Snowflake-Labs/schemachange

adding array assignment to snowflake_grant_account_role and snowflake_grant_privileges_to_account_role

bob-zarkoob opened this issue · 0 comments

Is your feature request related to a problem? Please describe.
No, but after you added these 2 resources, now we cannot use arrays to create the hierarchy between users and roles, and between roles and roles, now we have create a new resource for each assignment.

Like with snowflake_role_grants we used to have:

resource "snowflake_grant_account_role" "prod_bronze_read_arl" {
  role_name = snowflake_role.prod_bronze_read_arl.name

  roles = [
    snowflake_role.data_analyst_frl.name,
    snowflake_role.tableau_developer_frl.name,
    snowflake_role.data_scientist_frl.name
  ]

and now we to create 3 different resource like this:

resource "snowflake_grant_account_role" "prod_bronze_read_arl_1" {
  role_name        = snowflake_role.prod_bronze_read_arl.name
  parent_role_name = snowflake_role.data_analyst_frl.name
}

resource "snowflake_grant_account_role" "prod_bronze_read_arl_2" {
  role_name        = snowflake_role.prod_bronze_read_arl.name
  parent_role_name = snowflake_role.tableau_developer_frl.name
}

resource "snowflake_grant_account_role" "prod_bronze_read_arl_3" {
  role_name = snowflake_role.prod_bronze_read_arl.name
  parent_role_name = snowflake_role.data_scientist_frl.name
}

Describe the solution you'd like
I like to be able to add users and roles in bulk using arrays.
for snowflake_grant_privileges_to_account_role, I like to be able to add more than one object when granting privilages, like instead of doing 3 different resources to grant select privilage to 3 different objects, having the capability of adding multiple privilages to multiple roles.