All stacks · Platform & IaC

Terraform

Infrastructure as code for warehouses, IAM, and data accounts.

Terraform

Aug 23, 20264 min read

Terraform for Data Platforms: Modules for Warehouses, Not Click-Ops Grants

Click-ops Snowflake grants will not exist in the next account. Modules for warehouse plus IAM, secrets out of state, UI to explore, Terraform for anything that must last.

terraform
iac

About Terraform

Terraform (and OpenTofu) is how data platforms should create warehouses, IAM, buckets, and private networking — not click-ops in three clouds. The unit is a plan you can review, not a screenshot of the console.

Data engineers who skip IaC inherit mystery roles and a Snowflake account nobody can recreate. These notes cover the data-shaped parts: grants, service principals, and not putting secrets in state.

What you'll learn here

Modules for warehouses, databases, and IAM — not one 4,000-line file
State, locking, and who is allowed to apply prod
Snowflake / Databricks / AWS providers and the drift that still happens
Secrets: never in .tf, rarely in state, always in a manager

Frequently asked questions

Should data engineers write Terraform?

Yes for the objects they own (schemas, warehouses, jobs IAM). Platform teams own the account and network. A hard split with no PR path is how shadow click-ops returns.

Terraform or the vendor UI?

UI for exploration, Terraform for anything that must exist next quarter. If it is in the UI only, it will be missing in the next account.

OpenTofu or Terraform?

Same workflow for most data modules today. Pick what your org has licensed and standardized. Do not fork the tool debate in a Snowflake grant PR.

New Terraform posts, straight to your inbox

One email a week with our latest tutorials. No spam.

Newsletter signup is not live yet. Use the contact form if you want to be notified.