feat: Add snowflake grant ownership resource #2604

sfc-gh-jcieslak · 2024-03-07T12:44:05Z

The first part of the implementation of the snowflake_grant_ownership resource. This is a "basic" version of this resource providing baseline functionalities needed to transfer ownership in Terraform. In the next pull request, I'll add all of the edge cases we have to cover (most of them are described here).

Changes made:

Created a new snowflake_grant_ownership resource with CRUD operations implemented (still there are TODOs left for discussion)
Added examples and documentation needed for the resource and its identifier

Things to do before the merge:

remove snowflake_grant_ownership from the provider.go

TODO in the next pr(s):

Add deprecation messages to old grant resources specifically made for granting ownership
Add edge cases and test them (and if needed describe them in the documentation and add examples)
Add setId("") in read and forcefully grant ownership in Create operation
Referring to comment, test different cases where the Delete operation may struggle with
Test outside of Terraform interactions to see how it behaves in different situations

Test Plan

acceptance tests
unit tests for the resource identifier conversions from/to String representation
unit tests for the helper functions needed by resource CRUD operations

References

GRANT OWNERSHIP

Mentioned in

A list of issues requesting this resource (a big probability there's more); notify after part 2 will be done.

github-actions · 2024-03-07T12:47:41Z

Integration tests failure for 9c01b9c85e0c86918616ebfc4f4d360c53ecdecb

github-actions · 2024-03-07T13:02:45Z

Integration tests failure for cc173c2779042c7ff83d1517c659fa77f409122e

github-actions · 2024-03-07T15:32:41Z

Integration tests failure for 924b38600c2a088e3714915ad06259297fb4e625

github-actions · 2024-03-07T17:15:55Z

Integration tests failure for d22e3d957e53e6ddb8deb84c717e8a80faf4832d

docs/resources/grant_ownership.md

docs/resources/grant_privileges_to_database_role.md

templates/resources/grant_ownership.md.tmpl

pkg/sdk/testint/helpers_test.go

pkg/sdk/object_types.go

pkg/resources/grant_ownership.go

pkg/resources/grant_ownership_test.go

pkg/resources/grant_ownership_acceptance_test.go

github-actions · 2024-03-12T13:40:31Z

Integration tests failure for 306e09f29127cf8bc3afbaa607b393843e9fce5f

github-actions · 2024-03-12T15:09:00Z

Integration tests success for 66ca523a80f6c939bfc42c4ccec09a3429f1f9ba

sfc-gh-asawicki · 2024-03-13T13:32:57Z

pkg/resources/grant_ownership_test.go

+		"database_role_name": "account_role_name",
+	})
+
+	defer func() {


could be done with assert.Panics as suggested, you can change in the follow-up PR.

github-actions · 2024-03-13T14:35:12Z

Integration tests failure for e855a9291ff0e7f79aa609d9640a7d7e2e304273

github-actions · 2024-03-14T09:27:34Z

Integration tests failure for 9737b07e62eec0b4503f80e99a690a80c92e9089

🤖 I have created a release *beep* *boop* --- ## [0.87.3-pre](v0.87.2...v0.87.3-pre) (2024-03-18) ### 🎉 **What's new:** * Add snowflake grant ownership resource ([#2604](#2604)) ([bfadd24](bfadd24)), closes [#2549](#2549) [#2199](#2199) [#2084](#2084) [#1942](#1942) [#1875](#1875) ### 🔧 **Misc** * Fix env variables for tests ([#2603](#2603)) ([8bc2437](8bc2437)) * release 0.87.3-pre ([a2be7b9](a2be7b9)) ### 🐛 **Bug fixes:** * alter table column data type ([#2607](#2607)) ([538b6dc](538b6dc)) * cgo goreleaser alt solution ([#2613](#2613)) ([5d31856](5d31856)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: snowflake-release-please[bot] <105954990+snowflake-release-please[bot]@users.noreply.github.com>

A follow-up for #2604. Done in this pr: - Add setId("") in Read (when ownership is not found on the target object) and forcefully grant ownership in Create (this was already present, but added test cases for it). - Edge cases - Granting `ON PIPE` and `ON ALL PIPES` is handled (pipes are paused before and resumed after ownership transfer) Full list of things that still need to be done: - Deprecation messages - More documentation (explain how grant_ownership resource handles edge cases) and examples that would show simple usage, edge cases, cases where the resource may cause trouble - Referring to #2604 (comment), test different cases where the Delete operation may struggle with - Test outside of Terraform interactions to see how it behaves in different situations - A test where used role is not privileged enough to transfer ownership - Also cases within Terraform to see how grant_ownership will act with other grant resources within certain configurations - Edge cases - Granting `ON TASK` - Use `VIEW` when granting on `MATERIALIZED VIEW` - Granting `ON EXTERNAL TABLES` ## References [GRANT OWNERSHIP](https://docs.snowflake.com/en/sql-reference/sql/grant-ownership) ## Mentioned in A list of issues requesting this resource: #2549 #2199 #2084 #1942 #1875

A follow-up for #2604. Done in this pr: - All of the edge cases handled and tested (except of tasks that are done in the separate pr): - Materialized views (already handled by Snowflake no changes needed) - RBAC hierarchy (test case added) - Delete dependent resource (role or granted object) and remove grant resource from the state (test case added) Won't do: - External tables (cannot handle this edge case, because we have to know the auto_refresh state of the external table; it's not retrievable by SHOW or DESC commands. It will be still possible to grant ownership of the external table, but there may be additional manual work to do afterward. Everything is documented.) ## Test Plan  * [x] acceptance tests that show how the resource is handling certain edge cases + RBAC use case ## References [GRANT OWNERSHIP](https://docs.snowflake.com/en/sql-reference/sql/grant-ownership) ## Mentioned in A list of issues requesting this resource: #2549 #2199 #2084 #1942 #1875

A follow-up for #2604 (comment). Updated target objects for privilege-granting resources based on documentation (also added references above available object's list). Pr also contains: - #2689 is fixed in the pr and acceptance tests are added. - #2696 documentation fix

sfc-gh-jcieslak added 10 commits March 7, 2024 15:51

wip

fbc19a5

wip

8d4bcc7

wip

f46a01c

wip

afce522

wip

28b9ea5

wip

e3a48ee

wip

20364c2

wip

1ec3ac6

wip

69d7334

wip

924b386

sfc-gh-jcieslak force-pushed the add-snowflake-grant-ownership-resource branch from cc173c2 to 924b386 Compare March 7, 2024 14:51

lachniej mentioned this pull request Mar 7, 2024

snowflake_grant_privileges_to_account_role to support OWNERSHIP role #2549

Closed

wip

d22e3d9

sfc-gh-jcieslak marked this pull request as ready for review March 7, 2024 16:26

This was referenced Mar 8, 2024

Changing snowflake_grant_privileges_to_role resource involving ownership fails due to dependent grants #1942

Closed

OWNERSHIP can only be transferred error on destruction of snowflake_grant_privileges_to_role resource #2084

Closed

sfc-gh-asawicki self-requested a review March 11, 2024 10:49

sfc-gh-asawicki requested changes Mar 11, 2024

View reviewed changes

sfc-gh-asawicki mentioned this pull request Mar 11, 2024

Grant ownership on database role #2611

Closed

changes after review

306e09f

changes after review

66ca523

sfc-gh-asawicki self-requested a review March 13, 2024 13:10

sfc-gh-asawicki previously approved these changes Mar 13, 2024

View reviewed changes

change before merge

e855a92

sfc-gh-jcieslak dismissed sfc-gh-asawicki’s stale review via e855a92 March 13, 2024 13:48

sfc-gh-jcieslak requested a review from sfc-gh-asawicki March 13, 2024 13:50

sfc-gh-asawicki previously approved these changes Mar 14, 2024

View reviewed changes

skip ownership acceptance tests

9737b07

sfc-gh-jcieslak dismissed sfc-gh-asawicki’s stale review via 9737b07 March 14, 2024 08:39

sfc-gh-asawicki approved these changes Mar 14, 2024

View reviewed changes

sfc-gh-jcieslak merged commit bfadd24 into main Mar 14, 2024
8 of 9 checks passed

sfc-gh-jcieslak deleted the add-snowflake-grant-ownership-resource branch March 14, 2024 09:31

snowflake-release-please bot mentioned this pull request Mar 13, 2024

chore(main): release 0.87.3-pre #2605

Merged

sfc-gh-jcieslak mentioned this pull request Mar 18, 2024

feat: Grant ownership follow up #2628

Merged

sfc-gh-jcieslak mentioned this pull request Mar 27, 2024

feat: grant ownership follow-up #2658

Merged

1 task

sfc-gh-jcieslak mentioned this pull request Apr 9, 2024

feat: Update target objects for privilege-granting resources #2688

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add snowflake grant ownership resource #2604

feat: Add snowflake grant ownership resource #2604

sfc-gh-jcieslak commented Mar 7, 2024 •

edited

Loading

github-actions bot commented Mar 7, 2024

github-actions bot commented Mar 7, 2024

github-actions bot commented Mar 7, 2024

github-actions bot commented Mar 7, 2024

github-actions bot commented Mar 12, 2024

github-actions bot commented Mar 12, 2024

sfc-gh-asawicki Mar 13, 2024

sfc-gh-jcieslak Mar 13, 2024

github-actions bot commented Mar 13, 2024

github-actions bot commented Mar 14, 2024

feat: Add snowflake grant ownership resource #2604

feat: Add snowflake grant ownership resource #2604

Conversation

sfc-gh-jcieslak commented Mar 7, 2024 • edited Loading

Test Plan

References

Mentioned in

github-actions bot commented Mar 7, 2024

github-actions bot commented Mar 7, 2024

github-actions bot commented Mar 7, 2024

github-actions bot commented Mar 7, 2024

github-actions bot commented Mar 12, 2024

github-actions bot commented Mar 12, 2024

sfc-gh-asawicki Mar 13, 2024

Choose a reason for hiding this comment

sfc-gh-jcieslak Mar 13, 2024

Choose a reason for hiding this comment

github-actions bot commented Mar 13, 2024

github-actions bot commented Mar 14, 2024

sfc-gh-jcieslak commented Mar 7, 2024 •

edited

Loading