snowflake_table_grant on all tables to share

[florencewambui]

Snowflake documentation states that it's possible to grant SELECT privilege on all tables in a particular schema to a share. However, Terraform Provider Snowflake snowflake_table_grant grant does not allow this as "Grants privilege to these shares (only valid if on_future or on_all are unset).".

1. Are there plans to align snowflake_table_grant with Snowflake documentation by allowing use of on_all with shares?
2. How are others simplifying data sharing with shares given the current limitation of snowflake_table_grant? Are there alternatives to using multiple snowflake_table_grant/snowflake_view_grant when sharing multiple tables in the same schema?

[sfc-gh-jcieslak]

Hey, snowflake_<resource-name>_grant resources are deprecated. We're in the process of redesigning/implementing new grant resources to fully support Snowflake grant capabilities. We're not planning to improve deprecated resources, so please check what is available in the non-deprecated ones, but the grant <privileges> to share resource is a high priority for us and should be released, soon. We'll keep you posted and ping you here as soon as the resource is available.

[florencewambui]

Thank you. I see, V0.85.0, grant_privileges_to_share resource supports privilege SELECT on all tables in schema.

[sfc-gh-jcieslak]

Yeah, sorry. My bad that I didn't get back to you, but I'm glad that we provided what you needed :)

[florencewambui]

Thank you.

A follow up question:
What is the Terraform equivalent of rerunning grant select on all tables in schema db_name.schema_name to share share_name in Snowflake UI whenever new tables, that need to be shared with the share, are added to schema db_name.schema_name?

Context:
The first time we create a share and grant select on existing tables in schema db_name.schema_name to a share, all existing tables are added to the share. When we add new tables to db_name.schema_name (outside Terraform), they are not added to the share as Snowflake only allows grant select on all tables to share, but not grant select on future tables to share. Currently, we are going to Snowflake UI to rerun grant select on all tables in schema db_name.schema_name to share share_name so that the new tables in db_name.schema_name are added to the share.
Is there a way of doing this via Terraform - telling terraform there are new objects in db_name.schema_name (created outside Terraform) run grant select on all tables in schema db_name.schema_name to share share_name afresh even though there no changes on tf files?

[sfc-gh-jcieslak]

Hey, maybe there are other hacky ways to achieve it, but I found something like this: https://developer.hashicorp.com/terraform/cli/state/taint. In snowflake_grant_privileges_to_account_role and snowflake_grant_privileges_to_database_role we added the always_apply flag which basically does what you described (calling grant command per terraform apply). I'll create a task for us, because that's something that, most likely, should also be present in the snowflake_grant_privileges_to_share. For now, as a workaround, you can use the terraform -replace argument. Another workaround could be using this meta-argument (https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#replace_triggered_by) with some kind of random resource (e.g. https://registry.terraform.io/providers/hashicorp/random/latest).

[florencewambui]

Thank you. I will try the two suggested workarounds and watch out for always_apply flag.