Equivalent resource for snowflake_database_grant and snowflake_schema_grant with new snowflake_grant_privileges_to_role resource type

[toni-moreno]

Hello.

I'm trying to migrate some snowflake_database_grant and snowflake_schema_grant resources to the new snowflake_grant_privileges_to_role resource type .

The syntax and examples in documentation for the new resource is not clear ( to me) and I can't understand how to create them .

If I have this resources now for snowflake_database_grant

resource "snowflake_database_grant" "db_grant_USAGE" {

  database_name = "MY_DB1"
  privilege     = "USAGE"
  roles         = ["ROL1","ROL2"]
}
resource "snowflake_database_grant" "db_grant_CREATE_SCHEMA" {

  database_name = "MY_DB1"
  privilege     = "CREATE SCHEMA"
  roles         = ["ROL1","ROL2"]
}

It seems like with the new resource should be coded like follows .

resource "snowflake_grant_privileges_to_role" "db_grant_ROL1" {
  privileges = ["USAGE", "CREATE SCHEMA"]
  role_name ="ROL1"
  on_account_object {
    object_type = "DATABASE"
    object_name = "MY_DB1"
  }
}

resource "snowflake_grant_privileges_to_role" "db_grant_ROL2" {
  privileges = ["USAGE", "CREATE SCHEMA"]
  role_name ="ROL2"
  on_account_object {
    object_type = "DATABASE"
    object_name = "MY_DB1"
  }
}

I have also snowflake_schema_grant like that

resource "snowflake_schema_grant" "sch_grant_USAGE" {

  database_name = "MY_DB1"
  schema_name   = "SCH1"
  privilege     = "USAGE"
  roles         =  ["ROL1","ROL2"]
}

resource "snowflake_schema_grant" "sch_grant_CREATE_TABLE" {

  database_name = "MY_DB1"
  schema_name   = "SCH1"
  privilege     = "CREATE TABLE"
  roles         =  ["ROL1","ROL2"]
}

following the examples , It seems like with the new resource should be coded like follows with on_schema nested block instead of on_account_object.object_type= "SCHEMA" ( equivalent to on_account_object.object_type= "DATABASE" )

resource "snowflake_grant_privileges_to_role" "sch_grant_ROL1" {
  privileges = ["USAGE", "CREATE TABLE"]
  role_name  = "ROL1"
  on_schema {
   schema_name = "SCH1"
  }
}

resource "snowflake_grant_privileges_to_role" "sch_grant_ROL2" {
  privileges = ["USAGE", "CREATE TABLE"]
  role_name  = "ROL2"
  on_schema {
   schema_name = "SCH1"
  }
}

could anybody tell me if this is the right way to migrate them?

Thank you in advance.