Identify resources not managed by Terraform?

[davidlee-ca]

At my company we try to manage as many "infrastructure-like" objects like databases, schema, stages, file formats, roles, service users, warehouses, and the grants to tie these together -- you get the idea.

I was wondering if anyone has a trick to identify resources that are not managed by Terraform, so we can manage that drift.

Thank you!

[sfc-gh-swinkler]

Hello @davidlee-ca,
To answer your question, it is necessary first to discuss the limitations of the Terraform provider, followed by going through what is needed to create new Terraform resources.

Limitations of this Provider
This Terraform provider uses the gosnowflake connector to authenticate and perform SQL commands in Snowflake. This means that we can only perform actions that are supported by SQL commands. So ,for example, if there is a REST API but no SQL command, then we cannot manage it with Terraform. In the future, we may create a new Terraform provider which can use the REST API, but that is not something we are actively pursuing now.

Requirements for Creating New Terraform Resources
Terraform resources need hooks into the lifecycle of resources for CRUD operations. If this were a REST API, these would correspond to POST, GET, PATCH, and DELETE. Since this is Snowflake we are talking about, we need CREATE / SHOW / ALTER and DROP instead. Data sources require only READ since they do not modify anything. We also need a way to uniquely identify a resource by using the fully qualified name. If you look at the DDL command summary page, you will see a complete list of possible possibilities. We have also documented this in the README, although this does not include PrPr features yet.

[sfc-gh-swinkler]

Perhaps I am misreading the question. Let me see if I understand correctly:

1. you have some set of resources provisioned using Terraform
2. you have some other set of resources not managed using Terraform. Perhaps created manually
3. How to identify / list all resources not managed by Terraform and bring them under Terraform management

If this is what you are asking for, then it is not as easy of a question to answer. There would need to be some way to mark resources as being managed by Terraform. This could be in the form of a comment, or a tag, or a naming convention for the resource. As not all objects support comments, and object tagging is only possible with Enterprise Edition or higher, neither is a perfect solution.

What I might do instead is run various show commands to list the IDs of the objects you are interested in, for example databases, schemas, tables etc. Then compare that list with what is in your Terraform state file. Any objects that are not in the state file are objects that need to be imported. Importing also means needing to create configuration code that represents the current state of the object. If you are using Terraform 1.15, you can try using the experimental -generate-config-out flag to make this process a bit easier. See documentation here: https://developer.hashicorp.com/terraform/language/import/generating-configuration

In the future we may create a tool that can scan your entire Snowflake account, running all the necessary show commands, and generating Terraform configuration for the entire account. That way you could easily manage any account with Terraform. But that would be a long way off. Hope this helps.