## Snowflake Infrastructure Management

## Account Structure
- `prod/snowflake/delphi/` - Main Delphi production account configurations
- `prod/snowflake/delphidev/` - Delphi development account configurations

## Resource Organization
Account directories may contain the following subdirectories:
- `authentication_policies/` - MFA and authentication requirements
- `compute_pools/` - Snowflake compute pool configurations
- `databases/` - Database configurations with schemas and shared databases
- `external-access-integrations/` - External network access integration configurations
- `external-stages/` - External stage configurations (e.g. S3-backed stages)
- `human_users/` - User management with roles, authentication policies, and permissions
- `network-policies/` - Network access control policies
- `network-rules/` - Network rule configurations
- `roles/` - Custom role definitions and hierarchies
- `security_integrations/` - OAuth and other security integration configurations
- `service_users/` - Service account configurations for applications
- `storage_integrations/` - Cloud storage integration configurations
- `tags/` - Snowflake tag definitions
- `warehouses/` - Compute warehouse configurations

## Snowflake Provider Configuration

```hcl
provider "snowflake" {
  account_name = "delphi"  # or "delphidev"
  role         = "PROD_ATLANTIS"
}
```

The `preview_features_enabled` setting may be required for certain features. Refer to the relevant module documentation for details.

## Snowflake Modules

Snowflake modules can be found in the `terraform-snowflake` repository. Modules exist for managing:

- Compute pools
- Databases
- Object access roles
- Service users
- Warehouses

Use the `get-terraform-module-documentation` skill for usage instructions and available inputs.

## Snowflake Standards and Best Practices

### Role Management Guidelines

Snowflake roles follow a two-tier structure:

**Object Access Roles**
- Encapsulate permissions on specific objects (databases, warehouses)
- Example: `MARKETING_INTEGRATIONS_DB_READWRITE` grants read-write permissions on the `MARKETING_INTEGRATIONS` database
- **Should not be created directly** - automatically provisioned by Terraform modules
- If missing privileges or new object access role types are needed, raise a DevOps ticket

**Functional Roles**
- Align with business functions and inherit permissions via object access roles
- Example: `MARKETING_INTEGRATIONS_FIVETRAN` role inherits database permissions via the object access role
- **Should not have explicit grants on objects** - all grants inherited via object access roles
- All functional roles for each account are defined in a single location under the account's `roles/` directory