[Bug]: Possible bug in Snowflake provider: No schema available for snowflake_role_grants while reading state

[jamiekt]

Might be worth skipping straight to the "Steps to reproduce" at the bottom rather than read all the text here at the top!

Terraform CLI Version

1.9.3

Terraform Provider Version

0.94.1

Terraform Configuration

I am trying to upgrade provider version and am getting errors when I do so:

Error: no schema available for snowflake_account_grant.resource_name while reading state; this is a bug in Terraform and should be reported
Error: no schema available for snowflake_grant_privileges_to_role.resurce_name while reading state; this is a bug in Terraform and should be reported

The error states that it is a bug in terraform but I am skeptical that that is actually the case as I shall now explain.
I am trying to upgrade provider version and am getting errors when I do so:

Error: no schema available for snowflake_account_grant.resource_name while reading state; this is a bug in Terraform and should be reported
Error: no schema available for snowflake_grant_privileges_to_role.resurce_name while reading state; this is a bug in Terraform and should be reported

The error states that it is a bug in terraform but I am skeptical that that is actually the case as I shall now explain.

I have 14 errors of the form:

Error: no schema available for <snowflake_resource_type>.<snowflake_resource_name> while reading state; this is a bug in Terraform and should be reported

8 of the errors are for resource type snowflake_account_grant
5 of the errors are for resource type snowflake_grant_privileges_to_role
1 of the errors is for resource type snowflake_role_grants

that I am getting when running terraform plan. However, immediately prior to that there are 14 warnings in the plan of the form:

│ Warning: Missing resource schema from provider
│ No resource schema found for <snowflake_resource_type> when decoding prior

8 of the warnings are for resource type snowflake_account_grant
5 of the warnings are for resource type snowflake_grant_privileges_to_role
1 of the warnings is for resource type snowflake_role_grants

The change that I am making is to remove:

• 8 resources of type snowflake_account_grant
• 5 of type snowflake_grant_privileges_to_role
• 1 of type snowflake_role_grants

The reason I am removing them is that I am trying to upgrade the provider to the most recent version, 0.94.1, from a much older version, 0.68.2.

and in version 0.93.0 those resource types have been removed, in line with your announcement at #2736

Hence I have removed code like this:

resource "snowflake_role_grants" "sysadmin_to_srv_datacatalog_grant" {
  provider  = snowflake.acc
  role_name = "SYSADMIN"
  users     = [snowflake_user.srv_datacatalog_sf.name]
}

and replaced it with

removed {
  from = snowflake_role_grants.sysadmin_to_srv_datacatalog_grant
  lifecycle {
    destroy = false
  }
}
import {
  to = snowflake_grant_account_role.sysadmin_to_srv_datacatalog_grant
  id = "\"SYSADMIN\"|USER|\"SRV-DATACATALOG-SF\""
}
resource "snowflake_grant_account_role" "sysadmin_to_srv_datacatalog_grant" {
  provider  = snowflake.acc
  role_name = "SYSADMIN"
  user_name = "\"${snowflake_user.srv_datacatalog_sf.name}\""
}

The warning

│ Warning: Missing resource schema from provider
│ No resource schema found for <snowflake_resource_type> when decoding prior

Makes me think that this is a problem with the provider rather than a bug in terraform which is what the error suggests.

Category

category:other

Object type(s)

No response

Expected Behavior

1. Plan should not fail

Actual Behavior

Plan fails with

Error: no schema available for <snowflake_resource_type>.<snowflake_resource_name> while reading state; this is a bug in Terraform and should be reported

Steps to Reproduce

1. Use following configuration, supplying your own values for var.snowflake_account, var.snowflake_region, var.snowflake_user, var.snowflake_private_key, var.snowflake_user_being_granted_a_role:

terraform {
  required_version = ">= 0.13"
  required_providers {
    snowflake = {
      source  = "snowflake-labs/snowflake"
      version = "0.68.2"
    }
  }
}

provider "snowflake" {
  username      = var.snowflake_user
  alias         = "acc"
  account       = var.snowflake_account
  region        = var.snowflake_region
  private_key   = var.snowflake_private_key
  role          = "ACCOUNTADMIN"
}

resource "snowflake_role_grants" "this" {
  provider  = snowflake.acc
  role_name = "SYSADMIN"
  users     = [var.snowflake_user_being_granted_a_role]
}

2. Run terraform init which should return:

Initializing the backend...
Initializing provider plugins...
- Finding snowflake-labs/snowflake versions matching "0.68.2"...
- Installing snowflake-labs/snowflake v0.68.2...
- Installed snowflake-labs/snowflake v0.68.2 (signed by a HashiCorp partner, key ID 5166D7352E69A585)

Terraform has been successfully initialized!

3. Run terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # snowflake_role_grants.this will be created
  + resource "snowflake_role_grants" "this" {
      + enable_multiple_grants = false
      + id                     = (known after apply)
      + role_name              = "SYSADMIN"
      + users                  = [
          + "YOUR_USERNAME",
        ]
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

snowflake_role_grants.this: Creating...
snowflake_role_grants.this: Creation complete after 0s [id=SYSADMIN||YOUR_USERNAME]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

4. Change your configuration to this:

terraform {
  required_version = ">= 0.13"
  required_providers {
    snowflake = {
      source  = "snowflake-labs/snowflake"
      version = "0.94.1" # notice that the provider version has been changed
    }
  }
}
locals {
  account_and_region = "${var.snowflake_account}.${var.snowflake_region}"
}
provider "snowflake" {
  user          = var.snowflake_user
  alias         = "acc"
  account       = local.account_and_region
  private_key   = var.snowflake_private_key
  role          = "ACCOUNTADMIN"
  authenticator = "JWT"
}

# resource "snowflake_role_grants" "this" {
#   provider  = snowflake.acc
#   role_name = "SYSADMIN"
#   users     = [var.snowflake_user_being_granted_a_role]
# }

while building this repro I've realised its nothing to do with the import block. Simply removing the resource block is sufficient to repro the problem.

5. Run terraform init --upgrade

Initializing the backend...
Initializing provider plugins...
- Finding snowflake-labs/snowflake versions matching "0.94.1"...
- Installing snowflake-labs/snowflake v0.94.1...
- Installed snowflake-labs/snowflake v0.94.1 (signed by a HashiCorp partner, key ID 5166D7352E69A585)

Terraform has been successfully initialized!

6. Run terraform plan

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: no schema available for snowflake_role_grants.this while reading state; this is a bug in Terraform and should be reported
│ 
│ 
╵

How much impact is this issue causing?

Medium

Logs

No response

Additional Information

No response

Would you like to implement a fix?

• Yeah, I'll take it 😎

[sfc-gh-jmichalak]

Hi, @jamiekt 👋 These errors occur, because in the newer version old grant resources are removed and Terraform can't find schema definitions for them. Unfortunately, Terraform does not provide a way to automatically migrate between two different resources, so it needs to be done manually. Please check resource migration which has an example of migrating a grant (although a different one). We listed a few ways to migrate from deprecated resources, so pick one that suits you the most :)

Please note that upgrading almost 30 versions at once may be error-prone, and we suggest taking a more granular approach here.

[jamiekt]

Thank you @sfc-gh-jmichalak . That seems to be a bit of a failing in terraform :(

[jamiekt]

I've used an earlier version of the provider (0.92.0) which includes definitions of the removed and newly created resources and now the errors no longer appear 👍

[paul-marrand-hublo]

Hello @jamiekt
I'm in the same situation as you while trying to migrate from 0.71.0 to 0.96.0
Do you advise to migrate to 0.92.0 and then migrate from there to 0.96.0 ?
From what I saw, the identifier rework will be the only major change from 0.92 to a further version. Did you notice some other stuff ?
Thanks !!

[sfc-gh-jmichalak]

Hi @paul-marrand-hublo 👋

Please take a look at the migration guide (esp. grant removal entry). We write about all breaking changes there to ensure smoother migrations.

We advise migrating versions gradually one by one.