmanager_secret_version.admin_public_keys.secret_string)["admin_user"]
authenticator = "SNOWFLAKE_JWT"
private_key = jsondecode(data.aws_secretsmanager_secret_version.admin_public_keys.secret_string)["active_rsa_public_key_number"] == 1 ? data.aws_secretsmanager_secret_version.admin_private_key_1.secret_string : data.aws_secretsmanager_secret_version.admin_private_key_2.secret_string
}
resource "snowflake_account_role" "security_admin_role" {
provider = snowflake.security_admin
name = "${upper(local.secrets_insert)}_ROLE"
}
resource "snowflake_grant_privileges_to_account_role" "warehouse" {
provider = snowflake.security_admin
privileges = ["USAGE"]
account_role_name = snowflake_account_role.security_admin_role.name
on_account_object {
object_type = "WAREHOUSE"
object_name = snowflake_warehouse.apache_flink.name
}
}
resource "snowflake_user" "user" {
provider = snowflake.security_admin
name = upper(var.service_account_user)
default_warehouse = snowflake_warehouse.apache_flink.name
default_role = snowflake_account_role.security_admin_role.name
default_namespace = "${snowflake_database.apache_flink.name}.${snowflake_schema.apache_flink_schema.name}"
# Setting the attributes to `null`, effectively unsets the attribute
# Refer to this link `https://docs.snowflake.com/en/user-guide/key-pair-auth#configuring-key-pair-rotation`
# for more information
rsa_public_key = module.snowflake_user_rsa_key_pairs_rotation.active_rsa_public_key_number == 1 ? jsondecode(data.aws_secretsmanager_secret_version.svc_public_keys.secret_string)["rsa_public_key_1"] : null
rsa_public_key_2 = module.snowflake_user_rsa_key_pairs_rotation.active_rsa_public_key_number == 2 ? jsondecode(data.aws_secretsmanager_secret_version.svc_public_keys.secret_string)["rsa_public_key_2"] : null
}
resource "snowflake_grant_privileges_to_account_role" "user" {
provider = snowflake.security_admin
privileges = ["MONITOR"]
account_role_name = snowflake_account_role.security_admin_role.name
on_account_object {
object_type = "USER"
object_name = snowflake_user.user.name
}
}
resource "snowflake_grant_account_role" "user_security_admin" {
provider = snowflake.security_admin
role_name = snowflake_account_role.security_admin_role.name
user_name = snowflake_user.user.name
}
provider "snowflake" {
alias = "account_admin"
role = "ACCOUNTADMIN"
# Snowflake Terraform Provider 1.0.0 requires the `organization_name` and
# `account_name` to be set, whereas the previous versions did not require
# this. That is why we are setting these values here. Plus, `account` as
# been deprecated in favor of `account_name`.
organization_name = "${split("-", jsondecode(data.aws_secretsmanager_secret_version.admin_public_keys.secret_string)["account"])[0]}"
account_name = "${split("-", jsondecode(data.aws_secretsmanager_secret_version.admin_public_keys.secret_string)["account"])[1]}"
user = jsondecode(data.aws_secretsmanager_secret_version.admin_public_keys.secret_string)["admin_user"]
authenticator = "SNOWFLAKE_JWT"
private_key = jsondecode(data.aws_secretsmanager_secret_version.admin_public_keys.secret_string)["active_rsa_public_key_number"] == 1 ? data.aws_secretsmanager_secret_version.admin_private_key_1.secret_string : data.aws_secretsmanager_secret_version.admin_private_key_2.secret_string
# Enable preview features
preview_features_enabled = [
"snowflake_storage_integration_resource",
"snowflake_file_format_resource",
"snowflake_stage_resource",
"snowflake_external_table_resource"
]
}
resource "snowflake_account_role" "account_admin_role" {
provider = snowflake.account_admin
name = "${upper(local.secrets_insert)}_ACCOUNT_ADMIN_ROLE"
}
resource "snowflake_grant_privileges_to_account_role" "database" {
provider = snowflake.account_admin
privileges = ["USAGE"]
account_role_name = snowflake_account_role.account_admin_role.name
on_account_object {
object_type = "DATABASE"
object_name = snowflake_database.apache_flink.name
}
}
resource "snowflake_grant_privileges_to_account_role" "schema" {
provider = snowflake.account_admin
privileges = ["CREATE FILE FORMAT", "USAGE"]
account_role_name = snowflake_account_role.account_admin_role.name
on_schema {
schema_name = "${snowflake_database.apache_flink.name}.${snowflake_schema.apache_flink_schema.name}"
}
}
resource "snowflake_grant_privileges_to_account_role" "integration_grant" {
provider = snowflake.account_admin
privileges = ["USAGE"]
account_role_name = snowflake_account_role.account_admin_role.name
on_account_object {
object_type = "INTEGRATION"
object_name = snowflake_storage_integration.aws_s3_integration.name
}
}
resource "snowflake_grant_account_role" "user_account_admin" {
provider = snowflake.account_admin
role_name = snowflake_account_role.account_admin_role.name
user_name = snowflake_user.user.name
}