terragrunt project layout

[berosen]

Hi all! Has anyone created a terragrunt project for managing snowflake and have some ideas for a good project structure? I'm a hard time wrapping my head around where to put common resources such as dbs and grants then configuring different user lists per environment.

Thank you!

[robbruce]

@berosen - yes we use terragrunt extensively! We break down our structure as follows:

A terraform module to create top level resources and roles, executed as ACCOUNTADMIN. This layer creates a role we call a CREATOR role, which is given permission to create other resources inside the DB. We make sure that the creator role is included in the outputs and is granted to the same user that terraform is running under.

Separate modules for the different layers we'd create, such as schemas inside a database. However, when defining the provider block we pass in the creator role output as a variable; this ensures that the schema resources (and anything below) are created with the correct role.

[aquibmir]

Hi @robbruce can you share some code samples? I am trying to figure out how to properly structure a terragrunt project with Snowflake.

The idea is to have separate Dev and Prod DBs, schemas, and users/roles with permissions to access Dev or Prod.

Any sample or guidance would be appreciated.

[krishna-indicia]

Hi @robbruce @berosen
Please can you help me by sharing examples where I can generate provider block dynamically using terragrunt.
Below is what i have done so far but still is not working.

###terragrunt.hcl

terraform {
source = "../modules/"
}

locals {
provider_role = ["DBA", "ADMIN"]
}

inputs = {
for idx, name in local.provider_role :
(idx) => {dynaminc_role = name}
}

###modules/main.tf

variable "dynaminc_role" {
type = string
}

output "role_name" {
value = var.dynaminc_role
}

provider "snowflake" {
alias = "dyn_role"
role = var.dynaminc_role
}

resource "snowflake_database" "name" {
provider = snowflake.dyn_role
name = var.database_name
}