snowform_access_roles/role_privileges_db_schema_usage.tf at main · inovex/snowform_access_roles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
# Grant privileges to the access roles

# DB usage
resource "snowflake_grant_privileges_to_account_role" "grant_usage_on_db_r" {
  for_each          = local.schema_map
  provider          = snowflake.sysadmin
  privileges        = ["USAGE"]
  account_role_name = snowflake_account_role.r[each.value.name].name
  on_account_object {
    object_type = "DATABASE"
    object_name = var.db.name
  }
}

resource "snowflake_grant_privileges_to_account_role" "grant_usage_on_db_rw" {
  for_each          = local.schema_map
  provider          = snowflake.sysadmin
  privileges        = ["USAGE"]
  account_role_name = snowflake_account_role.rw[each.value.name].name
  on_account_object {
    object_type = "DATABASE"
    object_name = var.db.name
  }
}

resource "snowflake_grant_privileges_to_account_role" "grant_usage_on_db_full" {
  for_each          = local.schema_map
  provider          = snowflake.sysadmin
  privileges        = ["USAGE"]
  account_role_name = snowflake_account_role.full[each.value.name].name
  on_account_object {
    object_type = "DATABASE"
    object_name = var.db.name
  }
}

# schema usage
resource "snowflake_grant_privileges_to_account_role" "grant_usage_on_db_schema_r" {
  for_each          = local.schema_map
  provider          = snowflake.sysadmin
  privileges        = ["USAGE"]
  account_role_name = snowflake_account_role.r[each.value.name].name
  on_schema {
    schema_name = "\"${var.db.name}\".\"${each.value.name}\""
  }
}

resource "snowflake_grant_privileges_to_account_role" "grant_usage_on_db_schema_rw" {
  for_each          = local.schema_map
  provider          = snowflake.sysadmin
  privileges        = ["USAGE"]
  account_role_name = snowflake_account_role.rw[each.value.name].name
  on_schema {
    schema_name = "\"${var.db.name}\".\"${each.value.name}\""
  }
}

resource "snowflake_grant_privileges_to_account_role" "grant_usage_on_db_schema_full" {
  for_each          = local.schema_map
  provider          = snowflake.sysadmin
  privileges        = ["USAGE"]
  account_role_name = snowflake_account_role.full[each.value.name].name
  on_schema {
    schema_name = "\"${var.db.name}\".\"${each.value.name}\""
  }
}