TerraformでSnowflake環境構築スターターキットを作る試み

terraform {
  required_version = ">= 1.0.11"

  required_providers {
    snowflake = {
      source  = "chanzuckerberg/snowflake"
      version = "0.25.29"
    }
    aws = {
      version = "3.69.0"
    }
  }
}

# 
# Snowflake
# 
# ACCOUNTADMINを使うときはこちら
provider "snowflake" {
  alias            = "snowflake_accountadmin"
  account          = var.snowflake_account
  username         = var.snowflake_username
  private_key_path = var.snowflake_private_key_path
  role             = "ACCOUNTADMIN"
}

# Snowflake SYSADMINで十分なときはこちら
provider "snowflake" {
  alias            = "snowflake_sysadmin"
  account          = var.snowflake_account
  username         = var.snowflake_username
  private_key_path = var.snowflake_private_key_path
  role             = "SYSADMIN"
}

# 
# AWS
# 
provider "aws" {
  region = "ap-northeast-1"
}

# S3バケット、DynamoDBテーブル定義は terraform/environments/backend/resource.tf にある
terraform {
  backend "s3" {
    bucket         = "snowflake-starterkit"       # 作成済み
    key            = "dev/terraform.tfstate"
    region         = "ap-northeast-1"
    dynamodb_table = "snowflake-starterkit-lock"  # 作成済み
  }
}

# 
# ここからは各サンプルコードを呼び出すだけ
# パラメータの与え方は examples/ 以下の各サンプルで書く
# 

module "example_storage_integration_s3" {
  source = "../../examples/storage_integration_s3"
  providers = {
    snowflake = snowflake.snowflake_accountadmin
    aws       = aws
  }
  env = "dev"
}

locals {
  snowflake_storage_integration   = "${var.env}-s3_integration" 
  snowflake_external_stage_bucket = "${var.env}-snowflake-external-stage"
  snowflake_external_stage_role   = "${var.env}-snowflake-external-stage-role"
  snowflake_external_stage_policy = "${var.env}-snowflake-external-stage-policy"
}

# 外部ステージ（S3）
module "snowflake_external_stage" {
  # S3・IAMロール・IAMポリシーを作成するモジュール
  # Snowflake側のExternal IDを設定できるようにしてある
  source                 = "../../modules/aws/s3_snowflake_external_stage"
  providers = {
    aws = aws
  }

  bucket_name            = local.snowflake_external_stage_bucket
  role_name              = local.snowflake_external_stage_role
  policy_name            = local.snowflake_external_stage_policy
  snowflake_external_id  = [snowflake_storage_integration.s3_integration.storage_aws_external_id]
  snowflake_iam_user_arn = [snowflake_storage_integration.s3_integration.storage_aws_iam_user_arn]
  env                    = var.env

  depends_on = [
    # storage integration が先に存在する必要がある
    snowflake_storage_integration.s3_integration
  ]
}

# 外部ステージを参照するためのintegration
# 外部ステージを参照するためのintegration
resource "snowflake_storage_integration" "s3_integration" {
  provider = snowflake
  name    = local.snowflake_storage_integration
  type    = "EXTERNAL_STAGE"
  enabled = true
  storage_provider = "S3"
  storage_allowed_locations = [
    # 名前がわかっているので変数で与える
    "s3://${local.snowflake_external_stage_bucket}/"
  ]

  # 名前がわかっているので変数で与える
  storage_aws_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${local.snowflake_external_stage_role}"
}

################################################################################
# Base Image
################################################################################
FROM ubuntu:20.04

################################################################################
# Environments
################################################################################
# timezone
# "questions will narrow this down by presenting a list of cities, representing the time zones in which they are located." への対策
ENV TZ=Asia/Tokyo 

################################################################################
# Arguments
################################################################################
# terraform version
ARG terraform_version="1.0.11"

# Snowflake version
ARG snowflake_bootstrap_version="1.2"
ARG snowflake_version="1.2.20"

# Snowflake install option
ARG snowsql_dest="/root/.snowsql/${snowflake_version}"
ARG snowsql_login_shell="/root/.bashrc"

################################################################################
# Run commands
################################################################################
# Set timezone
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone

# Install tools
RUN apt update && \
  apt-get install --yes sudo make curl unzip jq git && \
  # Install awscliv2
  curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
  unzip awscliv2.zip && \
  rm -rf awscliv2.zip && \
  sudo ./aws/install && \
  # Install terraform
  curl -O "https://releases.hashicorp.com/terraform/${terraform_version}/terraform_${terraform_version}_linux_amd64.zip" && \
  unzip ./terraform_${terraform_version}_linux_amd64.zip -d /usr/local/bin/ && \
  rm -rf ./terraform_${terraform_version}_linux_amd64.zip && \
  # Install SnowSQL
  curl -O "https://sfc-repo.snowflakecomputing.com/snowsql/bootstrap/${snowflake_bootstrap_version}/linux_x86_64/snowsql-${snowflake_version}-linux_x86_64.bash" && \
  sudo touch "${snowsql_login_shell}" && \ 
  mkdir -p ${snowsql_dest} && \
  export SNOWSQL_DEST=${snowsql_dest} && export SNOWSQL_LOGIN_SHELL=${snowsql_login_shell} && bash ./snowsql-${snowflake_version}-linux_x86_64.bash