1010# ###########################
1111
1212terraform {
13+ required_version = " >= 1.0"
14+
1315 required_providers {
1416 snowflake =
1517 source = " Snowflake-Labs/snowflake"
@@ -24,38 +26,55 @@ terraform {
2426 }
2527}
2628
27- # Create the POLICIES database to store password/authentication policies
29+ # POLICIES database (import if it already exists)
2830resource "snowflake_database" "policies" {
2931 provider = . accountadmin
3032 name = . policies_database_name
31-
32- # If POLICIES already exists (e.g., created manually from docs),
33- # import it before first apply:
34- # terraform import module.policies.snowflake_database.policies POLICIES
33+ # import hint:
34+ # terraform import module.policies.snowflake_database.policies POLICIES
3535}
36- # Account-level logging role
36+
37+ # account-level role & warehouse (no env vars)
3738resource "snowflake_account_role" "logger" {
3839 provider = . securityadmin
39- name = " LOGGER_ ${ var . environment } "
40+ name = " LOGGER_PRD "
4041 comment = " Account-level role for logging tasks"
4142}
4243
43- # Account-level logging warehouse
4444resource "snowflake_warehouse" "logging" {
45- provider = . sysadmin
46- name = " LOGGING_ ${ var . environment } _WH "
47- warehouse_size = " XSMALL"
48- auto_suspend = 60
49- auto_resume = true
45+ provider = . sysadmin
46+ name = " LOGGING_PRD_WH "
47+ warehouse_size = " XSMALL"
48+ auto_suspend = 60
49+ auto_resume = true
5050 initially_suspended = true
51- comment = " Warehouse used by Sentinel/logging tasks"
51+ comment = " Warehouse used by Sentinel/logging tasks (PRD)"
52+ }
53+
54+ # ßSentinel service user
55+ resource "snowflake_legacy_service_user" "sentinel" {
56+ provider = . useradmin
57+ name = " SENTINEL_SVC_USER"
58+ comment = " Service user for Sentinel"
59+
60+ lifecycle { ignore_changes = rsa_public_key ] }
61+
62+ default_warehouse = . logging . name
63+ default_role = . logger . name
64+ }
65+
66+ # Grant LOGGER_PRD to Sentinel
67+ resource "snowflake_grant_account_role" "logger_to_sentinel" {
68+ provider = . useradmin
69+ role_name = . logger . name
70+ user_name = . sentinel . name
5271}
5372
5473# Default user password policy
5574resource "snowflake_password_policy" "user_password_policy" {
5675 provider = . accountadmin
57- database = . policies . name # Database name
58- schema = " PUBLIC" # Schema name
76+ database = . policies . name
77+ schema = " PUBLIC"
5978 name = " user_password_policy"
6079 min_length = 14
6180 min_upper_case_chars = 1
@@ -65,100 +84,77 @@ resource "snowflake_password_policy" "user_password_policy" {
6584 max_retries = 5
6685 lockout_time_mins = 30
6786 history = 5
68- or_replace = true # Ensures the policy can be updated without errors
87+ or_replace = true
6988}
7089
71- # Set the default password policy for the account
90+ # Attach password policy at account level
7291resource "snowflake_account_password_policy_attachment" "attachment" {
7392 provider = . accountadmin
7493 password_policy = . user_password_policy . fully_qualified_name
7594}
7695
77- // Defines an authentication policy for ODI human users that enforces Okta-only authentication via SAML.
96+ # Auth policies (Okta-only for human users, etc.)
7897resource "snowflake_authentication_policy" "odi_okta_only" {
79- count = . okta_integration_name == null ? 0 : 1 // meta-argument to conditionally create the resource
80- provider = . accountadmin
81- database = . policies . name # Database name
82- schema = " PUBLIC" # Schema name
83- name = " odi_okta_only"
84- authentication_methods = " SAML"
85- security_integrations = var . okta_integration_name ] # Okta security integration name
86- comment = " Okta-only authentication policy for ODI human users"
98+ count = . okta_integration_name == null ? 0 : 1
99+ provider = . accountadmin
100+ database = . policies . name
101+ schema = " PUBLIC"
102+ name = " odi_okta_only"
103+ authentication_methods = " SAML"
104+ security_integrations = var . okta_integration_name ]
105+ comment = " Okta-only authentication policy for ODI human users (PRD) "
87106}
88107
89- // Defines an authentication policy for external human users that enforces password-based authentication with Duo MFA.
90- resource "snowflake_authentication_policy" "external_duo_mfa" {
108+ resource "snowflake_authentication_policy" "admin_okta_duo" {
109+ count = var . okta_integration_name == null ? 0 : 1
91110 provider = . accountadmin
92- database = . policies . name # Database name
93- schema = " PUBLIC" # Schema name
94- name = " external_duo_mfa "
95- authentication_methods = " PASSWORD"
111+ database = . policies . name
112+ schema = " PUBLIC"
113+ name = " admin_okta_duo "
114+ authentication_methods = " SAML " , " PASSWORD"
96115 mfa_authentication_methods = " PASSWORD"
97116 mfa_enrollment = " REQUIRED"
98- client_types = " SNOWFLAKE_UI" " DRIVERS" " SNOWSQL" # MFA enrollment requires SNOWFLAKE_UI
99- comment = " Duo-MFA-only authentication policy for external human users"
117+ client_types = " SNOWFLAKE_UI" " DRIVERS" " SNOWSQL"
118+ security_integrations = var . okta_integration_name ]
119+ comment = " Okta and Duo-MFA policy for admin users (PRD)"
100120}
101121
102- // Defines an authentication policy for admin human users that allows both Okta SAML and password-based authentication with Duo MFA.
103- resource "snowflake_authentication_policy" "admin_okta_duo" {
104- count = . okta_integration_name == null ? 0 : 1 // meta-argument to conditionally create the resource
122+ resource "snowflake_authentication_policy" "external_duo_mfa" {
105123 provider = . accountadmin
106- database = . policies . name # Database name
107- schema = " PUBLIC" # Schema name
108- name = " admin_okta_duo "
109- authentication_methods = " SAML " , " PASSWORD"
124+ database = . policies . name
125+ schema = " PUBLIC"
126+ name = " external_duo_mfa "
127+ authentication_methods = " PASSWORD"
110128 mfa_authentication_methods = " PASSWORD"
111129 mfa_enrollment = " REQUIRED"
112130 client_types = " SNOWFLAKE_UI" " DRIVERS" " SNOWSQL"
113- security_integrations = var . okta_integration_name ] # Okta security integration name
114- comment = " Okta and Duo-MFA authentication policy for admin human users"
131+ comment = " Duo-MFA-only authentication policy for external human users (PRD)"
115132}
116133
117- // Defines an authentication policy for most service accounts that enforces key-pair authentication.
118134resource "snowflake_authentication_policy" "service_account_keypair" {
119- provider = . accountadmin
120- database = . policies . name # Database name
121- schema = " PUBLIC" # Schema name
122- name = " service_account_keypair"
123- authentication_methods = " KEYPAIR"
124- client_types = " DRIVERS" " SNOWSQL"
125- comment = " Key-pair only authentication policy for most service accounts"
135+ provider = . accountadmin
136+ database = . policies . name
137+ schema = " PUBLIC"
138+ name = " service_account_keypair"
139+ authentication_methods = " KEYPAIR"
140+ client_types = " DRIVERS" " SNOWSQL"
141+ comment = " Key-pair only authentication policy for most service accounts (PRD) "
126142}
127143
128- // Defines an authentication policy for legacy service accounts that enforces password-based authentication.
129144resource "snowflake_authentication_policy" "legacy_service_password" {
130- provider = . accountadmin
131- database = . policies . name # Database name
132- schema = " PUBLIC" # Schema name
133- name = " legacy_service_password"
134- authentication_methods = " PASSWORD"
135- client_types = " DRIVERS" " SNOWSQL"
136- comment = " Password-only authentication policy for legacy service accounts"
145+ provider = . accountadmin
146+ database = . policies . name
147+ schema = " PUBLIC"
148+ name = " legacy_service_password"
149+ authentication_methods = " PASSWORD"
150+ client_types = " DRIVERS" " SNOWSQL"
151+ comment = " Password-only authentication policy for legacy service accounts (PRD) "
137152}
138153
139- # Set odi_okta_only as the default authentication policy for the account
154+ # Set odi_okta_only as the default account auth policy (fmt-clean)
140155resource "snowflake_account_authentication_policy_attachment" "default_policy" {
141156 count = . okta_integration_name == null ? 0 : 1
157+
142158 provider = . accountadmin
143159 authentication_policy = . odi_okta_only [0 ]. fully_qualified_name
144160}
145-
146- # Create a sentinel service user with password authentication (legacy service user)
147- resource "snowflake_legacy_service_user" "sentinel" {
148- provider = . useradmin
149- name = " SENTINEL_SVC_USER"
150- comment = " Service user for Sentinel"
151- lifecycle {
152- ignore_changes = rsa_public_key ]
153- }
154- # no cross-module references; use resources created here
155- default_warehouse = . logging . name
156- default_role = . logger . name
157- }
158-
159- # Grant LOGGER to Sentinel
160- resource "snowflake_grant_account_role" "logger_to_sentinel" {
161- provider = . useradmin
162- role_name = . logger . name
163- user_name = . sentinel . name
164- }
0 commit comments