Programmatic Access Tokens on Roadmap - what's in scope?

[Andrew-Lindsay42]

I know that PAT authentication is currently on the roadmap, but I was wondering what's in scope for this.

Will this include the ability to generate and rotate programmatic access tokens for a service user created through Terraform?

At the moment we are doing something along these lines to create a password, assign it to a new user, and then store the result in Hashicorp Vault:

resource "random_password" "password" {
  length = 30
}

resource "snowflake_legacy_service_user" "svc_user" {
  name     = "NEW_USER"
  password = random_password.password.result
}

resource "vault_generic_secret" "svc_user" {
  path = "secret/dev/snowflake/user_secret"

  data_json = jsonencode({
    snowflake_legacy_service_user.svc_user.name : random_password.password.result
  })
}

I'm not a huge fan of this method, but it fits the use cases where some of our end user tooling only supports username & password authentication to Snowflake, and it does mean we can do it all just through Terraform.

Once November rolls around and legacy service users are no longer able to be created, we'll have to use PATs for these use cases. Ideally I don't want anyone to have to manage their tokens directly - generating these programmatically in Terraform would be preferable, to be picked up downstream from some kind of secure store. This also means that we could automatically rotate the tokens, which would be nice!

In a perfect world, we'd be able to do something like this:

resource "snowflake_service_user" "svc_user" {
  name           = "NEW_USER"
  network_policy = "POLICY_123" 
}

resource "snowflake_service_user_pat" "svc_user_pat" {
  name              = "ACCESS_TOKEN"
  generate_for_user = snowflake_service_user.svc_user.name
  role_restriction  = "SERVICE_ACCOUNT_ROLE"

  days_to_expiry     = 14
  rotate_after_days  = 7
}

resource "vault_generic_secret" "svc_user" {
  path = "secret/dev/snowflake/user_secret"

  data_json = jsonencode({
    snowflake_service_user.svc_user.name : snowflake_service_user_pat.svc_user_pat.token
  })
}

Is this a use case that's supported on the roadmap somewhere?
Does this even make sense to be done through the Terraform provider? It's probably getting into a slightly grey area, but being able to do most stuff through tf rather than having to maintain a bunch of scripts definitely makes life easier.

[sfc-gh-jmichalak]

Hi @Andrew-Lindsay42 👋

Thanks for your insights! We'll start working on the PATs later this month. We still haven't established a clear scope for this feature. For now, we will support PAT authentication in the provider (via Go driver) and basic PAT management. Currently, we aren't planning to implement rotating PATs.

We will update you when we agree on the scope and designs.

[Andrew-Lindsay42]

Thanks :)

Basic PAT management is still better than nothing and we can hack something together with lifecycles and replace_triggered_by for rotating them.
Looking forward to them getting into the provider!

[sfc-gh-jmichalak]

Hi @Andrew-Lindsay42 👋

We've released v2.4.0 (release, migration guide) with PAT support, including token rotation. Please try it out and give us feedback.

[Andrew-Lindsay42]

Hey @sfc-gh-jmichalak,

Just to say that this is ideal - I finally got the time to implement this in our set up and it's exactly what we were looking for, especially the rotation.

Thanks!

[sfc-gh-jmichalak]

You're welcome, we really appreciate your feedback 😄