Has anyone figured out to import existing grant priveleges with the generate-config-out flag?

[ndnchapathi69]

I have a role in snowflake and I want to be able to import all the privleges it has been granted so I can build my snowflake_grant_privileges_to_account_role resource. I've seen the examples, but haven't quite figure out how to get it working/setting up on my local.

ROLE: "TEST_ROLE"
SQL: "SHOW GRANTS TO TEST ROLE"

In my import.tf i added:

import {
    to = grant_privileges_to_account_role.TEST_ROLE
    account_role_name = "TEST_ROLE"
    id = "TEST_ROLE"
}

I'm not sure what the id would be considered for the existing role in snowflake.

command: terraform import "TEST_ROLE|TRUE|TRUE|ALL|OnAccount
command: terraform plan -generate-config-out=generated.tf

Any idea what i'm doing wrong?

[sfc-gh-jcieslak]

Hey @ndnchapathi69
Did you check our resource migration document https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/docs/technical-documentation/resource_migration.md? I think it should answer your question.

[ndnchapathi69]

Thanks for sharing @sfc-gh-jcieslak , I wanted to add, we are not doing a resource migration, but have been managing snowflake via UI/SQL for the past few years and have decided to make the shift over to terraform. Specifically for existing granted privileges to roles, is there a recommendation on how i can get everything that is in snowflake to a terraform config file?

[sfc-gh-jcieslak]

Sure, but import is part of the migration. You can read the migration and just assume you're at point 3 where importing is required. The guide describes everything as manual work, but some of those approaches can be easily automated with scripts (language + snowflake driver + some templating engine (e.g. Go text/template) can generate needed terraform constructs). For example, you can take this approach and generate locals+imports in a way that you have one grant resource with for_each representing every grant in your infra. Scripting such tool is easy and can speed up the process of moving to the Terraform approach.

Also if you're not sure what ID you should specify, every resource has Import section in our Terraform documentation (e.g. https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/grant_privileges_to_account_role#import).