Configuration of provider 0.87.2 not working on Gitlab

[olivierdewit]

Hi,

I am using version 0.87.2 of the provider. Code is managed with Gitlab. Pipeline fails with the following error and I don't understand why.

Error: No value for required variable
│
│ on variables.tf line 1:
│ 1: variable "oauth_client_secret" {
│
│ The root module input variable "oauth_client_secret" is not set, and has no
│ default value. Use a -var or -var-file command line argument to provide a
│ value for this variable.

Same error for the following variables: oauth_redirect_url, oauth_refresh_token, oauth_client_id, oauth_endpoint

Here are my main.tf file and variables.tf

main.tf:

terraform {
required_version = ">= 1.1.7"
backend "http" {
}
required_providers {
snowflake = {
source = "Snowflake-Labs/snowflake"
version = "0.87.2"
}
}
}

provider "snowflake" {
account = "xxx.canada-central.azure"
user = "SYSUSER_TF"
authenticator = "OAuth"
oauth_client_secret = var.oauth_client_secret
oauth_redirect_url = var.oauth_redirect_url
oauth_refresh_token = var.oauth_refresh_token
oauth_client_id = var.oauth_client_id
oauth_endpoint = var.oauth_endpoint
}

variables.tf:

variable "oauth_client_secret" {
type = string
}

variable "oauth_redirect_url" {
type = string
}

variable "oauth_refresh_token" {
type = string
}

variable "oauth_client_id" {
type = string
}

variable "oauth_endpoint" {
type = string
}

Those variables have been defined on Gitlab as environment variables. For the name of those environment variables, we tried two things e.g. for oauth_client_id, we tried SNOWFLAKE_OAUTH_CLIENT_ID as mentioned in the documentation and we tried also with TF_VAR_OAUTH_CLIENT_ID. Same error.

Any help will be greatly appreciated.

[sfc-gh-asawicki]

Hey @olivierdewit.

If SNOWFLAKE_OAUTH_CLIENT_ID is set, you shouldn't specify oauth_client_id = var.oauth_client_id because it overrides the env .

Specifying the values for tf vars is not a Snowflake provider-specific question. Please consult terraform docs: https://developer.hashicorp.com/terraform/language/values/variables#environment-variables.

[olivierdewit]

Same error when I run it locally :-(

[sfc-gh-asawicki]

Can you try to run locally the second option, i.e. with variables based on the docs https://developer.hashicorp.com/terraform/language/values/variables#environment-variables? Keep in mind that you may use the proper casing, so in your case TF_VAR_ oauth_client_id.

[olivierdewit]

Configuration is now valid but pipeline still fails. I get a warning about the way those variables are defined (even if it follows documentation) and an error. Regarding the error, I am sure the oauth_refresh_token is still valid on Snowflake. So, I don't understand what is causing this error.

Warning: Argument is deprecated
│
│ with provider["registry.terraform.io/snowflake-labs/snowflake"],
│ on main.tf line 17, in provider "snowflake":
│ 17: oauth_client_secret = var.oauth_client_secret
│
│ Use token_accessor.0.client_secret instead
│
│ (and 4 more similar warnings elsewhere)
╵
╷
│ Error: open snowflake connection: 390303 (08004): Invalid OAuth access token.
│
│ with provider["registry.terraform.io/snowflake-labs/snowflake"],
│ on main.tf line 13, in provider "snowflake":
│ 13: provider "snowflake" {

[sfc-gh-asawicki]

The deprecation warnings come from the fact that these parameters were deprecated in the provider's configuration. The new token_accessor was introduced. We will work on the configuration in the upcoming provider configuration rework https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/ROADMAP.md#providers-configuration-rework. For now try switching to token_accessor or ignore the warnings (remember that these are warnings, not errors).

The error 390303 (08004): Invalid OAuth access token. is the error coming from Snowflake, so please reach out to Snowflake's support. The only thing I could find was https://community.snowflake.com/s/article/Error-Invalid-OAuth-access-token-SqlState-08006-VendorCode-390303 but it mentions Connector for .NET and we are using the gosnowflake driver underneath.

[olivierdewit]

Thank you for your support and explanations. It really helped!