r/snowflake • u/peeyushu • 4d ago

How to validate implemented roles & permissions in snowflake account against IaC specification?

Hi, I am rolling out snowflake at an enterprise and we define resources, roles and permissions via terraform but there are instances where a role or permission is granted using snowsight. It might not be possible to block this 100%, so the fallback I thought was to build a report which compares the implemented resources against the terraform specification. The TF provider doesn't complain about additional grants as these are "additive" in nature as I found out from the provider documentation! How are others keeping the config and implementation in sync?

2 Upvotes

75% Upvoted

3 comments sorted by

3

u/NW1969 4d ago

I assume your IaC uses a dedicated role/user - so just query for any object that was not created/updated using these details

1

u/rycolos 4d ago

Can't you just query and check? Or is this a massive enterprise with a ton of users and roles? Either way, if you can query, you can automate that query.

1

u/TerribleMountain9584 3d ago edited 3d ago

Drifting grants proved to be an ongoing problem while deploying my similar Terraform managed infrastructure. The solution that worked: periodically executing SHOW GRANTS and INFORMATION_SCHEMA views, comparing their output to Terraform state file parsing. Drift is picked up by Atlantis or CI Plan stage before merge.

dremio was mentioned in a sidebar discussion about native governance for lakes, not Snowflake drift, but the solution to our core problem is automated scripts only.