diff --git a/README.md b/README.md index ba9e27a..860e6c1 100644 --- a/README.md +++ b/README.md @@ -84,7 +84,7 @@ module "snowflake_database_role" { | [database\_name](#input\_database\_name) | The name of the database to create the role in | `string` | n/a | yes | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | | [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no | -| [descriptor\_name](#input\_descriptor\_name) | Name of the descriptor used to form a resource name | `string` | `"snowflake-role"` | no | +| [descriptor\_name](#input\_descriptor\_name) | Name of the descriptor used to form a resource name | `string` | `"snowflake-database-role"` | no | | [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | | [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no | | [granted\_database\_roles](#input\_granted\_database\_roles) | Database Roles granted to this role | `list(string)` | `[]` | no | @@ -98,7 +98,7 @@ module "snowflake_database_role" { | [parent\_database\_role](#input\_parent\_database\_role) | Fully qualified Parent Database Role name (`DB_NAME.ROLE_NAME`), to create parent-child relationship | `string` | `null` | no | | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | | [schema\_grants](#input\_schema\_grants) | Grants on a schema level | 
list(object({
    all_privileges             = optional(bool)
    with_grant_option          = optional(bool, false)
    privileges                 = optional(list(string), null)
    all_schemas_in_database    = optional(bool)
    future_schemas_in_database = optional(bool)
    schema_name                = optional(string, null)
  }))
| `[]` | no | -| [schema\_objects\_grants](#input\_schema\_objects\_grants) | Grants on a schema object level | 
map(list(object({
    all_privileges    = optional(bool)
    with_grant_option = optional(bool)
    privileges        = optional(list(string))
    object_name       = optional(string)
    on_all            = optional(bool, false)
    schema_name       = optional(string)
    on_future         = optional(bool, false)
  })))
| `{}` | no | +| [schema\_objects\_grants](#input\_schema\_objects\_grants) | Grants on a schema object level

Example usage:

schema\_objects\_grants = {
"TABLE" = [
{
privileges = ["SELECT"]
object\_name = "TEST\_TABLE"
schema\_name = "BRONZE"
},
{
all\_privileges = true
object\_name = "TEST\_TABLE\_2"
schema\_name = "BRONZE"
}
]
"SECRET" = [
{
all\_privileges = true
object\_name = "SERVICE\_NOW\_CREDS\_PW"
schema\_name = "BRONZE"
}
]
"ALERT" = [
{
all\_privileges = true
on\_future = true
on\_all = true
}
]
}

Note: If you don't provide a schema\_name, the grants will be created in plural form.
List of the all objects can be found [here](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/grant_privileges_to_role#object_type) | 
map(list(object({
    all_privileges    = optional(bool)
    with_grant_option = optional(bool)
    privileges        = optional(list(string))
    object_name       = optional(string)
    on_all            = optional(bool, false)
    schema_name       = optional(string)
    on_future         = optional(bool, false)
  })))
| `{}` | no | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | diff --git a/variables.tf b/variables.tf index 181c5d3..9e8dd5f 100644 --- a/variables.tf +++ b/variables.tf @@ -71,7 +71,43 @@ variable "schema_grants" { } variable "schema_objects_grants" { - description = "Grants on a schema object level" + description = <