generated from getindata/terraform-module-template
-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.tf
168 lines (129 loc) · 5.28 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
data "context_label" "this" {
delimiter = local.context_template == null ? var.name_scheme.delimiter : null
properties = local.context_template == null ? var.name_scheme.properties : null
template = local.context_template
replace_chars_regex = var.name_scheme.replace_chars_regex
values = merge(
var.name_scheme.extra_values,
{ name = var.name }
)
}
resource "tls_private_key" "this" {
count = var.generate_rsa_key ? 1 : 0
algorithm = "RSA"
rsa_bits = 4096
}
resource "random_password" "this" {
count = var.generate_password ? 1 : 0
length = 36
special = true
override_special = "!#$%&*()-_=+[]{}<>:?"
}
resource "snowflake_user" "this" {
count = !var.ignore_changes_on_defaults && upper(var.type) == "PERSON" ? 1 : 0
name = data.context_label.this.rendered
login_name = var.login_name
display_name = var.display_name
comment = var.comment
password = var.generate_password ? one(random_password.this[*].result) : null
must_change_password = var.must_change_password
disabled = var.disabled
disable_mfa = var.disable_mfa
email = var.email
first_name = var.first_name
middle_name = var.middle_name
last_name = var.last_name
default_namespace = var.default_namespace
default_warehouse = var.default_warehouse
default_role = var.default_role
default_secondary_roles_option = var.default_secondary_roles_option #'DEFAULT', 'ALL', 'NONE'
rsa_public_key = local.rsa_public_key
rsa_public_key_2 = var.rsa_public_key_2
query_tag = var.query_tag
timezone = var.timezone
network_policy = var.network_policy
trace_level = var.trace_level
log_level = var.log_level
enable_unredacted_query_syntax_error = var.enable_unredacted_query_syntax_error
}
resource "snowflake_user" "defaults_not_enforced" {
count = var.ignore_changes_on_defaults && upper(var.type) == "PERSON" ? 1 : 0
name = data.context_label.this.rendered
login_name = var.login_name
display_name = var.display_name
comment = var.comment
password = var.generate_password ? one(random_password.this[*].result) : null
must_change_password = var.must_change_password
disabled = var.disabled
disable_mfa = var.disable_mfa
email = var.email
first_name = var.first_name
middle_name = var.middle_name
last_name = var.last_name
default_namespace = var.default_namespace
default_warehouse = var.default_warehouse
default_role = var.default_role
default_secondary_roles_option = var.default_secondary_roles_option #'DEFAULT', 'ALL', 'NONE'
rsa_public_key = local.rsa_public_key
rsa_public_key_2 = var.rsa_public_key_2
query_tag = var.query_tag
timezone = var.timezone
network_policy = var.network_policy
trace_level = var.trace_level
log_level = var.log_level
enable_unredacted_query_syntax_error = var.enable_unredacted_query_syntax_error
lifecycle {
ignore_changes = [
default_namespace,
default_warehouse,
default_role,
]
}
}
resource "snowflake_service_user" "this" {
count = upper(var.type) == "SERVICE" ? 1 : 0
name = data.context_label.this.rendered
login_name = var.login_name
display_name = var.display_name
comment = var.comment
email = var.email
disabled = var.disabled
default_warehouse = var.default_warehouse
default_secondary_roles_option = var.default_secondary_roles_option
default_role = var.default_role
default_namespace = var.default_namespace
rsa_public_key = local.rsa_public_key
rsa_public_key_2 = var.rsa_public_key_2
query_tag = var.query_tag
timezone = var.timezone
network_policy = var.network_policy
trace_level = var.trace_level
log_level = var.log_level
enable_unredacted_query_syntax_error = var.enable_unredacted_query_syntax_error
}
resource "snowflake_legacy_service_user" "this" {
count = upper(var.type) == "LEGACY_SERVICE" ? 1 : 0
name = data.context_label.this.rendered
login_name = var.login_name
display_name = var.display_name
disabled = var.disabled
password = var.generate_password ? one(random_password.this[*].result) : null
must_change_password = var.must_change_password
comment = var.comment
email = var.email
default_warehouse = var.default_warehouse
default_secondary_roles_option = var.default_secondary_roles_option
default_role = var.default_role
default_namespace = var.default_namespace
query_tag = var.query_tag
timezone = var.timezone
network_policy = var.network_policy
trace_level = var.trace_level
log_level = var.log_level
enable_unredacted_query_syntax_error = var.enable_unredacted_query_syntax_error
}
resource "snowflake_grant_account_role" "default_role" {
count = var.grant_default_roles && var.default_role != null ? 1 : 0
user_name = one(local.snowflake_user[*].name)
role_name = var.default_role
}