chore: Grant ownership common use cases #3356

sfc-gh-jcieslak · 2025-01-23T13:50:46Z

Changes

write and test common grant ownership use cases
link examples from grant ownership doc and grant ownership overview

github-actions · 2025-01-23T13:52:24Z

Integration tests cancelled for 4c89d0a93e47895f8b07a382c7c7cc097a892325

github-actions · 2025-01-23T16:06:45Z

Integration tests failure for 5d33cca65a684439272fb81723230d3765091121

github-actions · 2025-01-24T09:44:25Z

Integration tests cancelled for e59a4285e5bde19bf5137da17746793fcf3ed5d7

github-actions · 2025-01-24T09:48:59Z

Integration tests cancelled for 0a9c6cae80505eae1ea47b0c1b4414f5f999b9e3

sfc-gh-jmichalak · 2025-01-24T11:43:18Z

docs/guides/grant_ownership_common_use_cases.md

+
+### Granting ownership with a less privileged role (granting MANAGED ACCESS)
+
+This example shows how less privileged can be used to transfer ownership of the objects they currently own.


This example shows how a less privileged role can...

sfc-gh-jmichalak · 2025-01-24T11:44:25Z

docs/guides/grant_ownership_common_use_cases.md

+- Ownership of the created above database.
+- MANAGE GRANTS privilege on the currently used role.
+
+Once the ownership is taken away, you still must be able to take the ownership away, so that


Once the ownership is taken away, you still must be able to take the ownership away

This is not clear. Did you mean taking it back to the original role?

Yes, changed a bit. Lmk if that's enough.

sfc-gh-jmichalak · 2025-01-24T11:48:41Z

docs/guides/grant_ownership_common_use_cases.md

+
+This happened, because now, you don't own this database, and your current role cannot perform any actions on it.
+To let the current role modify the database it doesn't own you possibly have a few choices. One of the possible options
+is to grant the currently used role with necessary privilege (we chose this one in the examples below).


Nit: unordered list of the possibilities.

Added numbering

sfc-gh-asawicki · 2025-01-24T11:55:28Z

templates/resources/grant_ownership.md.tmpl

@@ -21,6 +21,8 @@ description: |-
 {{ if .HasExample -}}
 ## Example Usage

+For more examples, head over to our usage guide where we present how to use the grant_ownership resource in [common use cases](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/guides/grant_ownership_common_use_cases).


Relative link pls

sfc-gh-asawicki · 2025-01-24T11:56:52Z

docs/guides/grant_ownership_common_use_cases.md

+---
+# Grant ownership - common use cases
+
+This guide is a follow-up for the [grant_ownership resource overview](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/docs/technical-documentation/grant_ownership_resource_overview.md) document.


permalink pls

sfc-gh-asawicki · 2025-01-24T11:59:01Z

docs/guides/grant_ownership_common_use_cases.md

+# Grant ownership - common use cases
+
+This guide is a follow-up for the [grant_ownership resource overview](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/docs/technical-documentation/grant_ownership_resource_overview.md) document.
+Those examples should help you to work with difficulties imposed by Snowflake role management and Terraform.


let's maybe phrase it without the "difficulties" part: These examples should guide you through Snowflake role management and TF (or something similar)

sfc-gh-asawicki · 2025-01-24T12:00:31Z

docs/guides/grant_ownership_common_use_cases.md

+- [Granting ownership with a less privileged role (granting MANAGED ACCESS)](#granting-ownership-with-a-less-privileged-role-granting-managed-access)
+- [Modifying objects you don't own after transferring the ownership](#modifying-objects-you-dont-own-after-transferring-the-ownership)
+
+If other common problematic cases arise, we will add them to this list.


This list may be further extended with more cases; please approach us through GH issue (link) if you would like to see any others or contribute (permalink to guidelines).

sfc-gh-asawicki · 2025-01-24T12:02:08Z

docs/guides/grant_ownership_common_use_cases.md

+If other common problematic cases arise, we will add them to this list.
+
+### Basic RBAC example
+Here's an easy example of using RBAC (Role-based Access Control). Of course, there are many ways to perform RBAC, and here, we are not proposing any


let's suggest here that they may discuss the possibilities with their account managers and that usual route should be:

come up with the proper rbac for their use case

implement this use case in tf

sfc-gh-asawicki · 2025-01-24T12:04:16Z

docs/guides/grant_ownership_common_use_cases.md

+Once the ownership is taken away, you still must be able to take the ownership away, so that
+the Terraform is able to perform successful delete operation once the resource is removed from the configuration.
+That being said, granting ownership would be still possible without MANAGE GRANTS, but you wouldn't be able to grant
+the ownership back to the original role. This is a common mistake when dealing with ownership transfers. With Terraform, you have to think


can we link the error that appears in such a setup as an example?

I couldn't find anything useful, so I created a simple example showing what would happen.

sfc-gh-asawicki · 2025-01-24T12:05:33Z

docs/guides/grant_ownership_common_use_cases.md

@@ -0,0 +1,294 @@
+---
+page_title: "Grant ownership - common use cases"


general thought: let's link this guide also from our FAQ in the repo, wdyt?

Good point, added

sfc-gh-asawicki · 2025-01-24T12:06:47Z

docs/guides/grant_ownership_common_use_cases.md

+
+### Modifying objects you don't own after transferring the ownership
+
+By transferring ownership of an object to another role, you are limiting currently used role's access control on this object.


let's add here this context about why managing ownership in tf is not aligned well with tf idealogy

sfc-gh-asawicki · 2025-01-24T12:09:17Z

docs/guides/grant_ownership_common_use_cases.md

+There are possibly more paths that lead to the same place, but to keep it simple, we focus on less extreme cases.
+
+Also, keep in mind that the currently used role has MANAGE GRANTS privilege which makes it easier.
+For less privileged roles, your options are very limited, and it would be easier to grant ownership back for a second,


this would be a much better example (it was the one we discussed several times to include). Let's add this which requires granting back.
Do not remove the one already present.

sfc-gh-asawicki · 2025-01-24T12:09:51Z

docs/guides/grant_ownership_common_use_cases.md

+
+Also, keep in mind that the currently used role has MANAGE GRANTS privilege which makes it easier.
+For less privileged roles, your options are very limited, and it would be easier to grant ownership back for a second,
+perform the necessary action and grant the ownership back. For a less invasive approach, you could perform grants manually and import


add this one too. The idea behind these examples were to show possibilities for non-trivial/non-fully-automatic options.

Add grant ownership examples to the guides

4c89d0a

sfc-gh-jcieslak changed the base branch from main to dev January 23, 2025 13:51

Add grant ownership examples to the guides

5d33cca

Add grant ownership examples to the guides

e59a428

Add grant ownership examples to the guides

0a9c6ca

sfc-gh-jcieslak marked this pull request as ready for review January 24, 2025 09:47

sfc-gh-jcieslak requested review from sfc-gh-asawicki and sfc-gh-jmichalak January 24, 2025 09:48

sfc-gh-jmichalak requested changes Jan 24, 2025

View reviewed changes

sfc-gh-asawicki requested changes Jan 24, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Grant ownership common use cases #3356

chore: Grant ownership common use cases #3356

sfc-gh-jcieslak commented Jan 23, 2025 •

edited

Loading

github-actions bot commented Jan 23, 2025

github-actions bot commented Jan 23, 2025

github-actions bot commented Jan 24, 2025

github-actions bot commented Jan 24, 2025

sfc-gh-jmichalak Jan 24, 2025

sfc-gh-jcieslak Jan 29, 2025

sfc-gh-jmichalak Jan 24, 2025

sfc-gh-jcieslak Jan 29, 2025

sfc-gh-jmichalak Jan 24, 2025

sfc-gh-jcieslak Jan 29, 2025

sfc-gh-asawicki Jan 24, 2025

sfc-gh-jcieslak Jan 29, 2025

sfc-gh-asawicki Jan 24, 2025

sfc-gh-jcieslak Jan 29, 2025 •

edited

Loading

sfc-gh-asawicki Jan 24, 2025

sfc-gh-jcieslak Jan 29, 2025

sfc-gh-asawicki Jan 24, 2025

sfc-gh-jcieslak Jan 29, 2025

sfc-gh-asawicki Jan 24, 2025

sfc-gh-jcieslak Jan 29, 2025

sfc-gh-asawicki Jan 24, 2025

sfc-gh-jcieslak Jan 30, 2025 •

edited

Loading

sfc-gh-asawicki Jan 24, 2025

sfc-gh-jcieslak Jan 30, 2025 •

edited

Loading

sfc-gh-asawicki Jan 24, 2025

sfc-gh-jcieslak Jan 30, 2025

sfc-gh-asawicki Jan 24, 2025

sfc-gh-asawicki Jan 24, 2025


		### Granting ownership with a less privileged role (granting MANAGED ACCESS)

		This example shows how less privileged can be used to transfer ownership of the objects they currently own.

		@@ -0,0 +1,294 @@
		---
		page_title: "Grant ownership - common use cases"


		### Modifying objects you don't own after transferring the ownership

		By transferring ownership of an object to another role, you are limiting currently used role's access control on this object.

chore: Grant ownership common use cases #3356

Are you sure you want to change the base?

chore: Grant ownership common use cases #3356

Conversation

sfc-gh-jcieslak commented Jan 23, 2025 • edited Loading

Changes

github-actions bot commented Jan 23, 2025

github-actions bot commented Jan 23, 2025

github-actions bot commented Jan 24, 2025

github-actions bot commented Jan 24, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sfc-gh-jcieslak Jan 29, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sfc-gh-jcieslak Jan 30, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sfc-gh-jcieslak Jan 30, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sfc-gh-jcieslak commented Jan 23, 2025 •

edited

Loading

sfc-gh-jcieslak Jan 29, 2025 •

edited

Loading

sfc-gh-jcieslak Jan 30, 2025 •

edited

Loading

sfc-gh-jcieslak Jan 30, 2025 •

edited

Loading