[Bug]: snowflake_schema's describe_output changes appearing in every plan

[Mattioli]

Terraform CLI Version

1.7.4

Terraform Provider Version

1.0.0

Company Name

No response

Terraform Configuration

.

Category

category:resource

Object type(s)

No response

Expected Behavior

No change in plans when the resource is not modified at all

Actual Behavior

After upgrading from 0.93 to upper versions (0.94+), in every terraform plan, some specific snowflake_schema resources are showing as "to-change" even if the resource is not being touched at all. Specifically, the describe_output field is said to change, e.g.:

# snowflake_schema.dbt_blue_operations_sensitive will be updated in-place
--
  | ~ resource "snowflake_schema" "dbt_blue_operations_sensitive" {
  | + describe_output                               = (known after apply)
  | id                                            = "\"ANALYTICS_BLUE\".\"CORE_OPERATIONS_SENSITIVE\""
  | name                                          = "CORE_OPERATIONS_SENSITIVE"
  | # (20 unchanged attributes hidden)
  | }

When I look at the actual TF state, I notice that describe_output is empty. I suppose this is happening because my Terraform user doesn't have access to this schema (source), but it's trying to update it regardless. Is there a way for this not to happen without granting the terraform user ownership to these schemas?

Steps to Reproduce

1 - Be on a version >= 0.94.0
2 - Have a snowflake_schema where the terraform user has no sufficient privileges
3 - Run terraform plan
4 - Notice changes on describe_output for the related schema resource
5 - Apply cahnges
6 - Run terraform plan
7 - Notice again changes on describe_output for the related schema resource

How much impact is this issue causing?

Low

Logs

No response

Additional Information

No response

Would you like to implement a fix?

• Yeah, I'll take it 😎

[sfc-gh-jmichalak]

Hi @Mattioli 👋

Thanks for reporting this issue. I can't reproduce it. This field should not be marked as re-computedPlease provide the whole schema configuration (preferably with grants setup) and logs with TF_LOG=DEBUG.

You don't need to grant ownership. DESCRIBE for schemas returns a list of objects in the schema, so just MONITOR with at least one privilege granted on the object type should be enough - see docs.