feat: Add Snowflake stage resources (#1)

README.md

@@ -1,19 +1,9 @@
-# Terraform Module Template
-
-
-> **Warning**:
-> This is a template document. Remember to **remove** all text in _italics_ and **update** Module name, Repo name and links/badges to the acual name of your GitHub repository/module!!!
-
-<!--- Pick Cloud provider Badge -->
-<!---![Azure](https://img.shields.io/badge/azure-%230072C6.svg?style=for-the-badge&logo=microsoftazure&logoColor=white) -->
-<!---![Google Cloud](https://img.shields.io/badge/GoogleCloud-%234285F4.svg?style=for-the-badge&logo=google-cloud&logoColor=white) -->
-![AWS](https://img.shields.io/badge/AWS-%23FF9900.svg?style=for-the-badge&logo=amazon-aws&logoColor=white)
-<!---![Snowflake](https://img.shields.io/badge/-SNOWFLAKE-249edc?style=for-the-badge&logo=snowflake&logoColor=white) -->
+# Snowflake Stage Terraform Module
+![Snowflake](https://img.shields.io/badge/-SNOWFLAKE-249edc?style=for-the-badge&logo=snowflake&logoColor=white)
 ![Terraform](https://img.shields.io/badge/terraform-%235835CC.svg?style=for-the-badge&logo=terraform&logoColor=white)
 
-<!--- Replace repository name -->
-![License](https://badgen.net/github/license/getindata/terraform-module-template/)
-![Release](https://badgen.net/github/release/getindata/terraform-module-template/)
+![License](https://badgen.net/github/license/getindata/terraform-snowflake-stage/)
+![Release](https://badgen.net/github/release/getindata/terraform-snowflake-stage/)
 
 <p align="center">
   <img height="150" src="https://getindata.com/img/logo.svg">
@@ -22,31 +12,33 @@
 
 ---
 
-_Brief Description of MODULE:_
+Terraform module for Snowflake stage management.
 
-* _What it does_
-* _What techonlogies it uses_
-
-> **Warning**:
-> _When using "Invicton-Labs/deepmerge/null" module - pin `tflint` version to `v0.41.0` in [pre-commit.yaml](.github/workflows/pre-commit.yml) to avoid failing `tflint` checks_
+* Creates Snowflake stage
+* Can create custom Snowflake roles with role-to-role, role-to-user assignments
+* Can create a set of default roles to simplify access management:
+    * `READONLY` - granted `USAGE` or `READ` privilages
+    * `READWRITE` - granted `WRITE` privilages
+    * `ADMIN` - Full access, including schema options like `url` and `credentials`
 
 ## USAGE
 
-_Example usage of the module - terraform code snippet_
-
 ```terraform
-module "template" {
-  source = "getindata/template/null"
+module "snowflake_stage" {
+  source = "getindata/stage/snowflake"
   # version  = "x.x.x"
 
-  example_var = "foo"
+  name     = "my_stage"
+  schema   = "my_schema"
+  database = "my_db"
+  
+  url         = "s3://com.example.bucket/prefix"
+  credentials = "AWS_KEY_ID='${var.example_aws_key_id}' AWS_SECRET_KEY='${var.example_aws_secret_key}'"
+  
+  create_default_roles = true
 }
 ```
 
-## NOTES
-
-_Additional information that should be made public, for ex. how to solve known issues, additional descriptions/suggestions_
-
 ## EXAMPLES
 
 - [Simple](examples/simple) - Basic usage of the module
@@ -63,12 +55,21 @@ _Additional information that should be made public, for ex. how to solve known i
 |------|-------------|------|---------|:--------:|
 | <a name="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.<br>This is for some rare cases where resources want additional configuration of tags<br>and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no |
 | <a name="input_attributes"></a> [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,<br>in the order they appear in the list. New attributes are appended to the<br>end of the list. The elements of the list are joined by the `delimiter`<br>and treated as a single ID element. | `list(string)` | `[]` | no |
+| <a name="input_aws_external_id"></a> [aws\_external\_id](#input\_aws\_external\_id) | ID of the customer AWS account | `string` | `null` | no |
+| <a name="input_comment"></a> [comment](#input\_comment) | Specifies a comment for the stage | `string` | `null` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br>  "additional_tag_map": {},<br>  "attributes": [],<br>  "delimiter": null,<br>  "descriptor_formats": {},<br>  "enabled": true,<br>  "environment": null,<br>  "id_length_limit": null,<br>  "label_key_case": null,<br>  "label_order": [],<br>  "label_value_case": null,<br>  "labels_as_tags": [<br>    "unset"<br>  ],<br>  "name": null,<br>  "namespace": null,<br>  "regex_replace_chars": null,<br>  "stage": null,<br>  "tags": {},<br>  "tenant": null<br>}</pre> | no |
+| <a name="input_copy_options"></a> [copy\_options](#input\_copy\_options) | Specifies the copy options for the stage | `string` | `null` | no |
+| <a name="input_create_default_roles"></a> [create\_default\_roles](#input\_create\_default\_roles) | Whether the default roles should be created | `bool` | `false` | no |
+| <a name="input_credentials"></a> [credentials](#input\_credentials) | Specifies the credentials for the stage | `string` | `null` | no |
+| <a name="input_database"></a> [database](#input\_database) | The database in which to create the stage | `string` | n/a | yes |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
 | <a name="input_descriptor_formats"></a> [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.<br>Map of maps. Keys are names of descriptors. Values are maps of the form<br>`{<br>   format = string<br>   labels = list(string)<br>}`<br>(Type is `any` so the map values can later be enhanced to provide additional options.)<br>`format` is a Terraform format string to be passed to the `format()` function.<br>`labels` is a list of labels, in order, to pass to `format()` function.<br>Label values will be normalized before being passed to `format()` so they will be<br>identical to how they appear in `id`.<br>Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
+| <a name="input_descriptor_name"></a> [descriptor\_name](#input\_descriptor\_name) | Name of the descriptor used to form a resource name | `string` | `"snowflake-stage"` | no |
+| <a name="input_directory"></a> [directory](#input\_directory) | Specifies the directory settings for the stage | `string` | `null` | no |
 | <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
+| <a name="input_encryption"></a> [encryption](#input\_encryption) | Specifies the encryption settings for the stage | `string` | `null` | no |
 | <a name="input_environment"></a> [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
-| <a name="input_example_var"></a> [example\_var](#input\_example\_var) | Example varible passed into the module | `string` | n/a | yes |
+| <a name="input_file_format"></a> [file\_format](#input\_file\_format) | Specifies the file format for the stage | `string` | `null` | no |
 | <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for keep the existing setting, which defaults to `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
 | <a name="input_label_key_case"></a> [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.<br>Does not affect keys of tags passed in via the `tags` input.<br>Possible values: `lower`, `title`, `upper`.<br>Default value: `title`. | `string` | `null` | no |
 | <a name="input_label_order"></a> [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no |
@@ -77,40 +78,51 @@ _Additional information that should be made public, for ex. how to solve known i
 | <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
 | <a name="input_regex_replace_chars"></a> [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.<br>Characters matching the regex will be removed from the ID elements.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
+| <a name="input_roles"></a> [roles](#input\_roles) | Roles created in the database scope | <pre>map(object({<br>    enabled              = optional(bool, true)<br>    comment              = optional(string)<br>    role_ownership_grant = optional(string)<br>    granted_roles        = optional(list(string))<br>    granted_to_roles     = optional(list(string))<br>    granted_to_users     = optional(list(string))<br>    stage_grants         = optional(list(string))<br>  }))</pre> | `{}` | no |
+| <a name="input_schema"></a> [schema](#input\_schema) | The schema in which to create the stage | `string` | n/a | yes |
+| <a name="input_snowflake_iam_user"></a> [snowflake\_iam\_user](#input\_snowflake\_iam\_user) | Specifies the Snowflake IAM user | `string` | `null` | no |
 | <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
+| <a name="input_storage_integration"></a> [storage\_integration](#input\_storage\_integration) | Specifies the name of the storage integration used to delegate authentication responsibility for external cloud storage to a Snowflake identity and access management (IAM) entity | `string` | `null` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
 | <a name="input_tenant"></a> [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
+| <a name="input_url"></a> [url](#input\_url) | Specifies the URL for the stage | `string` | `null` | no |
 
 ## Modules
 
 | Name | Source | Version |
 |------|--------|---------|
+| <a name="module_roles_deep_merge"></a> [roles\_deep\_merge](#module\_roles\_deep\_merge) | Invicton-Labs/deepmerge/null | 0.1.5 |
+| <a name="module_snowflake_custom_role"></a> [snowflake\_custom\_role](#module\_snowflake\_custom\_role) | getindata/role/snowflake | 1.0.3 |
+| <a name="module_snowflake_default_role"></a> [snowflake\_default\_role](#module\_snowflake\_default\_role) | getindata/role/snowflake | 1.0.3 |
+| <a name="module_stage_label"></a> [stage\_label](#module\_stage\_label) | cloudposse/label/null | 0.25.0 |
 | <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| <a name="output_example_output"></a> [example\_output](#output\_example\_output) | Example output of the module |
+| <a name="output_name"></a> [name](#output\_name) | Name of the stage |
+| <a name="output_roles"></a> [roles](#output\_roles) | This stage access roles |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_null"></a> [null](#provider\_null) | 3.1.1 |
+| <a name="provider_snowflake"></a> [snowflake](#provider\_snowflake) | ~> 0.54 |
 
 ## Requirements
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15.0 |
-| <a name="requirement_null"></a> [null](#requirement\_null) | 3.1.1 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
+| <a name="requirement_snowflake"></a> [snowflake](#requirement\_snowflake) | ~> 0.54 |
 
 ## Resources
 
 | Name | Type |
 |------|------|
-| [null_resource.output_input](https://registry.terraform.io/providers/hashicorp/null/3.1.1/docs/resources/resource) | resource |
+| [snowflake_stage.this](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/stage) | resource |
+| [snowflake_stage_grant.this](https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/stage_grant) | resource |
 <!-- END_TF_DOCS -->
 
 ## CONTRIBUTING
@@ -127,7 +139,7 @@ Apache 2 Licensed. See [LICENSE](LICENSE) for full details.
 
 <!--- Replace repository name -->
 <a href="https://github.com/getindata/REPO_NAME/graphs/contributors">
-  <img src="https://contrib.rocks/image?repo=getindata/terraform-module-template" />
+  <img src="https://contrib.rocks/image?repo=getindata/terraform-snowflake-stage" />
 </a>
 
 Made with [contrib.rocks](https://contrib.rocks).

examples/complete/.env.dist

@@ -0,0 +1,4 @@
+SNOWFLAKE_USER=
+SNOWFLAKE_PASSWORD=
+SNOWFLAKE_ROLE=
+SNOWFLAKE_ACCOUNT=

examples/complete/.gitignore

@@ -0,0 +1 @@
+.env

examples/complete/README.md

@@ -1,15 +1,54 @@
 # Complete Example
 
 ```terraform
-module "terraform_module_template" {
+module "snowflake_admin_role" {
+  source  = "getindata/role/snowflake"
+  version = "1.0.3"
+  context = module.this.context
+  name    = "admin"
+}
+
+module "snowflake_dev_role" {
+  source  = "getindata/role/snowflake"
+  version = "1.0.3"
+  context = module.this.context
+  name    = "dev"
+}
+
+resource "snowflake_database" "this" {
+  name = "MY_DATABASE"
+}
+
+resource "snowflake_schema" "this" {
+  name     = "MY_SCHEMA"
+  database = snowflake_database.this.name
+}
+
+module "internal_stage" {
   source  = "../../"
   context = module.this.context
 
-  example_var = "This is a example value."
+  name     = "my_stage"
+  schema   = snowflake_schema.this.name
+  database = snowflake_database.this.name
+
+  comment = "This is my stage"
+
+  create_default_roles = true
+  roles = {
+    readonly = {
+      granted_to_roles = [module.snowflake_dev_role.name]
+    }
+    admin = {
+      granted_to_roles = [module.snowflake_admin_role.name]
+    }
+  }
 }
 ```
 
 ## Usage
+Populate `.env` file with Snowflake credentials and make sure it's sourced to your shell.
+
 ```
 terraform init
 terraform plan -var-file fixtures.tfvars -out tfplan

examples/complete/fixtures.tfvars

@@ -1,5 +1,20 @@
 descriptor_formats = {
-
+  snowflake-role = {
+    labels = ["attributes", "name"]
+    format = "%v_%v"
+  }
+  snowflake-database = {
+    labels = ["environment", "name", "attributes"]
+    format = "%v_%v_%v"
+  }
+  snowflake-schema = {
+    labels = ["name", "attributes"]
+    format = "%v_%v"
+  }
+  snowflake-stage = {
+    labels = ["name", "attributes"]
+    format = "%v_%v_STAGE"
+  }
 }
 
 tags = {

examples/complete/main.tf

@@ -1,6 +1,43 @@
-module "terraform_module_template" {
+module "snowflake_admin_role" {
+  source  = "getindata/role/snowflake"
+  version = "1.0.3"
+  context = module.this.context
+  name    = "admin"
+}
+
+module "snowflake_dev_role" {
+  source  = "getindata/role/snowflake"
+  version = "1.0.3"
+  context = module.this.context
+  name    = "dev"
+}
+
+resource "snowflake_database" "this" {
+  name = "MY_DATABASE"
+}
+
+resource "snowflake_schema" "this" {
+  name     = "MY_SCHEMA"
+  database = snowflake_database.this.name
+}
+
+module "internal_stage" {
   source  = "../../"
   context = module.this.context
 
-  example_var = "This is a example value."
+  name     = "my_stage"
+  schema   = snowflake_schema.this.name
+  database = snowflake_database.this.name
+
+  comment = "This is my stage"
+
+  create_default_roles = true
+  roles = {
+    readonly = {
+      granted_to_roles = [module.snowflake_dev_role.name]
+    }
+    admin = {
+      granted_to_roles = [module.snowflake_admin_role.name]
+    }
+  }
 }

examples/complete/outputs.tf

@@ -1,4 +1,4 @@
-output "example_output" {
-  description = "Example output of the module"
-  value       = module.terraform_module_template
+output "internal_stage" {
+  description = "Internal stage module outputs"
+  value       = module.internal_stage
 }

examples/complete/providers.tf

@@ -1,3 +1 @@
-provider "null" {
-  # Configuration options
-}
+provider "snowflake" {}

examples/complete/versions.tf

@@ -1,10 +1,9 @@
 terraform {
-  required_version = ">= 0.15.0"
-
+  required_version = ">= 1.3"
   required_providers {
-    null = {
-      source  = "hashicorp/null"
-      version = "3.1.1"
+    snowflake = {
+      source  = "Snowflake-Labs/snowflake"
+      version = "~> 0.54"
     }
   }
 }

examples/simple/.env.dist

@@ -0,0 +1,4 @@
+SNOWFLAKE_USER=
+SNOWFLAKE_PASSWORD=
+SNOWFLAKE_ROLE=
+SNOWFLAKE_ACCOUNT=

examples/simple/.gitignore

@@ -0,0 +1 @@
+.env

examples/simple/README.md

@@ -1,14 +1,18 @@
 # Simple Example
 
 ```terraform
-module "terraform_module_template" {
-  source  = "../../"
+module "internal_stage" {
+  source = "../../"
 
-  example_var = "This is a example value."
+  name     = "my_stage"
+  schema   = "my_schema"
+  database = "my_db"
 }
 ```
 
 ## Usage
+Populate `.env` file with Snowflake credentials and make sure it's sourced to your shell.
+
 ```
 terraform init
 terraform plan -out tfplan

examples/simple/main.tf

@@ -1,5 +1,7 @@
-module "terraform_module_template" {
+module "internal_stage" {
   source = "../../"
 
-  example_var = "This is a example value."
+  name     = "my_stage"
+  schema   = "my_schema"
+  database = "my_db"
 }

examples/simple/outputs.tf

@@ -1,4 +1,4 @@
-output "example_output" {
-  description = "Example output of the module"
-  value       = module.terraform_module_template
+output "internal_stage" {
+  description = "Internal stage module outputs"
+  value       = module.internal_stage
 }

examples/simple/providers.tf

@@ -1,3 +1 @@
-provider "null" {
-  # Configuration options
-}
+provider "snowflake" {}

examples/simple/versions.tf

@@ -1,10 +1,9 @@
 terraform {
-  required_version = ">= 0.15.0"
-
+  required_version = ">= 1.3"
   required_providers {
-    null = {
-      source  = "hashicorp/null"
-      version = "3.1.1"
+    snowflake = {
+      source  = "Snowflake-Labs/snowflake"
+      version = "~> 0.54"
     }
   }
 }