Snowflake Database resource having with_replication throwing error [errors.go:17] object does not exist or not authorized

satprarai commented 8 months ago

Terraform CLI and Provider Versions

Terraform CLI = 1.7.3 provider = 0.87.2

Terraform Configuration

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.databases.snowflake_database.database["DB_DATACLOUD_DEV_DROPME"] will be updated in-place
  ~ resource "snowflake_database" "database" {
        id                          = "DB_DATACLOUD_DEV_DROPME"
        name                        = "DB_DATACLOUD_DEV_DROPME"
        # (3 unchanged attributes hidden)

      + replication_configuration {
          + accounts             = [
              + "wpp.choreograph_techops_npd_2",
              + "wpp.choreograph_techops_npd_3",
            ]
          + ignore_edition_check = true
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Warnings:

- Resource targeting is in effect
- Argument is deprecated
  on main.tf line 5 (and 1 more)
- Deprecated Resource
  on .terraform/modules/roles/snowflake/roles/main.tf line 31 (and 37 more)

To see the full warning notes, run Terraform without -compact-warnings.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.databases.snowflake_database.database["DB_DATACLOUD_DEV_DROPME"]: Modifying... [id=DB_DATACLOUD_DEV_DROPME]
╷
│ Warning: Applied changes may be incomplete
│
│ The plan was created with the -target option in effect, so some changes
│ requested in the configuration may have been ignored and the output values
│ may not be fully updated. Run the following command to verify that no other
│ changes are pending:
│     terraform plan
│
│ Note that the -target option is not suitable for routine use, and is
│ provided only for exceptional situations such as recovering from errors or
│ mistakes, or when Terraform specifically suggests to use it as part of an
│ error message.
╵
╷
│ Warning: Argument is deprecated
│
│   with provider["registry.terraform.io/snowflake-labs/snowflake"],
│   on main.tf line 5, in provider "snowflake":
│    5: provider "snowflake" {
│
│ use the [file
│ Function](https://developer.hashicorp.com/terraform/language/functions/file)
│ instead
╵
╷
│ Error: error enabling replication configuration on DB_DATACLOUD_DEV_DROPME err = [errors.go:17] object does not exist or not authorized
│
│   with module.databases.snowflake_database.database["DB_DATACLOUD_DEV_DROPME"],
│   on .terraform/modules/databases/snowflake/databases/main.tf line 10, in resource "snowflake_database" "database":
│   10: resource "snowflake_database" "database" {
│
╵
ERRO[0011] terraform invocation failed in /Users/satya.rai/Documents/Satya/git-repos/AAA-IAC-Snowflake-run-test/projects/wpp-choreograph-techops-npd-1/.terragrunt-cache/jwmvTF7yK3J7ySs5cl9RmWaSl5s/C-qDR1v5h42PkhzkYsQAQqWGr-0  prefix=[/Users/satya.rai/Documents/Satya/git-repos/AAA-IAC-Snowflake-run-test/projects/wpp-choreograph-techops-npd-1]
ERRO[0011] 1 error occurred:
    * [/Users/satya.rai/Documents/Satya/git-repos/AAA-IAC-Snowflake-run-test/projects/wpp-choreograph-techops-npd-1/.terragrunt-cache/jwmvTF7yK3J7ySs5cl9RmWaSl5s/C-qDR1v5h42PkhzkYsQAQqWGr-0] exit status 1

Expected Behavior

Code should set a replication
State file should not get updated if apply fails. In this case even after the error the state file makes it success and the next run of terraform will not report missing replication config

Actual Behavior

Error: error enabling replication configuration on DB_DATACLOUD_DEV_DROPME err = [errors.go:17] object does not exist or not authorized

Steps to Reproduce

terraform apply

How much impact is this issue causing?

Medium

Logs

https://gist.github.com/satprarai/fdba7d8ed5808a8ca7e66c6ee2e77794

Additional Information

No response

sfc-gh-jcieslak commented 8 months ago

Hey @satprarai The logs are not complete, but my first guess is that account names are incorrect (it's case-sensitive). Please provide full logs (unless case-sensitive account names fix your issue).

satprarai commented 8 months ago

@sfc-gh-jcieslak - I can create databases on the same account, just can't add replication, here is the full log


NYCGRMSDRAIMAC:wpp-choreograph-techops-npd-1-clone satya.rai$ terragrunt apply

module.databases.snowflake_database.database["DB_DATACLOUD_DEV_DROPME"]: Refreshing state... [id=DB_DATACLOUD_DEV_DROPME]
module.databases.snowflake_database.database["DB_SOMENAME"]: Refreshing state... [id=DB_SOMENAME]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.databases.snowflake_database.database["DB_DATACLOUD_DEV_DROPME"] will be updated in-place
  ~ resource "snowflake_database" "database" {
        id                          = "DB_DATACLOUD_DEV_DROPME"
        name                        = "DB_DATACLOUD_DEV_DROPME"
        # (3 unchanged attributes hidden)

      + replication_configuration {
          + accounts             = [
              + "wpp.choreograph_techops_npd_2",
              + "wpp.choreograph_techops_npd_3",
            ]
          + ignore_edition_check = true
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Warnings:

- Resource targeting is in effect
- Argument is deprecated
  on main.tf line 5 (and 1 more)
- Deprecated Resource
  on .terraform/modules/roles/snowflake/roles/main.tf line 31 (and 8 more)

To see the full warning notes, run Terraform without -compact-warnings.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.databases.snowflake_database.database["DB_DATACLOUD_DEV_DROPME"]: Modifying... [id=DB_DATACLOUD_DEV_DROPME]
╷
│ Warning: Applied changes may be incomplete
│
│ The plan was created with the -target option in effect, so some changes
│ requested in the configuration may have been ignored and the output values
│ may not be fully updated. Run the following command to verify that no other
│ changes are pending:
│     terraform plan
│
│ Note that the -target option is not suitable for routine use, and is
│ provided only for exceptional situations such as recovering from errors or
│ mistakes, or when Terraform specifically suggests to use it as part of an
│ error message.
╵
╷
│ Warning: Argument is deprecated
│
│   with provider["registry.terraform.io/snowflake-labs/snowflake"],
│   on main.tf line 5, in provider "snowflake":
│    5: provider "snowflake" {
│
│ use the [file
│ Function](https://developer.hashicorp.com/terraform/language/functions/file)
│ instead
╵
╷
│ Error: error enabling replication configuration on DB_DATACLOUD_DEV_DROPME err = [errors.go:17] object does not exist or not authorized
│
│   with module.databases.snowflake_database.database["DB_DATACLOUD_DEV_DROPME"],
│   on .terraform/modules/databases/snowflake/databases/main.tf line 10, in resource "snowflake_database" "database":
│   10: resource "snowflake_database" "database" {
│
╵
ERRO[0016] terraform invocation failed in /Users/satya.rai/Documents/Satya/git-repos/AAA-IAC-Snowflake-run-test/projects/wpp-choreograph-techops-npd-1-clone/.terragrunt-cache/xSmy46PkfwymIuscUSyRFtgaJPY/C-qDR1v5h42PkhzkYsQAQqWGr-0  prefix=[/Users/satya.rai/Documents/Satya/git-repos/AAA-IAC-Snowflake-run-test/projects/wpp-choreograph-techops-npd-1-clone]
ERRO[0016] 1 error occurred:
    * [/Users/satya.rai/Documents/Satya/git-repos/AAA-IAC-Snowflake-run-test/projects/wpp-choreograph-techops-npd-1-clone/.terragrunt-cache/xSmy46PkfwymIuscUSyRFtgaJPY/C-qDR1v5h42PkhzkYsQAQqWGr-0] exit status 1

NYCGRMSDRAIMAC:wpp-choreograph-techops-npd-1-clone satya.rai$```

sfc-gh-jcieslak commented 8 months ago

Sorry, forgot to mention, but you have to set the TF_LOG=DEBUG environment variable for me to see what SQLs are being run. With debug log level I'll be able to see more.

sfc-gh-asawicki commented 8 months ago

Hey @satprarai. We also recently fixed the behavior of the account ids that were working by accident. Please try using the account locator instead of the orgname.accountname syntax (read more in https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#behavior-change-external-object-identifier-changes).

satprarai commented 8 months ago

Thanks for the help. The account name is case-sensitive hence it was failing.

FYI - the Account-URL still works.

 # module.databases.snowflake_database.database["DB_DATACLOUD_DEV_DROPME"] will be updated in-place
  ~ resource "snowflake_database" "database" {
        id                          = "DB_DATACLOUD_DEV_DROPME"
        name                        = "DB_DATACLOUD_DEV_DROPME"
        # (3 unchanged attributes hidden)

      + replication_configuration {
          + accounts             = [
              + "WPP.CHOREOGRAPH_TECHOPS_NPD_2",
              + "WPP.CHOREOGRAPH_TECHOPS_NPD_3",
            ]
          + ignore_edition_check = true
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.
...
..
module.databases.snowflake_database.database["DB_DATACLOUD_DEV_DROPME"]: Modifying... [id=DB_DATACLOUD_DEV_DROPME]
module.databases.snowflake_database.database["DB_DATACLOUD_DEV_DROPME"]: Modifications complete after 0s [id=DB_DATACLOUD_DEV_DROPME]

Warnings:

sfc-gh-jcieslak commented 8 months ago

Hey @satprarai I'm glad it works now. I'm closing the issue, but we'll revisit this part to take a closer look during the identifiers rework.

Snowflake-Labs / terraform-provider-snowflake