-
Notifications
You must be signed in to change notification settings - Fork 427
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: snowflake_user_ownership_grant resource (#969)
- Loading branch information
1 parent
1d1084d
commit 6f3f09d
Showing
13 changed files
with
455 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| --- | ||
| # generated by https://github.com/hashicorp/terraform-plugin-docs | ||
| page_title: "snowflake_user_ownership_grant Resource - terraform-provider-snowflake" | ||
| subcategory: "" | ||
| description: |- | ||
| --- | ||
|
|
||
| # snowflake_user_ownership_grant (Resource) | ||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
| <!-- schema generated by tfplugindocs --> | ||
| ## Schema | ||
|
|
||
| ### Required | ||
|
|
||
| - **on_user_name** (String) The name of the user ownership is granted on. | ||
| - **to_role_name** (String) The name of the role to grant ownership. Please ensure that the role that terraform is using is granted access. | ||
|
|
||
| ### Optional | ||
|
|
||
| - **current_grants** (String) Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. | ||
| - **id** (String) The ID of this resource. | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,152 @@ | ||
| package resources | ||
|
|
||
| import ( | ||
| "database/sql" | ||
| "fmt" | ||
| "log" | ||
| "strings" | ||
|
|
||
| "github.com/chanzuckerberg/terraform-provider-snowflake/pkg/snowflake" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation" | ||
| ) | ||
|
|
||
| var userOwnershipGrantSchema = map[string]*schema.Schema{ | ||
| "on_user_name": { | ||
| Type: schema.TypeString, | ||
| Elem: &schema.Schema{Type: schema.TypeString}, | ||
| Required: true, | ||
| Description: "The name of the user ownership is granted on.", | ||
| ValidateFunc: func(val interface{}, key string) ([]string, []error) { | ||
| return snowflake.ValidateIdentifier(val) | ||
| }, | ||
| }, | ||
| "to_role_name": { | ||
| Type: schema.TypeString, | ||
| Elem: &schema.Schema{Type: schema.TypeString}, | ||
| Required: true, | ||
| Description: "The name of the role to grant ownership. Please ensure that the role that terraform is using is granted access.", | ||
| ValidateFunc: func(val interface{}, key string) ([]string, []error) { | ||
| return snowflake.ValidateIdentifier(val) | ||
| }, | ||
| }, | ||
| "current_grants": { | ||
| Type: schema.TypeString, | ||
| Elem: &schema.Schema{Type: schema.TypeString}, | ||
| Optional: true, | ||
| Description: "Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role.", | ||
| Default: "COPY", | ||
| ValidateFunc: validation.StringInSlice([]string{ | ||
| "COPY", | ||
| "REVOKE", | ||
| }, true), | ||
| }, | ||
| } | ||
|
|
||
| func UserOwnershipGrant() *schema.Resource { | ||
| return &schema.Resource{ | ||
| Create: CreateUserOwnershipGrant, | ||
| Read: ReadUserOwnershipGrant, | ||
| Delete: DeleteUserOwnershipGrant, | ||
| Update: UpdateUserOwnershipGrant, | ||
| Schema: userOwnershipGrantSchema, | ||
| Importer: &schema.ResourceImporter{ | ||
| StateContext: schema.ImportStatePassthroughContext, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func CreateUserOwnershipGrant(d *schema.ResourceData, meta interface{}) error { | ||
| db := meta.(*sql.DB) | ||
| user := d.Get("on_user_name").(string) | ||
| role := d.Get("to_role_name").(string) | ||
| currentGrants := d.Get("current_grants").(string) | ||
|
|
||
| g := snowflake.UserOwnershipGrant(user, currentGrants) | ||
| err := snowflake.Exec(db, g.Role(role).Grant()) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| d.SetId(fmt.Sprintf(`%s|%s|%s`, user, role, currentGrants)) | ||
|
|
||
| return ReadUserOwnershipGrant(d, meta) | ||
| } | ||
|
|
||
| func ReadUserOwnershipGrant(d *schema.ResourceData, meta interface{}) error { | ||
| db := meta.(*sql.DB) | ||
| log.Println(d.Id()) | ||
| user := strings.Split(d.Id(), "|")[0] | ||
| currentGrants := strings.Split(d.Id(), "|")[2] | ||
|
|
||
| stmt := fmt.Sprintf("SHOW USERS LIKE '%s'", user) | ||
| row := snowflake.QueryRow(db, stmt) | ||
|
|
||
| grant, err := snowflake.ScanUserOwnershipGrant(row) | ||
| if err == sql.ErrNoRows { | ||
| // If not found, mark resource to be removed from statefile during apply or refresh | ||
| log.Printf("[DEBUG] user (%s) not found", d.Id()) | ||
| d.SetId("") | ||
| return nil | ||
| } | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if user != grant.Name.String { | ||
| return fmt.Errorf("no user found like '%s'", user) | ||
| } | ||
|
|
||
| grant.Name.String = strings.TrimPrefix(grant.Name.String, `"`) | ||
| grant.Name.String = strings.TrimSuffix(grant.Name.String, `"`) | ||
| err = d.Set("on_user_name", grant.Name.String) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| grant.Owner.String = strings.TrimPrefix(grant.Owner.String, `"`) | ||
| grant.Owner.String = strings.TrimSuffix(grant.Owner.String, `"`) | ||
| err = d.Set("to_role_name", grant.Owner.String) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| err = d.Set("current_grants", currentGrants) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func UpdateUserOwnershipGrant(d *schema.ResourceData, meta interface{}) error { | ||
| db := meta.(*sql.DB) | ||
| user := d.Get("on_user_name").(string) | ||
| role := d.Get("to_role_name").(string) | ||
| currentGrants := d.Get("current_grants").(string) | ||
|
|
||
| d.SetId(fmt.Sprintf(`%s|%s|%s`, user, role, currentGrants)) | ||
|
|
||
| g := snowflake.UserOwnershipGrant(user, currentGrants) | ||
| err := snowflake.Exec(db, g.Role(role).Grant()) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| return ReadUserOwnershipGrant(d, meta) | ||
| } | ||
|
|
||
| func DeleteUserOwnershipGrant(d *schema.ResourceData, meta interface{}) error { | ||
| db := meta.(*sql.DB) | ||
| user := d.Get("on_user_name").(string) | ||
| currentGrants := d.Get("current_grants").(string) | ||
|
|
||
| g := snowflake.UserOwnershipGrant(user, currentGrants) | ||
| err := snowflake.Exec(db, g.Role("ACCOUNTADMIN").Revoke()) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| d.SetId("") | ||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| package resources_test | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "testing" | ||
|
|
||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" | ||
| ) | ||
|
|
||
| func TestAccUserOwnershipGrant_defaults(t *testing.T) { | ||
| user := acctest.RandStringFromCharSet(10, acctest.CharSetAlpha) | ||
| role := acctest.RandStringFromCharSet(10, acctest.CharSetAlpha) | ||
|
|
||
| resource.ParallelTest(t, resource.TestCase{ | ||
| Providers: providers(), | ||
| Steps: []resource.TestStep{ | ||
| { | ||
| Config: userOwnershipGrantConfig(user, role), | ||
| Check: resource.ComposeTestCheckFunc( | ||
| resource.TestCheckResourceAttr("snowflake_user_ownership_grant.grant", "on_user_name", user), | ||
| resource.TestCheckResourceAttr("snowflake_user_ownership_grant.grant", "to_role_name", role), | ||
| resource.TestCheckResourceAttr("snowflake_user_ownership_grant.grant", "current_grants", "COPY"), | ||
| ), | ||
| }, | ||
| }, | ||
| }) | ||
| } | ||
|
|
||
| func userOwnershipGrantConfig(user, role string) string { | ||
| return fmt.Sprintf(` | ||
| resource "snowflake_user" "user" { | ||
| name = "%v" | ||
| } | ||
| resource "snowflake_role" "role" { | ||
| name = "%v" | ||
| } | ||
| resource "snowflake_role_grants" "grants" { | ||
| role_name = snowflake_role.role.name | ||
| roles = [ | ||
| "ACCOUNTADMIN", | ||
| ] | ||
| } | ||
| resource "snowflake_user_ownership_grant" "grant" { | ||
| on_user_name = snowflake_user.user.name | ||
| to_role_name = snowflake_role.role.name | ||
| current_grants = "COPY" | ||
| } | ||
| `, user, role) | ||
| } |
Oops, something went wrong.