Network policy showing up as suggested in plan eventhough created

[y-tee]

For other account level parameters in account_params.yaml , eventhough the snowddl is not the user to apply it (have to use ACCOUNTADMIN role), after the change is manually applied on snowsight with ACCOUNTADMIN, the suggested SQL commands does not show up anymore in snowddl plan

However for network_policy.yaml and account_policy.yaml it does not behave the same way. It is still showing up as suggested after i have applied it on snowsight. Any idea what may have been wrong? I want to keep it in snowddl to be git version controlled

[littleK0i]

Probably Snowflake changed something related to policy reference output.

Could you check the output of the following commands executed by ACCOUNTADMIN and by SnowDDL admin role? Do you see account-level reference returned? Any differences depending on current role?

SELECT * FROM TABLE(snowflake.information_schema.policy_references(policy_name => '<policy_name>', policy_kind => 'NETWORK_POLICY'))

[y-tee]

run the same command with snowddl role it says my network policy does not exist or not authorized

[y-tee]

Do you see entry with "REF_ENTITY_DOMAIN" equals to "ACCOUNT"?

yes with accountadmin, snowddl role cant run

[littleK0i]

Ok, I see. So they changed how permissions on network policies work.

Try to run this:

GRANT OWNERSHIP ON NETWORK POLICY <name> TO ROLE <snowddl_admin_role>;

So when you run stuff using ACCOUNTADMIN, created objects end up being "owned" by ACCOUNTADMIN, and SnowDDL admin cannot check references and manage such object.

I'll see if I can add additional "grant ownership" commands for "suggested SQL" only.

Alternatively, you may try to attach network policy to account using SnowDDL admin role. Technically it has "MANAGE GRANTS" from "SECURITYADMIN", so this operation might be allowed.

[y-tee]

I think it is working, now running on snowddl plan it is complaining that it does not have a warehouse set, when i run the earlier command on snowsight with snowddl role it is able to return a result instead of does not exists or not authorized

thanks alot!

[littleK0i]

Yeah, warehouse is required when working with policies. I generally suggest to create a separate warehouse for SnowDDL manually, grant USAGE on it to SnowDDL role and set DEFAULT_WAREHOUSE for SnowDDL user.

Basically, it is a Snowflake limitation. Most metadata commands do not require active warehouse, but table functions is the only way to get references, and Snowflake requires active warehouse for this.

[y-tee]

hi @littleK0i want to follow up with this, considering that i add -w (warehouse) in snowddl plan or snowddl apply, would it be smart enough to not use my warehouse if i am running regular commands that dont need warehouse?

or i should just explicitly include it only when the command needs a warehouse, like network policies?

[littleK0i]

@y-tee , you may safely set -w CLI option in all cases. Snowflake does not start a warehouse unless it is needed for specific query.