Merge pull request #505 from cagov/streamlit-grants

Changes related to STREAMLIT and STAGE creation grants

Author: ian-r-rose

terraform/snowflake/modules/elt/roles.tf

@@ -44,6 +44,13 @@ resource "snowflake_account_role" "logger" {
   comment  = "Permissions to read the SNOWFLAKE metadatabase for logging purposes"
 }
 
+# Adding streamlit role - only for analytics database
+resource "snowflake_account_role" "streamlit_analytics" {
+  provider = snowflake.useradmin
+  name     = "${module.analytics.name}_${var.environment}_STREAMLIT"
+  comment  = "Permissions to create Streamlit applications and stages in the ${module.analytics.name} database for the ${var.environment} environment."
+}
+
 ######################################
 #            Role Grants             #
 ######################################
@@ -206,3 +213,33 @@ resource "snowflake_grant_account_role" "transform_read_to_analytics_rwc" {
   role_name        = "${module.transform.name}_READ"
   parent_role_name = "${module.analytics.name}_READWRITECONTROL"
 }
+
+# Grant the Streamlit roles to the Reporter role in the current environment
+# The cross-environment grant of the ${module.raw.name}_${var.environment}_STREAMLIT role
+# to the REPORTER_DEV role will handled outside of this Terraform configuration.
+# via manual SQL execution
+resource "snowflake_grant_account_role" "streamlit_analytics_to_reporter" {
+  provider         = snowflake.useradmin
+  role_name        = snowflake_account_role.streamlit_analytics.name
+  parent_role_name = snowflake_account_role.reporter.name
+}
+
+locals {
+  streamlit_roles = {
+    analytics = snowflake_account_role.streamlit_analytics.name
+  }
+  databases = {
+    analytics = module.analytics.name
+  }
+}
+
+resource "snowflake_grant_privileges_to_account_role" "streamlit_privileges" {
+  provider          = snowflake.accountadmin
+  for_each          = local.streamlit_roles
+  account_role_name = each.value
+  privileges        = ["CREATE STREAMLIT", "CREATE STAGE"]
+  on_account_object {
+    object_type = "DATABASE"
+    object_name = local.databases[each.key]
+  }
+}