Skip to content

Commit

Permalink
Add grant ownership examples to the guides
Browse files Browse the repository at this point in the history
  • Loading branch information
sfc-gh-jcieslak committed Jan 23, 2025
1 parent 4c89d0a commit 5d33cca
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 18 deletions.
20 changes: 11 additions & 9 deletions docs/guides/grant_ownership_common_use_cases.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,21 +6,23 @@ description: |-
---
# Grant ownership - common use cases

That is a follow-up for the [grant_ownership resource overview](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/docs/technical-documentation/grant_ownership_resource_overview.md) document.
This guide is a follow-up for the [grant_ownership resource overview](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/docs/technical-documentation/grant_ownership_resource_overview.md) document.
Those examples should help you to work with difficulties imposed by Snowflake role management and Terraform.
Here's a list of grant ownership common use cases:

- [Basic RBAC example](#basic-rbac-example)
- [Granting ownership with a less privileged role (granting MANAGED ACCESS)](#granting-ownership-with-a-less-privileged-role-granting-managed-access)
- [Modifying objects you don't own after transferring the ownership](#modifying-objects-you-dont-own-after-transferring-the-ownership)

#### Basic RBAC example
Here's an easy example of using RBAC. Of course, there are many ways to perform RBAC, and here, we are not proposing any
option over the other. It only supposed to show, more or less, how the grant_ownership could be used in such a scenario.
If other problematic cases arise, we will add new examples to this list.

### Basic RBAC example
Here's an easy example of using RBAC (Role-based Access Control). Of course, there are many ways to perform RBAC, and here, we are not proposing any
option over the other. It is only supposed to show, more or less, how the grant_ownership could be used in such a scenario.
Keep in mind that this example uses highly privileged role (ACCOUNTADMIN) and for lower privileges roles, you should look into
other examples to see what else is needed to perform the same actions.

##### First deployment
#### First deployment
This configuration imitates the "main" Terraform deployment that manages the account

```terraform
Expand Down Expand Up @@ -60,7 +62,7 @@ resource "snowflake_grant_ownership" "grant_team_a_database" {
}
```

##### Second deployment
#### Second deployment
If the second deployment uses different user, then the TEST_A_ROLE should be granted to that user in the first deployment first.
By using our ownership of the TEST_DATABASE, we can manage its further access to other teams.

Expand All @@ -84,9 +86,9 @@ resource "snowflake_grant_privileges_to_account_role" "grant_privileges_to_team_
}
```

Then a team using TEAM_B_ROlE can take it from here and create all the tables / views they need.
Then a team using TEAM_B_ROLE can take it from here and create all the tables / views they need.

#### Granting ownership with a less privileged role (granting MANAGED ACCESS)
### Granting ownership with a less privileged role (granting MANAGED ACCESS)

This example shows how less privileged can be used to transfer ownership of the objects they currently own.
Read more in the [official Snowflake documentation](https://docs.snowflake.com/en/sql-reference/sql/grant-privilege#access-control-requirements).
Expand Down Expand Up @@ -134,7 +136,7 @@ Currently, the least privileged role that is able to transfer ownership has to h
In the future, we are planning to support other mechanisms that would allow you to use roles without MANAGE GRANTS.
However, other assumptions would be imposed, e.g., that the current user is granted to the role it transfers the ownership to.

#### Modifying objects you don't own after transferring the ownership
### Modifying objects you don't own after transferring the ownership

By transferring ownership of an object to another role, you are limiting currently used role's access control on this object.
This can lead to another common error of updating object after its ownership was transferred to another role. Note that
Expand Down
20 changes: 11 additions & 9 deletions templates/guides/grant_ownership_common_use_cases.md.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -6,21 +6,23 @@ description: |-
---
# Grant ownership - common use cases

That is a follow-up for the [grant_ownership resource overview](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/docs/technical-documentation/grant_ownership_resource_overview.md) document.
This guide is a follow-up for the [grant_ownership resource overview](https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/docs/technical-documentation/grant_ownership_resource_overview.md) document.
Those examples should help you to work with difficulties imposed by Snowflake role management and Terraform.
Here's a list of grant ownership common use cases:

- [Basic RBAC example](#basic-rbac-example)
- [Granting ownership with a less privileged role (granting MANAGED ACCESS)](#granting-ownership-with-a-less-privileged-role-granting-managed-access)
- [Modifying objects you don't own after transferring the ownership](#modifying-objects-you-dont-own-after-transferring-the-ownership)

#### Basic RBAC example
Here's an easy example of using RBAC. Of course, there are many ways to perform RBAC, and here, we are not proposing any
option over the other. It only supposed to show, more or less, how the grant_ownership could be used in such a scenario.
If other problematic cases arise, we will add new examples to this list.

### Basic RBAC example
Here's an easy example of using RBAC (Role-based Access Control). Of course, there are many ways to perform RBAC, and here, we are not proposing any
option over the other. It is only supposed to show, more or less, how the grant_ownership could be used in such a scenario.
Keep in mind that this example uses highly privileged role (ACCOUNTADMIN) and for lower privileges roles, you should look into
other examples to see what else is needed to perform the same actions.

##### First deployment
#### First deployment
This configuration imitates the "main" Terraform deployment that manages the account

```terraform
Expand Down Expand Up @@ -60,7 +62,7 @@ resource "snowflake_grant_ownership" "grant_team_a_database" {
}
```

##### Second deployment
#### Second deployment
If the second deployment uses different user, then the TEST_A_ROLE should be granted to that user in the first deployment first.
By using our ownership of the TEST_DATABASE, we can manage its further access to other teams.

Expand All @@ -84,9 +86,9 @@ resource "snowflake_grant_privileges_to_account_role" "grant_privileges_to_team_
}
```

Then a team using TEAM_B_ROlE can take it from here and create all the tables / views they need.
Then a team using TEAM_B_ROLE can take it from here and create all the tables / views they need.

#### Granting ownership with a less privileged role (granting MANAGED ACCESS)
### Granting ownership with a less privileged role (granting MANAGED ACCESS)

This example shows how less privileged can be used to transfer ownership of the objects they currently own.
Read more in the [official Snowflake documentation](https://docs.snowflake.com/en/sql-reference/sql/grant-privilege#access-control-requirements).
Expand Down Expand Up @@ -134,7 +136,7 @@ Currently, the least privileged role that is able to transfer ownership has to h
In the future, we are planning to support other mechanisms that would allow you to use roles without MANAGE GRANTS.
However, other assumptions would be imposed, e.g., that the current user is granted to the role it transfers the ownership to.

#### Modifying objects you don't own after transferring the ownership
### Modifying objects you don't own after transferring the ownership

By transferring ownership of an object to another role, you are limiting currently used role's access control on this object.
This can lead to another common error of updating object after its ownership was transferred to another role. Note that
Expand Down

0 comments on commit 5d33cca

Please sign in to comment.