cztack
cztack copied to clipboard
Terraform modules snowflake-XXX-grant-all should not have OWNERSHIP privileges
All the terraform modules have in their privileges list the OWNERSHIP role, for example on the snowflake-warehouse-grant-all module :
"privileges": [
"MODIFY",
"MONITOR",
"OPERATE",
"OWNERSHIP",
"USAGE"
]
This is incorrect, because the actual result of the Snowflake command GRANT ALL ON WAREHOUSE TO ROLE will give the following privileges : MODIFY, MONITOR, OPERATE and USAGE.
I have this issue too. Please remove OWNERSHIP privileges from all "all" grants