Merge pull request #10 from getindata/fix/default_secondary_roles

fix: Remove grants for secondary roles + add proper validation to default_secondary_roles input variable

Author: dgniewek

README.md

@@ -45,7 +45,7 @@ module "terraform_snowflake_user" {
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br>  "additional_tag_map": {},<br>  "attributes": [],<br>  "delimiter": null,<br>  "descriptor_formats": {},<br>  "enabled": true,<br>  "environment": null,<br>  "id_length_limit": null,<br>  "label_key_case": null,<br>  "label_order": [],<br>  "label_value_case": null,<br>  "labels_as_tags": [<br>    "unset"<br>  ],<br>  "name": null,<br>  "namespace": null,<br>  "regex_replace_chars": null,<br>  "stage": null,<br>  "tags": {},<br>  "tenant": null<br>}</pre> | no |
 | <a name="input_default_namespace"></a> [default\_namespace](#input\_default\_namespace) | Specifies the namespace (database only or database and schema) that is active by default for the user's session upon login. | `string` | `null` | no |
 | <a name="input_default_role"></a> [default\_role](#input\_default\_role) | Specifies the role that is active by default for the user's session upon login. | `string` | `null` | no |
-| <a name="input_default_secondary_roles"></a> [default\_secondary\_roles](#input\_default\_secondary\_roles) | Specifies the set of secondary roles that are active for the user's session upon login. | `list(string)` | `[]` | no |
+| <a name="input_default_secondary_roles"></a> [default\_secondary\_roles](#input\_default\_secondary\_roles) | Specifies the set of secondary roles that are active for the user's session upon login. <br>    Secondary roles are a set of roles that authorize any SQL action other than the execution of CREATE <object> statements. <br>    Currently only ["ALL"] value is supported | `list(string)` | `[]` | no |
 | <a name="input_default_warehouse"></a> [default\_warehouse](#input\_default\_warehouse) | Specifies the virtual warehouse that is active by default for the user's session upon login. | `string` | `null` | no |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
 | <a name="input_descriptor_formats"></a> [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.<br>Map of maps. Keys are names of descriptors. Values are maps of the form<br>`{<br>   format = string<br>   labels = list(string)<br>}`<br>(Type is `any` so the map values can later be enhanced to provide additional options.)<br>`format` is a Terraform format string to be passed to the `format()` function.<br>`labels` is a list of labels, in order, to pass to `format()` function.<br>Label values will be normalized before being passed to `format()` so they will be<br>identical to how they appear in `id`.<br>Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
@@ -122,7 +122,6 @@ module "terraform_snowflake_user" {
 |------|------|
 | [random_password.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
 | [snowflake_role_grants.default_role](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/role_grants) | resource |
-| [snowflake_role_grants.default_secondary_roles](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/role_grants) | resource |
 | [snowflake_user.this](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/user) | resource |
 | [tls_private_key.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
 <!-- END_TF_DOCS -->

examples/complete/main.tf

@@ -2,10 +2,6 @@ resource "snowflake_role" "user_role" {
   name = "SNOWFLAKE_USER_ROLE"
 }
 
-resource "snowflake_role" "secondary_role" {
-  name = "SNOWFLAKE_SECOND_ROLE"
-}
-
 module "terraform_snowflake_user" {
   source            = "../../"
   context           = module.this.context
@@ -14,5 +10,5 @@ module "terraform_snowflake_user" {
   generate_password = true
 
   default_role            = resource.snowflake_role.user_role.name
-  default_secondary_roles = [resource.snowflake_role.secondary_role.name]
+  default_secondary_roles = ["ALL"]
 }

main.tf

@@ -53,10 +53,3 @@ resource "snowflake_role_grants" "default_role" {
   role_name = var.default_role
   users     = [one(resource.snowflake_user.this[*].name)]
 }
-
-resource "snowflake_role_grants" "default_secondary_roles" {
-  for_each = module.this.enabled && var.grant_default_roles ? toset(var.default_secondary_roles) : []
-
-  role_name = each.key
-  users     = [one(resource.snowflake_user.this[*].name)]
-}

variables.tf

@@ -53,9 +53,17 @@ variable "default_role" {
 }
 
 variable "default_secondary_roles" {
-  description = "Specifies the set of secondary roles that are active for the user's session upon login."
+  description = <<EOT
+    Specifies the set of secondary roles that are active for the user's session upon login. 
+    Secondary roles are a set of roles that authorize any SQL action other than the execution of CREATE <object> statements. 
+    Currently only ["ALL"] value is supported
+  EOT
   type        = list(string)
   default     = []
+  validation {
+    condition     = var.default_secondary_roles == null || contains([0, 1], length(var.default_secondary_roles)) || contains(var.default_secondary_roles, "ALL")
+    error_message = "Currently only [\"ALL\"] value is supported by Snowflake provider."
+  }
 }
 
 variable "rsa_public_key" {