[Bug]: The terraform-provider-snowflake_v0.86.0 plugin crashed!

[rajasinghr]

Terraform CLI Version

1.4.6

Terraform Provider Version

0.86.0

Terraform Configuration

terraform {
  required_providers {
    snowflake = {
      source  = "Snowflake-Labs/snowflake"
      version = "<=0.86.0"
    }
  }
  required_version = ">= 1.1.3, <=1.4.6"
}



resource "snowflake_tag" "tag" {
  name     = var.name
  database = var.database
  schema   = var.schema
}

resource "snowflake_tag_masking_policy_association" "masking_policy_tag_association" {
  for_each          = toset(var.masking_policies)
  tag_id            = snowflake_tag.tag.id
  masking_policy_id = each.key
}

Category

category:resource

Object type(s)

resource:tag_masking_policy_association

Expected Behavior

Associating masking policies with a tag

Actual Behavior

I am getting the below error
Error: Plugin did not respond
│
│ The plugin encountered an error, and failed to respond to the
│ plugin6.(*GRPCProvider).ApplyResourceChange call. The plugin logs may
│ contain more details.
╵

Stack trace from the terraform-provider-snowflake_v0.86.0 plugin:

panic: interface conversion: sdk.ObjectIdentifier is sdk.AccountObjectIdentifier, not sdk.SchemaObjectIdentifier

Error: The terraform-provider-snowflake_v0.86.0 plugin crashed!

Steps to Reproduce

resource "snowflake_tag" "tag" {
name = var.name
database = var.database
schema = var.schema
}

resource "snowflake_tag_masking_policy_association" "masking_policy_tag_association" {
for_each = toset(var.masking_policies)
tag_id = snowflake_tag.tag.id
masking_policy_id = each.key
}

How much impact is this issue causing?

Low

Logs

No response

Additional Information

No response

Would you like to implement a fix?

• Yeah, I'll take it 😎

[sfc-gh-jmichalak]

Hi @rajasinghr 👋

Could you provide the definition of var.masking_policies and the whole stack trace output? I think the issue is that snowflake_tag_masking_policy_association expects a fully qualified name in tag_id and masking_policy_id, but only scoped names are provided.

In v0.95.0, we have introduced fully_qualified_name to each resource which should help in referencing these objects. We recommend updating the provider to this version.

Note that tags and masking policies are on our roadmap, and will be reworked soon.

[rajasinghr]

Hi @sfc-gh-jmichalak ,
Thanks for helping on this.
What do you mean by fully qualified name?

We are passing masking_policies as list from an yaml file and create resources using the below module.

module "tag" {
  for_each = var.tags
  source   = "../../modules/tag"

  name             = each.key
  database         = lookup(each.value, "database", "<default_db>")
  schema           = lookup(each.value, "schema", "<default_schema>")
  masking_policies = lookup(each.value, "masking_policies", [])
}

tag.yaml

tags:
  - name: MASKED
    properties:
      masking_policies: ["<policy 1>", "<policy 2>"]
  - name: PENDING_REVIEW
    properties:
      masking_policies: ["<policy 1>", "<policy 2>"]

Here is the full stack trace

Stack trace from the terraform-provider-snowflake_v0.86.0 plugin:

panic: interface conversion: sdk.ObjectIdentifier is sdk.AccountObjectIdentifier, not sdk.SchemaObjectIdentifier

goroutine 74 [running]:
github.com/Snowflake-Labs/terraform-provider-snowflake/pkg/resources.CreateTagMaskingPolicyAssociation(0x0?, {0x205bd40?, 0xc000d0be10?})
	github.com/Snowflake-Labs/terraform-provider-snowflake/pkg/resources/tag_masking_policy_association.go:118 +0x598
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).create(0x242a2c8?, {0x242a2c8?, 0xc000e00f60?}, 0xd?, {0x205bd40?, 0xc000d0be10?})
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.31.0/helper/schema/resource.go:766 +0x163
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).Apply(0xc000899180, {0x242a2c8, 0xc000e00f60}, 0xc000b7c680, 0xc000990180, {0x205bd40, 0xc000d0be10})
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.31.0/helper/schema/resource.go:909 +0xa89
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*GRPCProviderServer).ApplyResourceChange(0xc000b0aa50, {0x242a2c8?, 0xc000e00db0?}, 0xc000bc8aa0)
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.31.0/helper/schema/grpc_provider.go:1074 +0xdbc
github.com/hashicorp/terraform-plugin-mux/tf5to6server.v5tov6Server.ApplyResourceChange({{0x2440020?, 0xc000b0aa50?}}, {0x242a2c8, 0xc000e00db0}, 0x0?)
	github.com/hashicorp/terraform-plugin-mux@v0.13.0/tf5to6server/tf5to6server.go:37 +0x54
github.com/hashicorp/terraform-plugin-mux/tf6muxserver.(*muxServer).ApplyResourceChange(0x242a300?, {0x242a2c8?, 0xc000e00ab0?}, 0xc000bc8a50)
	github.com/hashicorp/terraform-plugin-mux@v0.13.0/tf6muxserver/mux_server_ApplyResourceChange.go:36 +0x193
github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server.(*server).ApplyResourceChange(0xc000b16960, {0x242a2c8?, 0xc000e000c0?}, 0xc0006776c0)
	github.com/hashicorp/terraform-plugin-go@v0.20.0/tfprotov6/tf6server/server.go:857 +0x56b
github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6._Provider_ApplyResourceChange_Handler({0x20091c0?, 0xc000b16960}, {0x242a2c8, 0xc000e000c0}, 0xc00088f900, 0x0)
	github.com/hashicorp/terraform-plugin-go@v0.20.0/tfprotov6/internal/tfplugin6/tfplugin6_grpc.pb.go:503 +0x169
google.golang.org/grpc.(*Server).processUnaryRPC(0xc0000d8d20, {0x242a2c8, 0xc000e00030}, {0x243b300, 0xc000a0e000}, 0xc000c16c60, 0xc000930ba0, 0x3424d78, 0x0)
	google.golang.org/grpc@v1.60.0/server.go:1372 +0xe03
google.golang.org/grpc.(*Server).handleStream(0xc0000d8d20, {0x243b300, 0xc000a0e000}, 0xc000c16c60)
	google.golang.org/grpc@v1.60.0/server.go:1783 +0xfec
google.golang.org/grpc.(*Server).serveStreams.func2.1()
	google.golang.org/grpc@v1.60.0/server.go:1016 +0x59
created by google.golang.org/grpc.(*Server).serveStreams.func2 in goroutine 10
	google.golang.org/grpc@v1.60.0/server.go:1027 +0x115

Error: The terraform-provider-snowflake_v0.86.0 plugin crashed!

This is always indicative of a bug within the plugin. It would be immensely
helpful if you could report the crash with the plugin's maintainers so that it
can be fixed. The output above should help diagnose the issue.

time=2024-09-17T23:06:06Z level=error msg=terraform invocation failed in /home/atlantis/.atlantis/repos/Rippling/terraform-snowflake/406/default/multi-region/dev/us1/resources/tag/.terragrunt-cache/Ulx83QFGCg23kzsO7mQKLofSLDM/kHYvUfT4SdbyrRHGWEVNpDPp-qE/application-modules/tag error=[/home/atlantis/.atlantis/repos/Rippling/terraform-snowflake/406/default/multi-region/dev/us1/resources/tag/.terragrunt-cache/Ulx83QFGCg23kzsO7mQKLofSLDM/kHYvUfT4SdbyrRHGWEVNpDPp-qE/application-modules/tag] exit status 1 prefix=[/home/atlantis/.atlantis/repos/Rippling/terraform-snowflake/406/default/multi-region/dev/us1/resources/tag] 
time=2024-09-17T23:06:06Z level=error msg=1 error occurred:
	* [/home/atlantis/.atlantis/repos/Rippling/terraform-snowflake/406/default/multi-region/dev/us1/resources/tag/.terragrunt-cache/Ulx83QFGCg23kzsO7mQKLofSLDM/kHYvUfT4SdbyrRHGWEVNpDPp-qE/application-modules/tag] exit status 1

[sfc-gh-jmichalak]

I mean that masking policies are schema-level objects, and a part of their id is also schema and database name. A fully qualified name of a masking policy looks like "<database_name>"."<schema_name>"."<policy_name>" and this is an expected format in snowflake_tag_masking_policy_association resource. I think that here you just pass <policy_name>, so this needs to be adjusted. Read more on Snowflake identificators here.

In v0.95.0, each resource has a fully_qualified_name field that returns a computed fully qualified name, so there's no need to construct these manually. We highly recommend migrating to this version and using this field.

[rajasinghr]

Got it. Thank you. Will try this with the latest version

[rajasinghr]

This worked after upgrading the version and mentioning the fully_qualified_name for the resources