Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Removed Grants #245

Merged
merged 2 commits into from
Jul 27, 2023
Merged

Fix Removed Grants #245

merged 2 commits into from
Jul 27, 2023

Conversation

dehume
Copy link
Contributor

@dehume dehume commented Jul 21, 2023

If a grant is removed outside of Terraform, it would lead to an error in subsequent plan/applies rather than recreating the grant.

New Workflow

  1. Grant via apply
resource "materialize_table_grant" "table_grant_insert" {
  role_name     = materialize_role.role_1.name
  privilege     = "INSERT"
  database_name = materialize_table.simple_table.database_name
  schema_name   = materialize_table.simple_table.schema_name
  table_name    = materialize_table.simple_table.name
}
  1. Manually remove grant
REVOKE INSERT ON TABLE example_database.example_schema.simple_table FROM "role-1";
  1. On next plan/apply
Terraform will perform the following actions:

  # materialize_table_grant.table_grant_insert will be created
  + resource "materialize_table_grant" "table_grant_insert" {
      + database_name = "example_database"
      + id            = (known after apply)
      + privilege     = "INSERT"
      + role_name     = "role-1"
      + schema_name   = "example_schema"
      + table_name    = "simple_table"
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Fix applies to object, system and default grants

@dehume dehume added the bug Something isn't working label Jul 21, 2023
@dehume dehume requested review from benesch and bobbyiliev July 21, 2023 17:37
Copy link
Member

@benesch benesch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code LGTM, but we should write a test for this, similar to how we test for objects disappearing:

func TestAccSecret_disappears(t *testing.T) {
secretName := acctest.RandStringFromCharSet(10, acctest.CharSetAlpha)
secret2Name := acctest.RandStringFromCharSet(10, acctest.CharSetAlpha)
roleName := acctest.RandStringFromCharSet(10, acctest.CharSetAlpha)
resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
ProviderFactories: testAccProviderFactories,
CheckDestroy: testAccCheckAllSecretsDestroyed,
Steps: []resource.TestStep{
{
Config: testAccSecretResource(roleName, secretName, "sekret", secret2Name, roleName),
Check: resource.ComposeTestCheckFunc(
testAccCheckSecretExists("materialize_secret.test"),
testAccCheckObjectDisappears(
materialize.ObjectSchemaStruct{
ObjectType: "SECRET",
Name: secretName,
},
),
),
ExpectNonEmptyPlan: true,
},
},
})
}

@dehume dehume mentioned this pull request Jul 23, 2023
@dehume dehume merged commit ed01ac4 into main Jul 27, 2023
@dehume dehume deleted the Fix-Removed-Grants branch July 27, 2023 16:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants