[Bug]: Error on snowflake_grant_privileges_to_account_role & snowflake_grant_ownership with procedures

[filipe-alves-itech]

Terraform CLI Version

0.97.0

Terraform Provider Version

1.9.7

Terraform Configuration

The identifier for functions and procedures described in the documentation (https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/guides/identifiers) doesn't work for the resources snowflake_grant_privileges_to_account_role and snowflake_grant_ownership

According to the documentation, the correct identifier format is:

“\”${snowflake_procedure.database}\”.\”${snowflake_procedure.schema}\”.\”${snowflake_procedure.name}(NUMBER, VARCHAR)\””

The identifier format that actually works:

“\”${snowflake_procedure.database}\”.\”${snowflake_procedure.schema}\”.\”${snowflake_procedure.name}\”(NUMBER, VARCHAR)”

Category

category:resource

Object type(s)

resource:snowflake_grant_privileges_to_account_role
resource:snowflake_grant_ownership

Expected Behavior

The documented identifier

Actual Behavior

The documented identifier format works.

Steps to Reproduce

Terraform code:

terraform {
  required_providers {
    snowflake = {
      source  = "snowflake-labs/snowflake"
      version = "0.97.0"
    }
  }

  required_version = ">= 1.9.7"
}

resource "snowflake_grant_ownership" "example" {
  account_role_name   = "DEV_DEVELOPER"
  outbound_privileges = "REVOKE"
  on {
    object_type = "FUNCTION"
    object_name = "\"DEV_DWH\".\"ADMIN\".\"SAY_HI(VARCHAR)\""
  }
}

resource "snowflake_grant_privileges_to_account_role" "example" {
  account_role_name = "DEV_DEVELOPER"
  privileges        = ["USAGE"]
  with_grant_option = false

  on_schema_object {
    object_type = "FUNCTION"
    object_name = "\"DEV_DWH\".\"ADMIN\".\"SAY_HI(VARCHAR)\""
  }
}

Run terraform apply -auto-approve

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # snowflake_grant_ownership.example will be created
  + resource "snowflake_grant_ownership" "example" {
      + account_role_name   = "DEV_DEVELOPER"
      + id                  = (known after apply)
      + outbound_privileges = "REVOKE"

      + on {
          + object_name = "\"DEV_DWH\".\"ADMIN\".\"SAY_HI(VARCHAR)\""
          + object_type = "FUNCTION"
        }
    }

  # snowflake_grant_privileges_to_account_role.example will be created
  + resource "snowflake_grant_privileges_to_account_role" "example" {
      + account_role_name = "DEV_DEVELOPER"
      + all_privileges    = false
      + always_apply      = false
      + id                = (known after apply)
      + on_account        = false
      + privileges        = [
          + "USAGE",
        ]
      + with_grant_option = false

      + on_schema_object {
          + object_name = "\"DEV_DWH\".\"ADMIN\".\"SAY_HI(VARCHAR)\""
          + object_type = "FUNCTION"
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.
snowflake_grant_ownership.example: Creating...
snowflake_grant_privileges_to_account_role.example: Creating...
╷
│ Error: unable to read identifier: "DEV_DWH"."ADMIN"."SAY_HI, err = parse error on line 1, column 26: extraneous or missing " in quoted-field
│ 
│   with snowflake_grant_ownership.example,
│   on main.tf line 1, in resource "snowflake_grant_ownership" "example":
│    1: resource "snowflake_grant_ownership" "example" {
│ 
╵
╷
│ Error: unable to read identifier: "DEV_DWH"."ADMIN"."SAY_HI, err = parse error on line 1, column 26: extraneous or missing " in quoted-field
│ 
│   with snowflake_grant_privileges_to_account_role.example,
│   on main.tf line 10, in resource "snowflake_grant_privileges_to_account_role" "example":
│   10: resource "snowflake_grant_privileges_to_account_role" "example" {
│ 
╵

How much impact is this issue causing?

Low

Logs

No response

Additional Information

Unsure if the error is with the documentation or the resource behaviour, but surely they should match.

Would you like to implement a fix?

• Yeah, I'll take it 😎

[sfc-gh-jmichalak]

Hi @filipe-alves-itech 👋

This is an error in the documentation, we'll fix it in the next release. The correct format is

“\”${snowflake_procedure.database}\”.\”${snowflake_procedure.schema}\”.\”${snowflake_procedure.name}\”(NUMBER, VARCHAR)”

Keep in mind that we've introduced the fully_qualified_name field, which is a preferred way of referencing other resources. If you manage this procedure in Terraform as well, simply use

resource "snowflake_grant_privileges_to_account_role" "example" {
  account_role_name = "DEV_DEVELOPER"
  privileges        = ["USAGE"]
  with_grant_option = false

  on_schema_object {
    object_type = "FUNCTION"
    object_name = snowflake_procedure.procedure_name.fully_qualified_name
  }
}

[sfc-gh-jmichalak]

Hi @filipe-alves-itech 👋

We've released a new v0.98.0 version (release, migration guide) with updated documentation.

[sfc-gh-jmichalak]

Closing due to inactivity. Please create a new issue if the problem persists in the newest version.