Overview :-

Snowflake, a cloud-based data warehousing platform, has become increasingly popular for its scalability and flexibility. One of the key aspects of managing a Snowflake environment is setting up proper access controls through roles and user grants. Terraform, an infrastructure-as-code tool, can significantly streamline this process. In this blog post, we’ll explore how to create roles and manage user grants in Snowflake using Terraform.

Prerequisites :-

Before we dive into the procedure, ensure you have the following:

1. A Snowflake account with administrative privileges

2. Terraform installed on your local machine

3. Basic knowledge of Snowflake and Terraform concepts

4. The Snowflake provider for Terraform configured

Tip: If you’re new to Terraform, consider going through their official documentation to get familiar with the basics.

Procedure :-

Step 1: Define the Snowflake Provider

First, we need to set up the Snowflake provider in our Terraform configuration:

terraform {
  required_providers {
    snowflake = {
      source  = "Snowflake-Labs/snowflake"
      version = "~> 0.35"
    }
  }
}
provider "snowflake" {
  account  = "your_account"
  username = "your_username"
  password = "your_password"
  role     = "ACCOUNTADMIN"
}

Step 2: Create Roles

Now, let’s define the roles we want to create:

resource "snowflake_role" "data_analyst" {
  name    = "DATA_ANALYST"
  comment = "Role for data analysts"
}

resource "snowflake_role" "data_scientist" {
  name    = "DATA_SCIENTIST"
  comment = "Role for data scientists"
}

After creating the roles, we can grant them specific privileges:

resource "snowflake_database_grant" "grant_usage_db" {
  database_name = "ANALYTICS"
  privilege     = "USAGE"
  roles         = [snowflake_role.data_analyst.name, snowflake_role.data_scientist.name]
}
resource "snowflake_schema_grant" "grant_usage_schema" {
  database_name = "ANALYTICS"
  schema_name   = "PUBLIC"
  privilege     = "USAGE"
  roles         = [snowflake_role.data_analyst.name, snowflake_role.data_scientist.name]
}

Step 4: Create Users

Next, let’s create some users:

resource "snowflake_user" "john_doe" {
  name     = "JOHN_DOE"
  login_name = "john.doe@example.com"
  comment  = "Data Analyst"
  password = "temporaryPassword123!"
}
resource "snowflake_user" "jane_smith" {
  name     = "JANE_SMITH"
  login_name = "jane.smith@example.com"
  comment  = "Data Scientist"
  password = "temporaryPassword456!"
}

Step 5: Grant Roles to Users

Finally, we can assign the roles to the users:

resource "snowflake_role_grants" "grant_analyst_role" {
  role_name = snowflake_role.data_analyst.name
  users     = [snowflake_user.john_doe.name]
}
resource "snowflake_role_grants" "grant_scientist_role" {
  role_name = snowflake_role.data_scientist.name
  users     = [snowflake_user.jane_smith.name]
}

Conclusion :-

By using Terraform to manage role creation and user grants in Snowflake, we can ensure consistency and repeatability in our access control setup. This approach allows for version control of our infrastructure and makes it easier to manage changes over time.

Remember to always follow the principle of least privilege when granting access, and regularly review and update your access controls to maintain a secure environment.