Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Snowflake Provider
  4. API Docs
  5. GrantOwnership
Viewing docs for Snowflake v2.23.0
published on Friday, Nov 6, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-snowflake

snowflake.GrantOwnership

snowflake logo
Viewing docs for Snowflake v2.23.0
published on Friday, Nov 6, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-snowflake

    Note For more details about granting ownership, please visit GRANT OWNERSHIP Snowflake documentation page, and our grant ownership resource overview.

    Note Manage grants on HYBRID TABLE by specifying TABLE or TABLES in objectType field. This applies to a single object, all objects, or future objects. This reflects the current behavior in Snowflake.

    Note Changes introduced in 202501 Snowflake BCR Bundle alter how future ownership grant hierarchy works. After the change schema-level future ownership grant(s) will override those defined on the database-level. Previously, the database-level ones took the precedence.

    Warning Be careful when using this resource on managed schema or any object within it, as in Snowflake managed schemas follow different ownership and privilege model. For more details, please visit Schema documentation (scroll to WITH MANAGED ACCESS option).

    Granting ownership on pipes

    Snowflake transfers ownership only of a paused pipe. For every pipe (a single pipe, or each pipe when ownership is granted on all pipes in a database or schema), the provider:

    1. Checks the pipe status with SYSTEM$PIPE_STATUS, and pauses a running pipe with ALTER PIPE ... SET PIPE_EXECUTION_PAUSED = TRUE. This needs either OWNERSHIP, or OPERATE and MONITOR on the pipe. Without them, the provider tries the transfer as is, and Snowflake rejects it for a running pipe.
    2. Transfers the ownership.
    3. Resumes the pipe with SYSTEM$PIPE_FORCE_RESUME, but only when the pipe was running, the current role has OPERATE on the pipe, and outboundPrivileges = "COPY" keeps that privilege after the transfer. If the pipe inherited PIPE_EXECUTION_PAUSED from its schema or account before, the provider unsets it again, so the pipe ends as it started.

    Otherwise, the pipe stays paused, with PIPE_EXECUTION_PAUSED = TRUE set on the pipe. Being the owner of the pipe before the transfer is not enough to resume it, because the current role has no privileges on the pipe after the transfer.

    To keep a running pipe running, grant OPERATE and MONITOR on the pipe to the role used by the provider before the transfer, and set outboundPrivileges = "COPY":

    import * as pulumi from "@pulumi/pulumi";
import * as snowflake from "@pulumi/snowflake";

const pipeOperate = new snowflake.GrantPrivilegesToAccountRole("pipe_operate", {
    accountRoleName: "<role used by the provider>",
    privileges: [
        "OPERATE",
        "MONITOR",
    ],
    onSchemaObject: {
        objectType: "PIPE",
        objectName: example.fullyQualifiedName,
    },
});
const pipe = new snowflake.GrantOwnership("pipe", {
    accountRoleName: newOwner.name,
    outboundPrivileges: "COPY",
    on: {
        objectType: "PIPE",
        objectName: example.fullyQualifiedName,
    },
}, {
    dependsOn: [pipeOperate],
});

    import pulumi
import pulumi_snowflake as snowflake

pipe_operate = snowflake.GrantPrivilegesToAccountRole("pipe_operate",
    account_role_name="<role used by the provider>",
    privileges=[
        "OPERATE",
        "MONITOR",
    ],
    on_schema_object={
        "object_type": "PIPE",
        "object_name": example["fullyQualifiedName"],
    })
pipe = snowflake.GrantOwnership("pipe",
    account_role_name=new_owner["name"],
    outbound_privileges="COPY",
    on={
        "object_type": "PIPE",
        "object_name": example["fullyQualifiedName"],
    },
    opts = pulumi.ResourceOptions(depends_on=[pipe_operate]))

    package main

import (
	"github.com/pulumi/pulumi-snowflake/sdk/v2/go/snowflake"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pipeOperate, err := snowflake.NewGrantPrivilegesToAccountRole(ctx, "pipe_operate", &snowflake.GrantPrivilegesToAccountRoleArgs{
			AccountRoleName: pulumi.String("<role used by the provider>"),
			Privileges: pulumi.StringArray{
				pulumi.String("OPERATE"),
				pulumi.String("MONITOR"),
			},
			OnSchemaObject: &snowflake.GrantPrivilegesToAccountRoleOnSchemaObjectArgs{
				ObjectType: pulumi.String("PIPE"),
				ObjectName: pulumi.Any(example.FullyQualifiedName),
			},
		})
		if err != nil {
			return err
		}
		_, err = snowflake.NewGrantOwnership(ctx, "pipe", &snowflake.GrantOwnershipArgs{
			AccountRoleName:    pulumi.Any(newOwner.Name),
			OutboundPrivileges: pulumi.String("COPY"),
			On: &snowflake.GrantOwnershipOnArgs{
				ObjectType: pulumi.String("PIPE"),
				ObjectName: pulumi.Any(example.FullyQualifiedName),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			pipeOperate,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Snowflake = Pulumi.Snowflake;

return await Deployment.RunAsync(() => 
{
    var pipeOperate = new Snowflake.GrantPrivilegesToAccountRole("pipe_operate", new()
    {
        AccountRoleName = "<role used by the provider>",
        Privileges = new[]
        {
            "OPERATE",
            "MONITOR",
        },
        OnSchemaObject = new Snowflake.Inputs.GrantPrivilegesToAccountRoleOnSchemaObjectArgs
        {
            ObjectType = "PIPE",
            ObjectName = example.FullyQualifiedName,
        },
    });

    var pipe = new Snowflake.GrantOwnership("pipe", new()
    {
        AccountRoleName = newOwner.Name,
        OutboundPrivileges = "COPY",
        On = new Snowflake.Inputs.GrantOwnershipOnArgs
        {
            ObjectType = "PIPE",
            ObjectName = example.FullyQualifiedName,
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            pipeOperate,
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.snowflake.GrantPrivilegesToAccountRole;
import com.pulumi.snowflake.GrantPrivilegesToAccountRoleArgs;
import com.pulumi.snowflake.inputs.GrantPrivilegesToAccountRoleOnSchemaObjectArgs;
import com.pulumi.snowflake.GrantOwnership;
import com.pulumi.snowflake.GrantOwnershipArgs;
import com.pulumi.snowflake.inputs.GrantOwnershipOnArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pipeOperate = new GrantPrivilegesToAccountRole("pipeOperate", GrantPrivilegesToAccountRoleArgs.builder()
            .accountRoleName("<role used by the provider>")
            .privileges(            
                "OPERATE",
                "MONITOR")
            .onSchemaObject(GrantPrivilegesToAccountRoleOnSchemaObjectArgs.builder()
                .objectType("PIPE")
                .objectName(example.get("fullyQualifiedName"))
                .build())
            .build());

        var pipe = new GrantOwnership("pipe", GrantOwnershipArgs.builder()
            .accountRoleName(newOwner.get("name"))
            .outboundPrivileges("COPY")
            .on(GrantOwnershipOnArgs.builder()
                .objectType("PIPE")
                .objectName(example.get("fullyQualifiedName"))
                .build())
            .build(), CustomResourceOptions.builder()
                .dependsOn(pipeOperate)
                .build());

    }
}

    resources:
  pipeOperate:
    type: snowflake:GrantPrivilegesToAccountRole
    name: pipe_operate
    properties:
      accountRoleName: <role used by the provider>
      privileges:
        - OPERATE
        - MONITOR
      onSchemaObject:
        objectType: PIPE
        objectName: ${example.fullyQualifiedName}
  pipe:
    type: snowflake:GrantOwnership
    properties:
      accountRoleName: ${newOwner.name}
      outboundPrivileges: COPY
      on:
        objectType: PIPE
        objectName: ${example.fullyQualifiedName}
    options:
      dependsOn:
        - ${pipeOperate}

    terraform {
  required_providers {
    snowflake = {
      source = "pulumi/snowflake"
    }
  }
}

resource "snowflake_grant_privileges_to_account_role" "pipe_operate" {
  lifecycle {
    create_before_destroy = true
  }
  account_role_name = "<role used by the provider>"
  privileges        = ["OPERATE", "MONITOR"]
  on_schema_object {
    object_type = "PIPE"
    object_name = example.fullyQualifiedName
  }
}
resource "snowflake_grant_ownership" "pipe" {
  depends_on = [snowflake_grant_privileges_to_account_role.pipe_operate]
  lifecycle {
    create_before_destroy = true
  }
  account_role_name   = newOwner.name
  outbound_privileges = "COPY"
  on {
    object_type = "PIPE"
    object_name = example.fullyQualifiedName
  }
}

    A paused pipe is transferred without a pause and a resume, and it stays paused after the transfer.

    If the pipe is managed by the snowflake.Pipe resource:

    • With pipeExecutionPaused not set, or set to false, the pipe keeps running when the privileges above are granted. Without them, the pipe stays paused after the transfer, and snowflake.Pipe reports a difference for pipeExecutionPaused.
    • With pipeExecutionPaused = true, the pipe stays paused, and no additional privileges are needed.
    • Setting pipeExecutionPaused = false after the transfer does not resume a pipe that was paused during the transfer, because Snowflake resumes it this way only if its ownership did not change while it was paused. Resume it with SYSTEM$PIPE_FORCE_RESUME instead.

    Granting ownership on task

    Granting ownership on single task requires:

    • Either OWNERSHIP or OPERATE privilege to suspend the task (and its root)
    • Role that will be granted ownership has to have USAGE granted on the warehouse assigned to the task, as well as EXECUTE TASK granted globally
    • The outbound privileges set to outboundPrivileges = "COPY" if you want to move grants automatically to the owner (also enables the provider to resume the task automatically) If originally the first owner won’t be granted with OPERATE, USAGE (on the warehouse), EXECUTE TASK (on the account), and outbound privileges won’t be set to COPY, then you have to resume suspended tasks manually.

    Granting ownership on all tasks in database/schema

    Granting ownership on all tasks requires less privileges than granting ownership on one task, because it does a little bit less and requires additional work to be done after. The only thing you have to take care of is to resume tasks after grant ownership transfer. If all of your tasks are managed by the Snowflake Terraform Plugin, this should be as simple as running pulumi up second time (assuming the currently used role is privileged enough to be able to resume the tasks). If your tasks are not managed by the Snowflake Terraform Plugin, you should resume them yourself manually.

    Granting ownership on external tables

    Transferring ownership on an external table or its parent database blocks automatic refreshes of the table metadata by setting the AUTO_REFRESH property to FALSE. Right now, there’s no way to check the AUTO_REFRESH state of the external table and because of that, a manual step is required after ownership transfer. To set the AUTO_REFRESH property back to TRUE (after you transfer ownership), use the ALTER EXTERNAL TABLE command.

    Note If a field has a default value, it is shown next to the type in the schema.

    Create GrantOwnership Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new GrantOwnership(name: string, args: GrantOwnershipArgs, opts?: CustomResourceOptions);
    @overload
def GrantOwnership(resource_name: str,
                   args: GrantOwnershipArgs,
                   opts: Optional[ResourceOptions] = None)

@overload
def GrantOwnership(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   on: Optional[GrantOwnershipOnArgs] = None,
                   account_role_name: Optional[str] = None,
                   database_role_name: Optional[str] = None,
                   outbound_privileges: Optional[str] = None)
    func NewGrantOwnership(ctx *Context, name string, args GrantOwnershipArgs, opts ...ResourceOption) (*GrantOwnership, error)
    public GrantOwnership(string name, GrantOwnershipArgs args, CustomResourceOptions? opts = null)
    public GrantOwnership(String name, GrantOwnershipArgs args)
public GrantOwnership(String name, GrantOwnershipArgs args, CustomResourceOptions options)

    type: snowflake:GrantOwnership
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "snowflake_grant_ownership" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args GrantOwnershipArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args GrantOwnershipArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args GrantOwnershipArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args GrantOwnershipArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args GrantOwnershipArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var grantOwnershipResource = new Snowflake.GrantOwnership("grantOwnershipResource", new()
{
    On = new Snowflake.Inputs.GrantOwnershipOnArgs
    {
        All = new Snowflake.Inputs.GrantOwnershipOnAllArgs
        {
            ObjectTypePlural = "string",
            InDatabase = "string",
            InSchema = "string",
        },
        Future = new Snowflake.Inputs.GrantOwnershipOnFutureArgs
        {
            ObjectTypePlural = "string",
            InDatabase = "string",
            InSchema = "string",
        },
        ObjectName = "string",
        ObjectType = "string",
    },
    AccountRoleName = "string",
    DatabaseRoleName = "string",
    OutboundPrivileges = "string",
});

    example, err := snowflake.NewGrantOwnership(ctx, "grantOwnershipResource", &snowflake.GrantOwnershipArgs{
	On: &snowflake.GrantOwnershipOnArgs{
		All: &snowflake.GrantOwnershipOnAllArgs{
			ObjectTypePlural: pulumi.String("string"),
			InDatabase:       pulumi.String("string"),
			InSchema:         pulumi.String("string"),
		},
		Future: &snowflake.GrantOwnershipOnFutureArgs{
			ObjectTypePlural: pulumi.String("string"),
			InDatabase:       pulumi.String("string"),
			InSchema:         pulumi.String("string"),
		},
		ObjectName: pulumi.String("string"),
		ObjectType: pulumi.String("string"),
	},
	AccountRoleName:    pulumi.String("string"),
	DatabaseRoleName:   pulumi.String("string"),
	OutboundPrivileges: pulumi.String("string"),
})

    resource "snowflake_grant_ownership" "grantOwnershipResource" {
  lifecycle {
    create_before_destroy = true
  }
  on = {
    all = {
      object_type_plural = "string"
      in_database        = "string"
      in_schema          = "string"
    }
    future = {
      object_type_plural = "string"
      in_database        = "string"
      in_schema          = "string"
    }
    object_name = "string"
    object_type = "string"
  }
  account_role_name   = "string"
  database_role_name  = "string"
  outbound_privileges = "string"
}

    var grantOwnershipResource = new GrantOwnership("grantOwnershipResource", GrantOwnershipArgs.builder()
    .on(GrantOwnershipOnArgs.builder()
        .all(GrantOwnershipOnAllArgs.builder()
            .objectTypePlural("string")
            .inDatabase("string")
            .inSchema("string")
            .build())
        .future(GrantOwnershipOnFutureArgs.builder()
            .objectTypePlural("string")
            .inDatabase("string")
            .inSchema("string")
            .build())
        .objectName("string")
        .objectType("string")
        .build())
    .accountRoleName("string")
    .databaseRoleName("string")
    .outboundPrivileges("string")
    .build());

    grant_ownership_resource = snowflake.GrantOwnership("grantOwnershipResource",
    on={
        "all": {
            "object_type_plural": "string",
            "in_database": "string",
            "in_schema": "string",
        },
        "future": {
            "object_type_plural": "string",
            "in_database": "string",
            "in_schema": "string",
        },
        "object_name": "string",
        "object_type": "string",
    },
    account_role_name="string",
    database_role_name="string",
    outbound_privileges="string")

    const grantOwnershipResource = new snowflake.GrantOwnership("grantOwnershipResource", {
    on: {
        all: {
            objectTypePlural: "string",
            inDatabase: "string",
            inSchema: "string",
        },
        future: {
            objectTypePlural: "string",
            inDatabase: "string",
            inSchema: "string",
        },
        objectName: "string",
        objectType: "string",
    },
    accountRoleName: "string",
    databaseRoleName: "string",
    outboundPrivileges: "string",
});

    type: snowflake:GrantOwnership
properties:
    accountRoleName: string
    databaseRoleName: string
    "on":
        all:
            inDatabase: string
            inSchema: string
            objectTypePlural: string
        future:
            inDatabase: string
            inSchema: string
            objectTypePlural: string
        objectName: string
        objectType: string
    outboundPrivileges: string

    GrantOwnership Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The GrantOwnership resource accepts the following input properties:

    On GrantOwnershipOn
    Configures which object(s) should transfer their ownership to the specified role.
    AccountRoleName string
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    DatabaseRoleName string
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    OutboundPrivileges string
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    On GrantOwnershipOnArgs
    Configures which object(s) should transfer their ownership to the specified role.
    AccountRoleName string
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    DatabaseRoleName string
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    OutboundPrivileges string
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    on object
    Configures which object(s) should transfer their ownership to the specified role.
    account_role_name string
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    database_role_name string
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    outbound_privileges string
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    on GrantOwnershipOn
    Configures which object(s) should transfer their ownership to the specified role.
    accountRoleName String
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    databaseRoleName String
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    outboundPrivileges String
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    on GrantOwnershipOn
    Configures which object(s) should transfer their ownership to the specified role.
    accountRoleName string
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    databaseRoleName string
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    outboundPrivileges string
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    on GrantOwnershipOnArgs
    Configures which object(s) should transfer their ownership to the specified role.
    account_role_name str
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    database_role_name str
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    outbound_privileges str
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    on Property Map
    Configures which object(s) should transfer their ownership to the specified role.
    accountRoleName String
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    databaseRoleName String
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    outboundPrivileges String
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the GrantOwnership resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing GrantOwnership Resource

    Get an existing GrantOwnership resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: GrantOwnershipState, opts?: CustomResourceOptions): GrantOwnership
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_role_name: Optional[str] = None,
        database_role_name: Optional[str] = None,
        on: Optional[GrantOwnershipOnArgs] = None,
        outbound_privileges: Optional[str] = None) -> GrantOwnership
    func GetGrantOwnership(ctx *Context, name string, id IDInput, state *GrantOwnershipState, opts ...ResourceOption) (*GrantOwnership, error)
    public static GrantOwnership Get(string name, Input<string> id, GrantOwnershipState? state, CustomResourceOptions? opts = null)
    public static GrantOwnership get(String name, Output<String> id, GrantOwnershipState state, CustomResourceOptions options)
    resources:  _:    type: snowflake:GrantOwnership    get:      id: ${id}
    import {
  to = snowflake_grant_ownership.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountRoleName string
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    DatabaseRoleName string
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    On GrantOwnershipOn
    Configures which object(s) should transfer their ownership to the specified role.
    OutboundPrivileges string
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    AccountRoleName string
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    DatabaseRoleName string
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    On GrantOwnershipOnArgs
    Configures which object(s) should transfer their ownership to the specified role.
    OutboundPrivileges string
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    account_role_name string
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    database_role_name string
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    on object
    Configures which object(s) should transfer their ownership to the specified role.
    outbound_privileges string
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    accountRoleName String
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    databaseRoleName String
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    on GrantOwnershipOn
    Configures which object(s) should transfer their ownership to the specified role.
    outboundPrivileges String
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    accountRoleName string
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    databaseRoleName string
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    on GrantOwnershipOn
    Configures which object(s) should transfer their ownership to the specified role.
    outboundPrivileges string
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    account_role_name str
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    database_role_name str
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    on GrantOwnershipOnArgs
    Configures which object(s) should transfer their ownership to the specified role.
    outbound_privileges str
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.
    accountRoleName String
    The fully qualified name of the account role to which privileges will be granted. For more information about this resource, see docs.
    databaseRoleName String
    The fully qualified name of the database role to which privileges will be granted. For more information about this resource, see docs.
    on Property Map
    Configures which object(s) should transfer their ownership to the specified role.
    outboundPrivileges String
    Specifies whether to remove or transfer all existing outbound privileges on the object when ownership is transferred to a new role. Available options are: REVOKE for removing existing privileges and COPY to transfer them with ownership. For more information head over to Snowflake documentation.

    Supporting Types

    GrantOwnershipOn, GrantOwnershipOnArgs

    All GrantOwnershipOnAll
    Configures the privilege to be granted on all objects in either a database or schema.
    Future GrantOwnershipOnFuture
    Configures the privilege to be granted on all objects in either a database or schema.
    ObjectName string
    Specifies the identifier for the object on which you are transferring ownership.
    ObjectType string
    Specifies the type of object on which you are transferring ownership. For more information head over to Snowflake documentation. Known examples (case-insensitive): AGENT | AGGREGATION POLICY | ALERT | AUTHENTICATION POLICY | COMPUTE POOL | CORTEX SEARCH SERVICE | DATA METRIC FUNCTION | DATABASE | DATABASE ROLE | DBT PROJECT | DYNAMIC TABLE | EVENT TABLE | EXTERNAL TABLE | EXTERNAL VOLUME | FAILOVER GROUP | FILE FORMAT | FUNCTION | GIT REPOSITORY | HYBRID TABLE | ICEBERG TABLE | IMAGE REPOSITORY | INTEGRATION | INTERACTIVE TABLE | MATERIALIZED VIEW | NETWORK POLICY | NETWORK RULE | PACKAGES POLICY | PIPE | PROCEDURE | MASKING POLICY | PASSWORD POLICY | PROJECTION POLICY | REPLICATION GROUP | RESOURCE MONITOR | ROLE | ROW ACCESS POLICY | SCHEMA | SESSION POLICY | SECRET | SEMANTIC VIEW | SEQUENCE | SNOWFLAKE INTELLIGENCE | STAGE | STREAM | TABLE | TAG | TASK | USER | VIEW | WAREHOUSE. Snowflake validates the type at apply time.
    All GrantOwnershipOnAll
    Configures the privilege to be granted on all objects in either a database or schema.
    Future GrantOwnershipOnFuture
    Configures the privilege to be granted on all objects in either a database or schema.
    ObjectName string
    Specifies the identifier for the object on which you are transferring ownership.
    ObjectType string
    Specifies the type of object on which you are transferring ownership. For more information head over to Snowflake documentation. Known examples (case-insensitive): AGENT | AGGREGATION POLICY | ALERT | AUTHENTICATION POLICY | COMPUTE POOL | CORTEX SEARCH SERVICE | DATA METRIC FUNCTION | DATABASE | DATABASE ROLE | DBT PROJECT | DYNAMIC TABLE | EVENT TABLE | EXTERNAL TABLE | EXTERNAL VOLUME | FAILOVER GROUP | FILE FORMAT | FUNCTION | GIT REPOSITORY | HYBRID TABLE | ICEBERG TABLE | IMAGE REPOSITORY | INTEGRATION | INTERACTIVE TABLE | MATERIALIZED VIEW | NETWORK POLICY | NETWORK RULE | PACKAGES POLICY | PIPE | PROCEDURE | MASKING POLICY | PASSWORD POLICY | PROJECTION POLICY | REPLICATION GROUP | RESOURCE MONITOR | ROLE | ROW ACCESS POLICY | SCHEMA | SESSION POLICY | SECRET | SEMANTIC VIEW | SEQUENCE | SNOWFLAKE INTELLIGENCE | STAGE | STREAM | TABLE | TAG | TASK | USER | VIEW | WAREHOUSE. Snowflake validates the type at apply time.
    all object
    Configures the privilege to be granted on all objects in either a database or schema.
    future object
    Configures the privilege to be granted on all objects in either a database or schema.
    object_name string
    Specifies the identifier for the object on which you are transferring ownership.
    object_type string
    Specifies the type of object on which you are transferring ownership. For more information head over to Snowflake documentation. Known examples (case-insensitive): AGENT | AGGREGATION POLICY | ALERT | AUTHENTICATION POLICY | COMPUTE POOL | CORTEX SEARCH SERVICE | DATA METRIC FUNCTION | DATABASE | DATABASE ROLE | DBT PROJECT | DYNAMIC TABLE | EVENT TABLE | EXTERNAL TABLE | EXTERNAL VOLUME | FAILOVER GROUP | FILE FORMAT | FUNCTION | GIT REPOSITORY | HYBRID TABLE | ICEBERG TABLE | IMAGE REPOSITORY | INTEGRATION | INTERACTIVE TABLE | MATERIALIZED VIEW | NETWORK POLICY | NETWORK RULE | PACKAGES POLICY | PIPE | PROCEDURE | MASKING POLICY | PASSWORD POLICY | PROJECTION POLICY | REPLICATION GROUP | RESOURCE MONITOR | ROLE | ROW ACCESS POLICY | SCHEMA | SESSION POLICY | SECRET | SEMANTIC VIEW | SEQUENCE | SNOWFLAKE INTELLIGENCE | STAGE | STREAM | TABLE | TAG | TASK | USER | VIEW | WAREHOUSE. Snowflake validates the type at apply time.
    all GrantOwnershipOnAll
    Configures the privilege to be granted on all objects in either a database or schema.
    future GrantOwnershipOnFuture
    Configures the privilege to be granted on all objects in either a database or schema.
    objectName String
    Specifies the identifier for the object on which you are transferring ownership.
    objectType String
    Specifies the type of object on which you are transferring ownership. For more information head over to Snowflake documentation. Known examples (case-insensitive): AGENT | AGGREGATION POLICY | ALERT | AUTHENTICATION POLICY | COMPUTE POOL | CORTEX SEARCH SERVICE | DATA METRIC FUNCTION | DATABASE | DATABASE ROLE | DBT PROJECT | DYNAMIC TABLE | EVENT TABLE | EXTERNAL TABLE | EXTERNAL VOLUME | FAILOVER GROUP | FILE FORMAT | FUNCTION | GIT REPOSITORY | HYBRID TABLE | ICEBERG TABLE | IMAGE REPOSITORY | INTEGRATION | INTERACTIVE TABLE | MATERIALIZED VIEW | NETWORK POLICY | NETWORK RULE | PACKAGES POLICY | PIPE | PROCEDURE | MASKING POLICY | PASSWORD POLICY | PROJECTION POLICY | REPLICATION GROUP | RESOURCE MONITOR | ROLE | ROW ACCESS POLICY | SCHEMA | SESSION POLICY | SECRET | SEMANTIC VIEW | SEQUENCE | SNOWFLAKE INTELLIGENCE | STAGE | STREAM | TABLE | TAG | TASK | USER | VIEW | WAREHOUSE. Snowflake validates the type at apply time.
    all GrantOwnershipOnAll
    Configures the privilege to be granted on all objects in either a database or schema.
    future GrantOwnershipOnFuture
    Configures the privilege to be granted on all objects in either a database or schema.
    objectName string
    Specifies the identifier for the object on which you are transferring ownership.
    objectType string
    Specifies the type of object on which you are transferring ownership. For more information head over to Snowflake documentation. Known examples (case-insensitive): AGENT | AGGREGATION POLICY | ALERT | AUTHENTICATION POLICY | COMPUTE POOL | CORTEX SEARCH SERVICE | DATA METRIC FUNCTION | DATABASE | DATABASE ROLE | DBT PROJECT | DYNAMIC TABLE | EVENT TABLE | EXTERNAL TABLE | EXTERNAL VOLUME | FAILOVER GROUP | FILE FORMAT | FUNCTION | GIT REPOSITORY | HYBRID TABLE | ICEBERG TABLE | IMAGE REPOSITORY | INTEGRATION | INTERACTIVE TABLE | MATERIALIZED VIEW | NETWORK POLICY | NETWORK RULE | PACKAGES POLICY | PIPE | PROCEDURE | MASKING POLICY | PASSWORD POLICY | PROJECTION POLICY | REPLICATION GROUP | RESOURCE MONITOR | ROLE | ROW ACCESS POLICY | SCHEMA | SESSION POLICY | SECRET | SEMANTIC VIEW | SEQUENCE | SNOWFLAKE INTELLIGENCE | STAGE | STREAM | TABLE | TAG | TASK | USER | VIEW | WAREHOUSE. Snowflake validates the type at apply time.
    all GrantOwnershipOnAll
    Configures the privilege to be granted on all objects in either a database or schema.
    future GrantOwnershipOnFuture
    Configures the privilege to be granted on all objects in either a database or schema.
    object_name str
    Specifies the identifier for the object on which you are transferring ownership.
    object_type str
    Specifies the type of object on which you are transferring ownership. For more information head over to Snowflake documentation. Known examples (case-insensitive): AGENT | AGGREGATION POLICY | ALERT | AUTHENTICATION POLICY | COMPUTE POOL | CORTEX SEARCH SERVICE | DATA METRIC FUNCTION | DATABASE | DATABASE ROLE | DBT PROJECT | DYNAMIC TABLE | EVENT TABLE | EXTERNAL TABLE | EXTERNAL VOLUME | FAILOVER GROUP | FILE FORMAT | FUNCTION | GIT REPOSITORY | HYBRID TABLE | ICEBERG TABLE | IMAGE REPOSITORY | INTEGRATION | INTERACTIVE TABLE | MATERIALIZED VIEW | NETWORK POLICY | NETWORK RULE | PACKAGES POLICY | PIPE | PROCEDURE | MASKING POLICY | PASSWORD POLICY | PROJECTION POLICY | REPLICATION GROUP | RESOURCE MONITOR | ROLE | ROW ACCESS POLICY | SCHEMA | SESSION POLICY | SECRET | SEMANTIC VIEW | SEQUENCE | SNOWFLAKE INTELLIGENCE | STAGE | STREAM | TABLE | TAG | TASK | USER | VIEW | WAREHOUSE. Snowflake validates the type at apply time.
    all Property Map
    Configures the privilege to be granted on all objects in either a database or schema.
    future Property Map
    Configures the privilege to be granted on all objects in either a database or schema.
    objectName String
    Specifies the identifier for the object on which you are transferring ownership.
    objectType String
    Specifies the type of object on which you are transferring ownership. For more information head over to Snowflake documentation. Known examples (case-insensitive): AGENT | AGGREGATION POLICY | ALERT | AUTHENTICATION POLICY | COMPUTE POOL | CORTEX SEARCH SERVICE | DATA METRIC FUNCTION | DATABASE | DATABASE ROLE | DBT PROJECT | DYNAMIC TABLE | EVENT TABLE | EXTERNAL TABLE | EXTERNAL VOLUME | FAILOVER GROUP | FILE FORMAT | FUNCTION | GIT REPOSITORY | HYBRID TABLE | ICEBERG TABLE | IMAGE REPOSITORY | INTEGRATION | INTERACTIVE TABLE | MATERIALIZED VIEW | NETWORK POLICY | NETWORK RULE | PACKAGES POLICY | PIPE | PROCEDURE | MASKING POLICY | PASSWORD POLICY | PROJECTION POLICY | REPLICATION GROUP | RESOURCE MONITOR | ROLE | ROW ACCESS POLICY | SCHEMA | SESSION POLICY | SECRET | SEMANTIC VIEW | SEQUENCE | SNOWFLAKE INTELLIGENCE | STAGE | STREAM | TABLE | TAG | TASK | USER | VIEW | WAREHOUSE. Snowflake validates the type at apply time.

    GrantOwnershipOnAll, GrantOwnershipOnAllArgs

    ObjectTypePlural string
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    InDatabase string
    The fully qualified name of the database. For more information about this resource, see docs.
    InSchema string
    The fully qualified name of the schema. For more information about this resource, see docs.
    ObjectTypePlural string
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    InDatabase string
    The fully qualified name of the database. For more information about this resource, see docs.
    InSchema string
    The fully qualified name of the schema. For more information about this resource, see docs.
    object_type_plural string
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    in_database string
    The fully qualified name of the database. For more information about this resource, see docs.
    in_schema string
    The fully qualified name of the schema. For more information about this resource, see docs.
    objectTypePlural String
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    inDatabase String
    The fully qualified name of the database. For more information about this resource, see docs.
    inSchema String
    The fully qualified name of the schema. For more information about this resource, see docs.
    objectTypePlural string
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    inDatabase string
    The fully qualified name of the database. For more information about this resource, see docs.
    inSchema string
    The fully qualified name of the schema. For more information about this resource, see docs.
    object_type_plural str
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    in_database str
    The fully qualified name of the database. For more information about this resource, see docs.
    in_schema str
    The fully qualified name of the schema. For more information about this resource, see docs.
    objectTypePlural String
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    inDatabase String
    The fully qualified name of the database. For more information about this resource, see docs.
    inSchema String
    The fully qualified name of the schema. For more information about this resource, see docs.

    GrantOwnershipOnFuture, GrantOwnershipOnFutureArgs

    ObjectTypePlural string
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    InDatabase string
    The fully qualified name of the database. For more information about this resource, see docs.
    InSchema string
    The fully qualified name of the schema. For more information about this resource, see docs.
    ObjectTypePlural string
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    InDatabase string
    The fully qualified name of the database. For more information about this resource, see docs.
    InSchema string
    The fully qualified name of the schema. For more information about this resource, see docs.
    object_type_plural string
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    in_database string
    The fully qualified name of the database. For more information about this resource, see docs.
    in_schema string
    The fully qualified name of the schema. For more information about this resource, see docs.
    objectTypePlural String
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    inDatabase String
    The fully qualified name of the database. For more information about this resource, see docs.
    inSchema String
    The fully qualified name of the schema. For more information about this resource, see docs.
    objectTypePlural string
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    inDatabase string
    The fully qualified name of the database. For more information about this resource, see docs.
    inSchema string
    The fully qualified name of the schema. For more information about this resource, see docs.
    object_type_plural str
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    in_database str
    The fully qualified name of the database. For more information about this resource, see docs.
    in_schema str
    The fully qualified name of the schema. For more information about this resource, see docs.
    objectTypePlural String
    Specifies the type of object in plural form on which you are transferring ownership. For more information head over to Snowflake documentation.
    inDatabase String
    The fully qualified name of the database. For more information about this resource, see docs.
    inSchema String
    The fully qualified name of the schema. For more information about this resource, see docs.

    Import

    Note All the …_name parts should be fully qualified names (where every part is quoted), e.g. for schema object it is "<database_name>"."<schema_name>"."<object_name>"

    terraform import snowflake_grant_ownership.example '<role_type>|<role_identifier>|<outbound_privileges_behavior>|<grant_type>|<grant_data>'

    where:

    • roleType - string - type of granted role (either ToAccountRole or ToDatabaseRole)
    • roleName - string - fully qualified identifier for either account role or database role (depending on the role_type)
    • outboundPrivilegesBehavior - string - behavior specified for existing roles (can be either COPY or REVOKE)
    • grantType - enum
    • grantData - data dependent on grantType

    It has varying number of parts, depending on grant_type. All the possible types are:

    OnObject

    terraform import snowflake_grant_ownership.example '<role_type>|<role_identifier>|<outbound_privileges_behavior>|OnObject|<object_type>|<object_name>'

    OnAll (contains inner types: InDatabase | InSchema)

    InDatabase

    terraform import snowflake_grant_ownership.example '<role_type>|<role_identifier>|<outbound_privileges_behavior>|OnAll|<object_type_plural>|InDatabase|<database_name>'

    InSchema

    terraform import snowflake_grant_ownership.example '<role_type>|<role_identifier>|<outbound_privileges_behavior>|OnAll|<object_type_plural>|InSchema|<schema_name>'

    OnFuture (contains inner types: InDatabase | InSchema)

    InDatabase

    terraform import snowflake_grant_ownership.example '<role_type>|<role_identifier>|<outbound_privileges_behavior>|OnFuture|<object_type_plural>|InDatabase|<database_name>'

    InSchema

    terraform import snowflake_grant_ownership.example '<role_type>|<role_identifier>|<outbound_privileges_behavior>|OnFuture|<object_type_plural>|InSchema|<schema_name>'

    Import examples

    OnObject on Schema ToAccountRole

    terraform import snowflake_grant_ownership.example 'ToAccountRole|"accountRole"|COPY|OnObject|SCHEMA|"databaseName"."schemaName"'

    OnObject on Schema ToDatabaseRole

    terraform import snowflake_grant_ownership.example 'ToDatabaseRole|"databaseName"."databaseRoleName"|COPY|OnObject|SCHEMA|"databaseName"."schemaName"'

    OnObject on Table

    terraform import snowflake_grant_ownership.example 'ToAccountRole|"accountRole"|COPY|OnObject|TABLE|"databaseName"."schemaName"."tableName"'

    OnAll InDatabase

    terraform import snowflake_grant_ownership.example 'ToAccountRole|"accountRole"|REVOKE|OnAll|TABLES|InDatabase|"databaseName"'

    OnAll InSchema

    terraform import snowflake_grant_ownership.example 'ToAccountRole|"accountRole"||OnAll|TABLES|InSchema|"databaseName"."schemaName"'

    OnFuture InDatabase

    terraform import snowflake_grant_ownership.example 'ToAccountRole|"accountRole"||OnFuture|TABLES|InDatabase|"databaseName"'

    OnFuture InSchema

    terraform import snowflake_grant_ownership.example 'ToAccountRole|"accountRole"|COPY|OnFuture|TABLES|InSchema|"databaseName"."schemaName"'

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Snowflake pulumi/pulumi-snowflake
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the snowflake Terraform Provider.
    snowflake logo
    Viewing docs for Snowflake v2.23.0
    published on Friday, Nov 6, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-snowflake

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial