[fix] Fix Snowflake ALL modules on_future

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
             - uses: actions/checkout@v2
             - uses: hashicorp/setup-terraform@v1
               with:
-                terraform_version: 0.12.30
+                terraform_version: 0.13.6
                 terraform_wrapper: "false"
             - name: setup
               run: make setup
@@ -24,8 +24,55 @@ jobs:
               name: linters
               run: make lint-ci
     test:
+        env:
+            SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
+            SNOWFLAKE_PASSWORD: ${{ secrets.SNOWFLAKE_PASSWORD }}
+            SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }}
         name: test ${{ matrix.module }}
         runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v2
+            - id: filter
+              uses: dorny/paths-filter@v2
+              with:
+                filters: |
+                    module:
+                      - '${{ matrix.module }}/**'
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              uses: hashicorp/setup-terraform@v1
+              with:
+                terraform_version: 0.13.6
+                terraform_wrapper: "false"
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              uses: actions/setup-go@v2
+              with:
+                go-version: 1.14.3
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              name: Install bless provider
+              run: curl -s https://raw.githubusercontent.com/chanzuckerberg/terraform-provider-bless/main/download.sh | bash -s -- -b $HOME/.terraform.d/plugins/ -d
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              name: Check bless provider
+              run: ls -al $HOME/.terraform.d/plugins/terraform-provider-bless*
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              name: Install Snowflake provider
+              run: curl -s https://raw.githubusercontent.com/chanzuckerberg/terraform-provider-snowflake/main/download.sh | bash -s -- -b $HOME/.terraform.d/plugins/ -d
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              name: Check Snowflake provider
+              run: ls -al $HOME/.terraform.d/plugins/terraform-provider-snowflake*
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              run: aws configure set aws_access_key_id ${{ secrets.CI1_AWS_ACCESS_KEY_ID }} --profile cztack-ci-1
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              run: aws configure set aws_secret_access_key ${{ secrets.CI1_AWS_SECRET_ACCESS_KEY }} --profile cztack-ci-1
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              run: aws --profile cztack-ci-1 sts get-caller-identity
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              run: aws configure set aws_access_key_id ${{ secrets.CI2_AWS_ACCESS_KEY_ID }} --profile cztack-ci-2
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              run: aws configure set aws_secret_access_key ${{ secrets.CI2_AWS_SECRET_ACCESS_KEY }} --profile cztack-ci-2
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              run: aws --profile cztack-ci-2 sts get-caller-identity
+            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
+              run: make test-ci TEST=./${{ matrix.module }}
         strategy:
             fail-fast: false
             matrix:
@@ -76,7 +123,6 @@ jobs:
                     - aws-sns-lambda
                     - aws-ssm-params
                     - aws-ssm-params-writer
-                    # - bless-ca/test
                     - github-webhooks-to-s3
                     - module-template
                     - snowflake-account-grant-all
@@ -95,54 +141,10 @@ jobs:
                     - snowflake-table-grant-all
                     - snowflake-view-grant-all
                     - snowflake-warehouse-grant-all
-        steps:
-            - uses: actions/checkout@v2
-            - id: filter
-              uses: dorny/paths-filter@v2
-              with:
-                filters: |
-                    module:
-                      - '${{ matrix.module }}/**'
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              uses: hashicorp/setup-terraform@v1
-              with:
-                terraform_version: 0.12.30
-                terraform_wrapper: "false"
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              uses: actions/setup-go@v2
-              with:
-                go-version: 1.14.3
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              name: Install bless provider
-              run: curl -s https://raw.githubusercontent.com/chanzuckerberg/terraform-provider-bless/main/download.sh | bash -s -- -b $HOME/.terraform.d/plugins/ -d
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              name: Check bless provider
-              run: ls -al $HOME/.terraform.d/plugins/terraform-provider-bless*
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              name: Install Snowflake provider
-              run: curl -s https://raw.githubusercontent.com/chanzuckerberg/terraform-provider-snowflake/main/download.sh | bash -s -- -b $HOME/.terraform.d/plugins/ -d
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              name: Check Snowflake provider
-              run: ls -al $HOME/.terraform.d/plugins/terraform-provider-snowflake*
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              run: aws configure set aws_access_key_id ${{ secrets.CI1_AWS_ACCESS_KEY_ID }} --profile cztack-ci-1
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              run: aws configure set aws_secret_access_key ${{ secrets.CI1_AWS_SECRET_ACCESS_KEY }} --profile cztack-ci-1
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              run: aws --profile cztack-ci-1 sts get-caller-identity
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              run: aws configure set aws_access_key_id ${{ secrets.CI2_AWS_ACCESS_KEY_ID }} --profile cztack-ci-2
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              run: aws configure set aws_secret_access_key ${{ secrets.CI2_AWS_SECRET_ACCESS_KEY }} --profile cztack-ci-2
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              run: aws --profile cztack-ci-2 sts get-caller-identity
-            - if: github.event == 'push' || steps.filter.outputs.module == 'true'
-              run: make test-ci TEST=./${{ matrix.module }}
-
         timeout-minutes: 45
 name: CI
 "on":
-    pull_request:
+    pull_request: null
     push:
         branches:
             - main

.gitignore

@@ -4,3 +4,4 @@
 bin
 .idea
 .test-data
+.terraform.lock.hcl

scripts/snowflake_generate_grant_all/Makefile

@@ -1,6 +1,7 @@
 run:
 	go run .
 	$(MAKE) -C ../.. docs
+	$(MAKE) -C ../.. fmt
 .PHONY: run
 
 update-deps:

scripts/snowflake_generate_grant_all/main.go

@@ -192,9 +192,11 @@ func generateModule(name string, grant *resources.TerraformGrantResource) ([]byt
 				lookup(var.per_privilege_grants, each.value, %s).roles,
 				)}`, defaultPrivType)
 		case "shares":
-			resourceAll["shares"] = fmt.Sprintf(`${setunion(
-				var.shares,
-				lookup(var.per_privilege_grants, each.value, %s).shares,
+			resourceAll["shares"] = fmt.Sprintf(`${
+				var.shares == null ? null :
+				setunion(
+					var.shares,
+					lookup(var.per_privilege_grants, each.value, %s).shares,
 				)}`, defaultPrivType)
 		default:
 			resourceAll[elementName] = fmt.Sprintf("${var.%s}", elementName)
@@ -240,7 +242,3 @@ func reverseType(s *schema.Schema) (string, error) {
 		return "", errors.Newf("Unrecognized type %s", t.String())
 	}
 }
-
-func optString(s string) *string {
-	return &s
-}

scripts/snowflake_generate_grant_all/test_generate.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/chanzuckerberg/go-misc/sets"
 	"github.com/chanzuckerberg/terraform-provider-snowflake/pkg/resources"
 )
 
@@ -26,19 +27,38 @@ import (
 )
 
 const vars string = %q
+const onFutureVars string = %q
 
 func TestModule(t *testing.T) {
 	test := tftest.Test{
-		// just run init, swtich to Plan or Apply when you can
-		Mode: tftest.Init,
+		Mode: tftest.Plan,
 
 		Setup: func(t *testing.T) *terraform.Options {
-			opts := tftest.Options(
-				tftest.DefaultRegion,
-				mustJson(vars),
-			)
-			opts.TerraformDir = "."
+			opts := &terraform.Options{
+				TerraformDir: ".",
+				EnvVars:      map[string]string{},
+				Vars:         mustJson(vars),
+			}
+			return opts
+		},
+		Validate: func(t *testing.T, options *terraform.Options) {},
+	}
 
+	test.Run(t)
+}
+
+func TestModule_onFuture(t *testing.T) {
+	if onFutureVars == "" {
+		return // nothing to test, no future vars
+	}
+	test := tftest.Test{
+		Mode: tftest.Plan,
+		Setup: func(t *testing.T) *terraform.Options {
+			opts := &terraform.Options{
+				TerraformDir: ".",
+				EnvVars:      map[string]string{},
+				Vars:         mustJson(vars),
+			}
 			return opts
 		},
 		Validate: func(t *testing.T, options *terraform.Options) {},
@@ -59,6 +79,53 @@ func mustJson(jsonData string) map[string]interface{} {
 `
 )
 
+func hasOnFutureProperty(grant *resources.TerraformGrantResource) bool {
+	_, ok := grant.Resource.Schema["on_future"]
+	return ok
+}
+
+// generateFutureVars generates vars for on_future=true tests
+func generateFutureTestVars(grant *resources.TerraformGrantResource) map[string]interface{} {
+	vars := map[string]interface{}{}
+
+	// no on-future so nothing to test here
+	if !hasOnFutureProperty(grant) {
+		return vars
+	}
+
+	conflictsWith := sets.NewStringSet().Add(grant.Resource.Schema["on_future"].ConflictsWith...)
+
+	vars["on_future"] = true
+
+	for name := range grant.Resource.Schema {
+		// conflicts, skip
+		if conflictsWith.ContainsElement(name) {
+			continue
+		}
+
+		if strings.HasSuffix(name, "_name") {
+			vars[name] = strings.TrimSuffix(name, "_name")
+			continue
+		}
+
+		if name == "roles" {
+			vars[name] = []string{"role_a", "role_b", "role_c"}
+			continue
+		}
+
+		if name == "arguments" {
+			vars[name] = []map[string]string{
+				{
+					"name": "foo",
+					"type": "STRING",
+				},
+			}
+			continue
+		}
+	}
+	return vars
+}
+
 // generateVars currently generates vars for a basic integration test
 // many input variable combinations are currently missing
 func generateTestVars(grant *resources.TerraformGrantResource) map[string]interface{} {
@@ -91,5 +158,14 @@ func generateTest(grant *resources.TerraformGrantResource) (string, error) {
 		return "", err
 	}
 
-	return fmt.Sprintf(testTemplate, string(data)), nil
+	futureData := []byte("")
+	if hasOnFutureProperty(grant) {
+		futureVars := generateFutureTestVars(grant)
+		futureData, err = json.Marshal(futureVars)
+		if err != nil {
+			return "", err
+		}
+	}
+
+	return fmt.Sprintf(testTemplate, string(data), string(futureData)), nil
 }

snowflake-account-grant-all/module_test.go

@@ -15,19 +15,38 @@ import (
 )
 
 const vars string = "{\"roles\":[\"role_a\",\"role_b\",\"role_c\"]}"
+const onFutureVars string = ""
 
 func TestModule(t *testing.T) {
 	test := tftest.Test{
-		// just run init, swtich to Plan or Apply when you can
-		Mode: tftest.Init,
+		Mode: tftest.Plan,
 
 		Setup: func(t *testing.T) *terraform.Options {
-			opts := tftest.Options(
-				tftest.DefaultRegion,
-				mustJson(vars),
-			)
-			opts.TerraformDir = "."
+			opts := &terraform.Options{
+				TerraformDir: ".",
+				EnvVars:      map[string]string{},
+				Vars:         mustJson(vars),
+			}
+			return opts
+		},
+		Validate: func(t *testing.T, options *terraform.Options) {},
+	}
+
+	test.Run(t)
+}
 
+func TestModule_onFuture(t *testing.T) {
+	if onFutureVars == "" {
+		return // nothing to test, no future vars
+	}
+	test := tftest.Test{
+		Mode: tftest.Plan,
+		Setup: func(t *testing.T) *terraform.Options {
+			opts := &terraform.Options{
+				TerraformDir: ".",
+				EnvVars:      map[string]string{},
+				Vars:         mustJson(vars),
+			}
 			return opts
 		},
 		Validate: func(t *testing.T, options *terraform.Options) {},

snowflake-database-grant-all/main.tf.json

@@ -45,7 +45,7 @@
         "for_each": "${toset(local.privileges)}",
         "privilege": "${each.value}",
         "roles": "${setunion(\n\t\t\t\tvar.roles,\n\t\t\t\tlookup(var.per_privilege_grants, each.value, { shares = [], roles = [] }).roles,\n\t\t\t\t)}",
-        "shares": "${setunion(\n\t\t\t\tvar.shares,\n\t\t\t\tlookup(var.per_privilege_grants, each.value, { shares = [], roles = [] }).shares,\n\t\t\t\t)}",
+        "shares": "${\n\t\t\t\tvar.shares == null ? null :\n\t\t\t\tsetunion(\n\t\t\t\t\tvar.shares,\n\t\t\t\t\tlookup(var.per_privilege_grants, each.value, { shares = [], roles = [] }).shares,\n\t\t\t\t)}",
         "with_grant_option": "${var.with_grant_option}"
       }
     }

snowflake-database-grant-all/module_test.go

@@ -15,19 +15,38 @@ import (
 )
 
 const vars string = "{\"database_name\":\"database\",\"roles\":[\"role_a\",\"role_b\",\"role_c\"],\"shares\":[\"share_a\",\"share_b\",\"share_c\"]}"
+const onFutureVars string = ""
 
 func TestModule(t *testing.T) {
 	test := tftest.Test{
-		// just run init, swtich to Plan or Apply when you can
-		Mode: tftest.Init,
+		Mode: tftest.Plan,
 
 		Setup: func(t *testing.T) *terraform.Options {
-			opts := tftest.Options(
-				tftest.DefaultRegion,
-				mustJson(vars),
-			)
-			opts.TerraformDir = "."
+			opts := &terraform.Options{
+				TerraformDir: ".",
+				EnvVars:      map[string]string{},
+				Vars:         mustJson(vars),
+			}
+			return opts
+		},
+		Validate: func(t *testing.T, options *terraform.Options) {},
+	}
+
+	test.Run(t)
+}
 
+func TestModule_onFuture(t *testing.T) {
+	if onFutureVars == "" {
+		return // nothing to test, no future vars
+	}
+	test := tftest.Test{
+		Mode: tftest.Plan,
+		Setup: func(t *testing.T) *terraform.Options {
+			opts := &terraform.Options{
+				TerraformDir: ".",
+				EnvVars:      map[string]string{},
+				Vars:         mustJson(vars),
+			}
 			return opts
 		},
 		Validate: func(t *testing.T, options *terraform.Options) {},

snowflake-external-table-grant-all/main.tf.json

@@ -58,7 +58,7 @@
         "privilege": "${each.value}",
         "roles": "${setunion(\n\t\t\t\tvar.roles,\n\t\t\t\tlookup(var.per_privilege_grants, each.value, { shares = [], roles = [] }).roles,\n\t\t\t\t)}",
         "schema_name": "${var.schema_name}",
-        "shares": "${setunion(\n\t\t\t\tvar.shares,\n\t\t\t\tlookup(var.per_privilege_grants, each.value, { shares = [], roles = [] }).shares,\n\t\t\t\t)}",
+        "shares": "${\n\t\t\t\tvar.shares == null ? null :\n\t\t\t\tsetunion(\n\t\t\t\t\tvar.shares,\n\t\t\t\t\tlookup(var.per_privilege_grants, each.value, { shares = [], roles = [] }).shares,\n\t\t\t\t)}",
         "with_grant_option": "${var.with_grant_option}"
       }
     }