A grant per role causes changes outside terraform and resources are updated

[tekumara]

Provider Version

0.25.22

Terraform Version

1.0.9

Describe the bug

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the last "terraform apply":

  # module.databases["DEV_JAFFLES"].snowflake_database_grant.admin["USAGE"] has been changed
  ~ resource "snowflake_database_grant" "admin" {
        id                = "DEV_JAFFLES|||USAGE|false"
      ~ roles             = [
          - "JAFFLES_ADMIN",
        ]
        # (4 unchanged attributes hidden)
    }

Unless you have made equivalent changes to your configuration, or ignored the relevant attributes using ignore_changes, the following plan may include actions to
undo or respond to these changes.

───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.databases["DEV_JAFFLES"].snowflake_database_grant.admin["USAGE"] will be updated in-place
  ~ resource "snowflake_database_grant" "admin" {
        id                = "DEV_JAFFLES|||USAGE|false"
      ~ roles             = [
          + "JAFFLES_ADMIN",
        ]
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Expected behavior

No changes detected and the grant is not recreated.

Code samples and commands

// reference: https://docs.snowflake.com/en/user-guide/security-access-control-privileges.html

locals {
  reader_privileges = {
    database = ["USAGE"]

  }
  admin_privileges = {
    database = ["USAGE"]
  }
}

// apply reader grants defined above

resource "snowflake_database_grant" "reader" {
  for_each = toset(local.reader_privileges.database)

  database_name = snowflake_database.db.name
  privilege     = each.key
  roles         = var.readers
}

// apply admin grants defined above

resource "snowflake_database_grant" "admin" {
  for_each = toset(local.admin_privileges.database)

  database_name = snowflake_database.db.name
  privilege     = each.key
  roles         = var.admins
}

[tekumara]

Seems if you have two grants for the same privilege with a different set of roles they clobber each other, and the terraform state only reflects the last role applied. On the next apply, terraform thinks there are changes applied outside of Terraform.

To resolve, only have one grant for a privilege, eg:

resource "snowflake_database_grant" "reader" {
  for_each = toset(local.reader_privileges.database)

  database_name = snowflake_database.db.name
  privilege     = each.key
  roles         = concat(var.readers, var.admins)
}

[tekumara]

I do wonder though, could the grants be tracked per role in the state file instead?

[chriscardillo]

Plus one on this issue.

This means that we can only call the grant once, as if we call it more than once it will create duplicate ids.

[tekumara]

Resolved by #824

[matthewoflynn]

As of version 0.29.0 the fix is disabled by default. It can be re-enabled using the enable_multiple_grants optional argument on the *_grant resources.

Relevant PRs: #941 has made the fix #824 disabled by default.