Plugin encountered an error

[adrian-montero-hkkd]

Terraform CLI and Provider Versions

I'm using TF Cloud version 1.6.3

Terraform Configuration

resource "snowflake_grant_privileges_to_role" "db_grants_to_fivetran_role" {
  provider = snowflake.securityadmin
  privileges = ["USAGE","MONITOR","CREATE SCHEMA"] 
  role_name = snowflake_role.fivetran_role.name
  on_account_object {
    object_name = snowflake_database.fivetran_database.name
    object_type = "DATABASE"
  }
  with_grant_option = false
}

Expected Behavior

I expected TF/ the snowflake provider to create a db_grants_to_fivetran_role resource and apply the grants in the SF instance.

Actual Behavior

Error: Plugin did not respond The plugin encountered an error, and failed to respond to the plugin6.(*GRPCProvider).ApplyResourceChange call. The plugin logs may contain more details.

Steps to Reproduce

1. terraform apply

How much impact is this issue causing?

High

Logs

No response

Additional Information

Error Log from provider:

Stack trace from the terraform-provider-snowflake_v0.79.0 plugin:

panic: runtime error: index out of range [1] with length 1

goroutine 101 [running]: github.com/Snowflake-Labs/terraform-provider-snowflake/pkg/sdk.NewDatabaseObjectIdentifierFromFullyQualifiedName({0xc0010d6090?, 0x1df9b46?}) github.com/Snowflake-Labs/terraform-provider-snowflake/pkg/sdk/identifier_helpers.go:159 +0xcc github.com/Snowflake-Labs/terraform-provider-snowflake/pkg/resources.configureAccountRoleGrantPrivilegeOptions(0xc001296de0?, {0xc0012d3c10, 0x1, 0x1}, 0x0?, 0xc000afacf0) github.com/Snowflake-Labs/terraform-provider-snowflake/pkg/resources/grant_privileges_to_role.go:748 +0x8f1 github.com/Snowflake-Labs/terraform-provider-snowflake/pkg/resources.CreateGrantPrivilegesToRole(0x0?, {0x1d3ff80?, 0xc0005b36c0?}) github.com/Snowflake-Labs/terraform-provider-snowflake/pkg/resources/grant_privileges_to_role.go:460 +0x226 github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(Resource).create(0x20b4e60?, {0x20b4e60?, 0xc0012c4810?}, 0xd?, {0x1d3ff80?, 0xc0005b36c0?}) github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/resource.go:766 +0x178 github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(Resource).Apply(0xc00002a540, {0x20b4e60, 0xc0012c4810}, 0xc0012ccc30, 0xc0012bc300, {0x1d3ff80, 0xc0005b36c0}) github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/resource.go:909 +0xa7e github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(GRPCProviderServer).ApplyResourceChange(0xc00091cc18, {0x20b4e60?, 0xc0012c44b0?}, 0xc0012d6050) github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/grpc_provider.go:1060 +0xe8d github.com/hashicorp/terraform-plugin-mux/tf5to6server.v5tov6Server.ApplyResourceChange({{0x20d4480?, 0xc00091cc18?}}, {0x20b4e60, 0xc0012c44b0}, 0x0?) github.com/hashicorp/terraform-plugin-mux@v0.12.0/tf5to6server/tf5to6server.go:37 +0x5a github.com/hashicorp/terraform-plugin-mux/tf6muxserver.(muxServer).ApplyResourceChange(0x20b4db8?, {0x20b4e60?, 0xc00095f050?}, 0xc0013045f0) github.com/hashicorp/terraform-plugin-mux@v0.12.0/tf6muxserver/mux_server_ApplyResourceChange.go:36 +0x1b5 github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server.(server).ApplyResourceChange(0xc000927e00, {0x20b4e60?, 0xc00095e840?}, 0xc0009621c0) github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov6/tf6server/server.go:857 +0x574 github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6._Provider_ApplyResourceChange_Handler({0x1ce79a0?, 0xc000927e00}, {0x20b4e60, 0xc00095e840}, 0xc000962150, 0x0) github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov6/internal/tfplugin6/tfplugin6_grpc.pb.go:467 +0x170 google.golang.org/grpc.(Server).processUnaryRPC(0xc0002634a0, {0x20c4d00, 0xc000590680}, 0xc0011b4b40, 0xc000ac63f0, 0x2e01958, 0x0) google.golang.org/grpc@v1.58.2/server.go:1376 +0xdd2 google.golang.org/grpc.(Server).handleStream(0xc0002634a0, {0x20c4d00, 0xc000590680}, 0xc0011b4b40, 0x0) google.golang.org/grpc@v1.58.2/server.go:1753 +0xa36 google.golang.org/grpc.(Server).serveStreams.func1.1() google.golang.org/grpc@v1.58.2/server.go:998 +0x98 created by google.golang.org/grpc.(*Server).serveStreams.func1 google.golang.org/grpc@v1.58.2/server.go:996 +0x18c

Error: The terraform-provider-snowflake_v0.79.0 plugin crashed!

This is always indicative of a bug within the plugin. It would be immensely helpful if you could report the crash with the plugin's maintainers so that it can be fixed. The output above should help diagnose the issue.

[sfc-gh-jcieslak]

@adrian-montero-hkkd Hey, from the error message, it seems that the error occurred in the resource that wanted to grant privileges on_schema, not on_object_account, and to resolve the error you have to pass the fully qualified schema name (probably somewhere in your config on_schema.schema_name = "<schema_name>", but should be on_schema.schema_name = "\"<database_name>\".\"<schema_name>\""). It's similar to this issue. Please see and let me know if that resolves your issue.

[adrian-montero-hkkd]

I'm actually trying to do the grant at the db level. So that wouldn't work. Right now I'm using the previous snowflake_database_grant but I get the deprecated warning (but it does work, the permissions are granted successfully):

resource "snowflake_database_grant" "db_grant_usage_to_fivetran_role" {
  provider = snowflake.securityadmin
  database_name = snowflake_database.fivetran_database.name
  privilege = "USAGE"
  roles = [ snowflake_role.fivetran_role.name ]
  enable_multiple_grants = true
}

I was expecting it to work since it is an example just like the one in the provider docs:

##################################
### account object privileges
##################################

# list of privileges
resource "snowflake_grant_privileges_to_role" "g3" {
  privileges = ["CREATE", "MONITOR"]
  role_name  = snowflake_role.r.name
  on_account_object {
    object_type = "DATABASE"
    object_name = snowflake_database.d.name
  }
}

Ref: https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/grant_privileges_to_role

I would expect to have to provide a fully qualifier if I were granting the create table permission, not the create schema, which wouldn't make much sense to grant at a schema level, since well, I want the user to be able to create new schemas.

Thanks for the help.

[sfc-gh-jcieslak]

@adrian-montero-hkkd Hey, so maybe what I wrote is unclear, but the example and the code you provided look correct and they should work. What I was saying is that it looks like the error is pointing to another resource, not to the one you provided. The error looks to reference a "snowflake_grant_privileges_to_role" resource that uses on_schema instead of on_account_object like in your example.

[adrian-montero-hkkd]

Thanks. You are right, that was not the problematic block. Changed it for the fully qualified schema name and it worked.