Circular dependency during StorageIntegration with AWS S3

[LouisAmon]

According to the official Snowflake documentation, integrating Snowflake with AWS requires 3 steps:

1. Create Role in AWS (with a basic trust relationship to the S3 service)
2. Create StorageIntegration using the Role ARN from Step 1
3. Update the Role's trust relationship and add a restriction that includes Snowflake's AWS account, user and external ID (obtained from Step 2)

In terms of resource provisioning, this creates a circular dependency:
Role -> StorageIntegration -> Role

I'm wondering how other people in the community usually solve this ?

In AWS, there's a similar example or this regarding ACM SSL Certificates (Certificate -> DNS record -> Certificate) and the way they solved it is by creating an additional resource type (CertificateValidation), therefore breaking the circular dependency (Certificate -> DNS record -> CertificateValidation)

I'm not sure this would help us here, because the 3rd step is on AWS' side but I'm just tossing ideas here ;)

[robbruce]

@LouisAmon - the IAM role you supply into the storage integration does not need to exist beforehand. As you can construct the format of a IAM role arn yourself with interpolation and consistent naming standards, this can be supplied without a reference to the aws_iam_role's arn attribute.

However, if you then go on to use a snowpipe the IAM role does need to exist as Snowflake will check the stage can access the data before accepting the snowpipe definition.

You may also need to add a local exec provisioner to sleep for a few seconds as IAM can be delayed; we add a delay of 5 seconds onto the creation of the stage and a depends_on so that it executes successfully.

[LouisAmon]

That's actually a great solution ! Thanks @robbruce

[robbruce]

@LouisAmon - this can also be used for delaying time when needed https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep