User network policy attachments and migration to v0.95

[ppo-38]

Hi, I want to migrate to v0.95.0 provider version but I have a question about network policy attachments.

Before v0.95, I attached network policies to users using the snowflake_network_policy_attachment resource.

Since v0.95, there is a new network_policy attribute on the snowflake_user resource. Does it mean that we now have to use this new attribute and no longer use snowflake_network_policy_attachment? Initial tests seem to confirm this, but I'd like your opinion.

The migration guide about this :

(breaking change) user parameters added to snowflake_user resource
On our road to V1 we changed the approach to Snowflake parameters on the object level; now, we add them directly to the resource. This is a breaking change because now:
Leaving the config empty does not set the default value on the object level but uses the one from hierarchy on Snowflake level instead (so after version bump, the diff running UNSET statements is expected).

[sfc-gh-asawicki]

Hey @ppo-38. Yes, I will update the migration guide, because this is not clear there.

Essentially, this resource should be treated similarly to snowflake_user_public_key (which is mentioned in the migration guide here: https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#breaking-change-snowflake_user_public_keys-usage-with-snowflake_user). There are two differences, though:

1. There is also an account option (https://registry.terraform.io/providers/Snowflake-Labs/snowflake/latest/docs/resources/network_policy_attachment#set_for_account). It is also available through the snowflake_account_parameter resource.
2. Multiple users are handled in the resource.

We will most likely leave the resource for situations where user creation is not managed through Terraform (to leave an option to assign network policies if needed).

[ppo-38]

Hey @sfc-gh-asawicki, thank you for your answer. So I will also remove snowflake_user_public_key in my configuration. For information, if snowflake_user_public_key is defined in configuration and network_policy is not defined in snowflake_user attribute, then network policies are first removed from users by the provider.

[sfc-gh-asawicki]

Hey. This is expected behavior originating from how the Snowflake parameter hierarchies work. We wanted to have the same behavior on the provider side (check more here, here, and here). It is also the reason why snowflake_user resource should not be used with snowflake_user_public_keys and snowflake_network_policy_attachment resources.

[sfc-gh-asawicki]

@ppo-38 hey, I have just added the missing part to the migration guide here:

terraform-provider-snowflake/MIGRATION_GUIDE.md

Line 318 in d5dac60

#### *(breaking change)* snowflake_network_policy_attachment usage with snowflake_user

[jrobison-sb]

I had a need to attach a network policy to some user accounts today and stumbled on to this GitHub issue for a similar reason as the author. It wasn't clear to me if I should use the network_policy attribute of the snowflake_user resource, or if I should use the snowflake_network_policy_attachment resource.

The migration guide linked above makes it clear which one you should use:

terraform-provider-snowflake/MIGRATION_GUIDE.md

Line 318 in d5dac60

#### *(breaking change)* snowflake_network_policy_attachment usage with snowflake_user

But that tidbit is likely only helpful if you're migrating an existing setup from an older provider version to a newer provider version and thus you are reading the migration guide. If you're already on the new version and you're setting up a network policy -> user attachment from scratch and just reading the docs, it won't be clear to you which one you should use.

It would be helpful if the standard docs provided guidance on this.

[sfc-gh-asawicki]

Hey @jrobison-sb. Thanks for reaching out to us.

You are right; we will add it to the newest version docs.