adding new user to user.yaml and running snowddl plan it show deleting existing user

[raginc007]

Adding new user to user.yaml and running snowddl plan it show deleting existing user

can you please help why plan is showing deleting everything which was present in db.

I had below folder structure

snowflake
|
_config
|
snowflake_01
|
DBNAME
|
user.yaml
technical_role.yaml
business_role.yaml
warehouse.yaml

snowflake_02
|
user.yaml

I am running command from _config folder using python file.
command = ["snowddl", "-c", config_folder, "-a", account, "-r", role, "-u", user,"-p", password, "plan"]

Output: of plan --- Suggested DDL ---

DROP ROLE "TEST_WH__MONITOR__W_ROLE";

DROP ROLE "TEST_WH__USAGE__W_ROLE";

DROP ROLE "TEST__RRSAC360__OWNER__S_ROLE";

DROP ROLE "TEST__RRSAC360__READ__S_ROLE";

DROP ROLE "TEST__RRSAC360__WRITE__S_ROLE";

DROP ROLE "TEST_READ_ROLE__B_ROLE";

DROP ROLE "TEST_WRITE_ROLE__B_ROLE";

DROP ROLE "TESTDB_READ_ROLE__B_ROLE";

DROP ROLE "TESTDB_WRITE_ROLE__B_ROLE";

REVOKE ROLE "SYSADMIN" FROM ROLE "TEST_ADMIN_USER__U_ROLE";

CREATE ROLE "TEST__U_ROLE";

GRANT ROLE "TEST__U_ROLE" TO ROLE "USERADMIN";

GRANT ROLE "SYSADMIN__B_ROLE" TO ROLE "TEST__U_ROLE";

CREATE USER "TEST"
PASSWORD = 'HIDING'
LOGIN_NAME = 'TEST'
DISPLAY_NAME = 'TEST'
DISABLED = FALSE
FIRST_NAME = NULL
LAST_NAME = NULL
EMAIL = NULL
DEFAULT_WAREHOUSE = 'TEST_WH'
DEFAULT_NAMESPACE = NULL
DEFAULT_ROLE = "TEST__U_ROLE"
COMMENT = 'User created with SnowDDL' ;

GRANT ROLE "TEST__U_ROLE" TO USER "TEST";

[littleK0i]

Yes, you're supposed to have one super-config with all users bundled together. An entire config is synchornized on every run. Objects which are no longer present in config will be deleted.

Alternatively, you may have multiple SnowDDL admin users and admin roles, one role per config. SnowDDL only tries to delete objects directly owned by current SnowDDL admin role. Objects owned by other roles are untouched.

[raginc]

I tried to use sample config 02 and trying to create technical role through snowddl and assigning to business_role
TESTDB_WRITE_ROLE:
database_owner:
- TESTDB
database_write:
- TESTDB
schema_write:
- TESTDB.*
warehouse_usage:
- TEST_WH
warehouse_monitor:
- TEST_WH
technical_roles:
- TESTDB_OBJ_WRITE_ROLE
comment: "Write Role created with SnowDDL"

technical role.yaml

TESTDB_OBJ_WRITE_ROLE:
grants:
DATABASE:ALL:
- TESTDB.*
STAGE:WRITE:
- TESTDB.*
WAREHOUSE:OPERATE:
- TEST_WH

while apply it says "Role 'TESTDB_OBJ_WRITE_ROLE__B_ROLE' does not exist or not authorized.", even plan didn't show creation of role

[raginc]

I created one role outside snowddl and now am trying to assign it to other role using global role, but it doesn't work out.

TEST_DBA_ROLE:
database_owner:
- TESTDB
warehouse_usage:
- CXPPOC_WH
warehouse_monitor:
- CXPPOC_WH
global_roles:
- DBA_TEST_ROLE

DBA_TEST_ROLE is created outside snowddl.

[littleK0i]

It should work. What is the error message?

[raginc]

is there any way to retrieve password from hashicorp vault using snowDDL?

[littleK0i]

SnowDDL config can be modified in pure Python using programmatic config feature. Any custom scenario is supported, with a bit of effort.

In theory, if vault is now popular and available via API calls, I may consider adding native support for it.