Outbound share: table select grant & alter share error

[bhargavpatil-dignifi]

I am creating an outbound share to a reader account of the same type (standard->standard)
In the environment, Database & schema is managed by SnowDDL whereas tables are managed/created using DBT

Below is the snippet of my outbound-share.yaml file:

test_share:
  accounts:
    - test_org.test_reader
  grants:
    DATABASE:USAGE:
      - test_db
    SCHEMA:USAGE:
      - test_db.test_schema
    TABLE:SELECT:
      - test_db.test_schema.*
  
  comment: test share created using snowddl

In Outbound share.yaml, I am facing 2 issues:

1. "TABLE:SELECT: " is not able to detect the tables in the schema.
   Error: it either doesn't run any "grant select to share" or says no table match the wildcard provided in yaml file.

I suspect the issue is because they are not defined in the snowddl config & when i tried to create a test table using snowddl, it run the grant select to the share for that table.
What can be done to solve this in out current setup i.e. dbt creating the tables & not defining it in the snowddl config & have grant select to share run successfully?

2. I am setting the account in the outbound-share.yaml & when snowddl wants to set this using alter share, it is failing, below is the error message:

WARNING - Resolved SHARE [TEST_SHARE]: ERROR
(
    message   =>  SQL compilation error:
invalid property 'SHARE_RESTRICTIONS' for 'SHARE'
    errno     =>  1420
    sqlstate  =>  22023
    sfqid     =>  01bc1b43-0205-20cd-0013-********
    sql       =>  ALTER SHARE "TEST_SHARE" SET ACCOUNTS = "TEST_ORG"."TEST_READER"
SHARE_RESTRICTIONS = FALSE

Due to this, my share is getting created but failing to set the "TO" attribute as seen in "SHOW SHARES" command.

[littleK0i]

1. Since shares do not support future grants, Snowflake leaves us with no other way but adding tables grants to shares directly. Please add GRANT SELECT ON TABLE ... TO SHARE test_share to DBT posthook.
2. This should be fixed in version 0.44.0 and above. SHARE_RESTRICTIONS parameter should only be added if it was explicitly defined in config.

[bhargavpatil-dignifi]

For Point 2:
Re-ran using 0.45.0. Still the same error for share_restrictions=true

WARNING - Resolved SHARE [TEST_SHARE]: ERROR
(
    message   =>  SQL compilation error:
invalid property 'SHARE_RESTRICTIONS' for 'SHARE'
    errno     =>  1420
    sqlstate  =>  22023
    sfqid     =>  01bc1b96-0205-2281-0013-db87024***
    sql       =>  ALTER SHARE "TEST_SHARE" ADD ACCOUNTS = "TEST_ORG"."TEST_READER"
SHARE_RESTRICTIONS = TRUE
)

[bhargavpatil-dignifi]

For Point 1:
Okay! will try the post hook method for select grant to share. Thanks :)

[bhargavpatil-dignifi]

For Point 1: Okay! will try the post hook method for select grant to share. Thanks :)

1. Will it work if i create a view (using snowddl config) using the dbt table on which i was trying to give "select grants to share".
2. Can i use VIEWS:SELECT: in the outbound-share.yaml file? Couldn't find it in the documentation.

[littleK0i]

Do you have proeprty share_restrictions in outbound share config? If so, remove it. Do not mention it at all. If it does not help, I'll take a look and test on STANDARD Snowflake version. My normal tests run at least on ENTERPRISE.

In view, you should not have references to objects created outside of SnowDDL in your config. If you ever try to apply config with such references to new account, it will fail due to lack of objects created by DBT or something else.

So if DBT creates tables, DBT should create views as well.

You may use any privileges. For views it will be VIEW:SELECT, not VIEWS.