Merge pull request #27 from getindata/fix/rollback_stage_default_roles

fix: Set stage default_roles using `create_default_roles` schema toggle

Author: dgniewek

README.md

@@ -103,7 +103,7 @@ For more information, refer to [variables.tf](variables.tf), list of inputs belo
 | <a name="input_roles"></a> [roles](#input\_roles) | Database roles created in the scheme scope | <pre>map(object({<br>    enabled                   = optional(bool, true)<br>    descriptor_name           = optional(string, "snowflake-database-role")<br>    role_ownership_grant      = optional(string)<br>    granted_to_roles          = optional(list(string))<br>    granted_to_database_roles = optional(list(string))<br>    granted_database_roles    = optional(list(string))<br>    schema_grants = optional(list(object({<br>      all_privileges    = optional(bool)<br>      with_grant_option = optional(bool, false)<br>      privileges        = optional(list(string), null)<br>    })))<br>    schema_objects_grants = optional(map(list(object({<br>      all_privileges    = optional(bool)<br>      with_grant_option = optional(bool)<br>      privileges        = optional(list(string), null)<br>      object_name       = optional(string)<br>      on_all            = optional(bool, false)<br>      on_future         = optional(bool, false)<br>    }))), {})<br>  }))</pre> | `{}` | no |
 | <a name="input_skip_schema_creation"></a> [skip\_schema\_creation](#input\_skip\_schema\_creation) | Should schema creation be skipped but allow all other resources to be created.<br>    Useful if schema already exsists but you want to add e.g. access roles." | `bool` | `false` | no |
 | <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
-| <a name="input_stages"></a> [stages](#input\_stages) | Stages to be created in the schema | <pre>map(object({<br>    enabled             = optional(bool, true)<br>    descriptor_name     = optional(string, "snowflake-stage")<br>    aws_external_id     = optional(string)<br>    comment             = optional(string)<br>    copy_options        = optional(string)<br>    credentials         = optional(string)<br>    directory           = optional(string)<br>    encryption          = optional(string)<br>    file_format         = optional(string)<br>    snowflake_iam_user  = optional(string)<br>    storage_integration = optional(string)<br>    url                 = optional(string)<br>    roles = optional(map(object({<br>      descriptor_name           = optional(string, "snowflake-database-role")<br>      with_grant_option         = optional(bool)<br>      granted_to_roles          = optional(list(string))<br>      granted_to_database_roles = optional(list(string))<br>      granted_database_roles    = optional(list(string))<br>      stage_grants              = optional(list(string))<br>      all_privileges            = optional(bool)<br>    })), ({}))<br>    create_default_roles = optional(bool, false)<br>  }))</pre> | `{}` | no |
+| <a name="input_stages"></a> [stages](#input\_stages) | Stages to be created in the schema | <pre>map(object({<br>    enabled             = optional(bool, true)<br>    descriptor_name     = optional(string, "snowflake-stage")<br>    aws_external_id     = optional(string)<br>    comment             = optional(string)<br>    copy_options        = optional(string)<br>    credentials         = optional(string)<br>    directory           = optional(string)<br>    encryption          = optional(string)<br>    file_format         = optional(string)<br>    snowflake_iam_user  = optional(string)<br>    storage_integration = optional(string)<br>    url                 = optional(string)<br>    roles = optional(map(object({<br>      descriptor_name           = optional(string, "snowflake-database-role")<br>      with_grant_option         = optional(bool)<br>      granted_to_roles          = optional(list(string))<br>      granted_to_database_roles = optional(list(string))<br>      granted_database_roles    = optional(list(string))<br>      stage_grants              = optional(list(string))<br>      all_privileges            = optional(bool)<br>    })), ({}))<br>    create_default_roles = optional(bool)<br>  }))</pre> | `{}` | no |
 | <a name="input_storage_serialization_policy"></a> [storage\_serialization\_policy](#input\_storage\_serialization\_policy) | The storage serialization policy for Iceberg tables that use Snowflake as the catalog.<br>Valid options are: [COMPATIBLE OPTIMIZED]. | `string` | `null` | no |
 | <a name="input_suspend_task_after_num_failures"></a> [suspend\_task\_after\_num\_failures](#input\_suspend\_task\_after\_num\_failures) | How many times a task must fail in a row before it is automatically suspended. 0 disables auto-suspending. | `number` | `null` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |

examples/complete/main.tf

@@ -131,9 +131,11 @@ module "this_schema" {
       create_default_roles = false
     }
     my_second_stage = {
-      comment = "Stage used to transform data from other source"
-
+      comment              = "Stage used to transform data from other source"
       create_default_roles = true
     }
+    my_third_stage = {
+      comment = "Stage used to transform data from other source"
+    }
   }
 }

main.tf

@@ -63,7 +63,7 @@ module "snowflake_stage" {
   url                 = each.value.url
   roles               = each.value.roles
 
-  create_default_roles = each.value.create_default_roles
+  create_default_roles = coalesce(each.value.create_default_roles, var.create_default_roles)
 }
 
 module "snowflake_default_role" {

variables.tf

@@ -99,7 +99,7 @@ variable "stages" {
       stage_grants              = optional(list(string))
       all_privileges            = optional(bool)
     })), ({}))
-    create_default_roles = optional(bool, false)
+    create_default_roles = optional(bool)
   }))
   default = {}
 }