diff --git a/README.md b/README.md index ff124ee..8719514 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ Terraform module for managing Snowflake Database roles. -- Creates Snowflake roles with specific privileges on databases and schemas. +- Creates Snowflake database role with specific privileges on database and schemas. - Allows granting of privileges on future schemas in a database. - Allows granting of privileges on all existing schemas in a database. - Allows granting of privileges on specific schema objects like tables. diff --git a/examples/complete/README.md b/examples/complete/README.md index 7d9ddf9..c0af880 100644 --- a/examples/complete/README.md +++ b/examples/complete/README.md @@ -1,19 +1,76 @@ # Complete Example ```terraform +resource "snowflake_database" "this" { + name = "TEST_DB" +} + +resource "snowflake_schema" "this" { + database = snowflake_database.this.name + name = "BRONZE" +} + +resource "snowflake_table" "table_1" { + database = snowflake_schema.this.database + schema = snowflake_schema.this.name + name = "TEST_TABLE_1" + + column { + name = "identity" + type = "NUMBER(38,0)" + nullable = true + + identity { + start_num = 1 + step_num = 3 + } + } +} + +resource "snowflake_table" "table_2" { + database = snowflake_schema.this.database + schema = snowflake_schema.this.name + name = "TEST_TABLE_2" + + column { + name = "identity" + type = "NUMBER(38,0)" + nullable = true + + identity { + start_num = 1 + step_num = 3 + } + } +} + +resource "snowflake_database_role" "db_role_1" { + database = snowflake_database.this.name + name = "DB_ROLE_1" +} + +resource "snowflake_database_role" "db_role_2" { + database = snowflake_database.this.name + name = "DB_ROLE_2" +} + +resource "snowflake_database_role" "db_role_3" { + database = snowflake_database.this.name + name = "DB_ROLE_3" +} + module "snowflake_database_role" { source = "../../" context = module.this.context - database_name = "PLAYGROUND_DB" - comment = "Database role for PLAYGROUND_DB" - name = "EXAMPLE_DB_ROLE" + database_name = snowflake_database.this.name + name = "TEST_DB_ROLE" - parent_database_role = "EXAMPLE_DB_ROLE_1" + parent_database_role = snowflake_database_role.db_role_1.name granted_database_roles = [ - "EXAMPLE_DB_ROLE_2", - "EXAMPLE_DB_ROLE_3" + snowflake_database_role.db_role_2.name, + snowflake_database_role.db_role_3.name ] database_grants = [ { @@ -23,41 +80,37 @@ module "snowflake_database_role" { schema_grants = [ { - schema_name = "BRONZE" + schema_name = snowflake_schema.this.name privileges = ["USAGE"] }, { future_schemas_in_database = true + all_schemas_in_database = true privileges = ["USAGE"] }, - { - all_schemas_in_database = true - privileges = ["USAGE"] - }, ] - schema_objects_grants = [ - { - privileges = ["SELECT"] - future = { - object_type_plural = "TABLES" - in_schema = "BRONZE" + schema_objects_grants = { + "TABLE" = [ + { + privileges = ["SELECT"] + object_name = snowflake_table.table_1.name + schema_name = snowflake_schema.this.name + }, + { + all_privileges = true + object_name = snowflake_table.table_2.name + schema_name = snowflake_schema.this.name } - }, - { - privileges = ["SELECT"] - object_type = "TABLE" - object_name = "BRONZE/TEST_TABLE" - }, - { - privileges = ["SELECT"] - future = { - object_type_plural = "ICEBERG TABLES" - in_schema = "BRONZE" + ] + "ALERT" = [ + { + all_privileges = true + on_future = true + on_all = true } - } - ] - + ] + } } ``` diff --git a/examples/simple/README.md b/examples/simple/README.md index f49c015..275f420 100644 --- a/examples/simple/README.md +++ b/examples/simple/README.md @@ -1,14 +1,41 @@ # Simple Example ```terraform +resource "snowflake_database" "this" { + name = "TEST_DB" +} + +resource "snowflake_schema" "this" { + database = snowflake_database.this.name + name = "BRONZE" +} + module "snowflake_database_role" { source = "../../" - database_name = "PLAYGROUND_DB" - comment = "Database role for PLAYGROUND_DB" - name = "EXAMPLE_DB_ROLE" -} + database_name = snowflake_database.this.name + name = "TEST_DB_ROLE" + + schema_grants = [ + { + future_schemas_in_database = true + all_schemas_in_database = true + all_privileges = true + }, + ] + + schema_objects_grants = { + "TABLE" = [ + { + all_privileges = true + on_future = true + on_all = true + schema_name = snowflake_schema.this.name + } + ] + } +} ``` ## Usage