Creating Snowflake Resources Using Terraform

				
					name: Terraform Pipeline 
run-name: Terraform Pipeline-@${{ github.actor }}.${{ github.sha }} 
 
on: 
  push: 
    branches: 
      - "infra/**" 
      - "!main" 
    paths-ignore: 
      - .gitignore 
      - LICENSE 
      - '**/*.md' 
      - 'README.md' 
  workflow_dispatch: 
    # Inputs the workflow expects. 
    inputs: 
      environment: 
        description: 'Deployment Environment' 
        required: true 
        default: 'dev' 
        type: choice 
        options: 
          - dev 
          - test 
 
permissions: 
  id-token: write   # This is required for requesting the JWT 
  contents: read    # This is required for actions/checkout 
 
jobs: 
  terraform-snowflake: 
    runs-on: ubuntu-latest 
    environment: ${{ inputs.environment }} 
    env: 
      INFRA_PATH : "infra/snowflake/terraform" 
      ENV: "dev" 
    # Ensure that only a single job or workflow runs using the same concurrency group 
    concurrency: 
      group: ${{ github.workflow }}-${{ github.ref }} 
      cancel-in-progress: true 
 
 
    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest 
    defaults: 
      run: 
        shell: bash 
 
    steps: 
      - name: Checkout code 
        uses: actions/checkout@v4 
        with: 
            repository: cevoaustralia/cevo-data-pattern-library 
 
      - name: configure aws credentials 
        uses: aws-actions/configure-aws-credentials@v4 
        with: 
          role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT }}:role/github-actions-role" 
          role-session-name: snowflake-terraform-session 
          aws-region:  ${{ vars.AWS_REGION }} 
 
      - name: Set up Terraform 
        uses: hashicorp/setup-terraform@v1 
        with: 
          terraform_version: 1.8.5 
 
      - name: Prepare Terraform Runs 
        run: | 
          sudo apt-get install jq -y 
          pip install checkov 
          curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash 
 
 
      - name: Terraform Fmt 
        id: fmt 
        run: 
          echo "** Running Terraform Fmt **" 
          terraform fmt -check -recursive 
        working-directory: ./${{ env.INFRA_PATH }} 
 
      - name: Terraform Init 
        id: init 
        run: | 
          echo "** Running Terraform Init **" 
          terraform init -backend-config=./environments/${{ env.ENV }}.backend 
        working-directory: ./${{ env.INFRA_PATH }} 
 
 
      - name: Check Terraform Init Status 
        if: steps.init.outcome == 'failure' 
        run: exit 1 
 
 
      - name: Terraform Validate 
        id: validate 
           
        run: | 
          echo "** Running Terraform Validate **" 
          terraform validate 
        working-directory: ./${{ env.INFRA_PATH }} 
 
 
      - name: Check Terraform Validate Status 
        if: steps.validate.outcome == 'failure' 
        run: exit 1 
 
      - name: Plan Terraform changes 
        run: | 
          echo "** Running Terraform Plan **" 
          terraform plan -var-file="./environments/dev.tfvars" -out tf.plan 
        working-directory: ./${{ env.INFRA_PATH }} 
        env: 
          SNOWFLAKE_ACCOUNT: ${{ vars.SNOWFLAKE_ACCOUNT }} 
          SNOWFLAKE_USER: ${{ vars.SNOWFLAKE_USER }} 
          TF_VAR_private_key: ${{ secrets.TF_VAR_PRIVATE_KEY }} 
          SNOWFLAKE_PRIVATE_KEY: ${{ secrets.TF_VAR_PRIVATE_KEY }} 
 
      - name: Terraform Plan Status 
        if: steps.plan.outcome == 'failure' 
        run: exit 1 
 
      - name: Run Checkov Terraform Infra Checks 
        run: | 
          echo "** Save Terraform Plan File as Json File **" 
          terraform show -json tf.plan > tf.json 
 
          # echo "** Format Json Terraform Plan **" 
          # jq '.' tf.json > tf_pretty.json 
 
          # echo "** Running Checkov Terraform Infra Checks **" 
          # checkov -f tf.json --skip-check CKV2_AWS_5,CKV2_AWS_11,CKV_AWS_144,CKV2_AWS_41,CKV2_AWS_12,CKV_AWS_337 
        working-directory: ./${{ env.INFRA_PATH }} 
 
 
      - name: Run Terraform Apply 
        run: | 
          echo "** Save Terraform Plan File as Json File **" 
          terraform apply  -var-file="./environments/dev.tfvars" -auto-approve 
        working-directory: ./${{ env.INFRA_PATH }} 
        env: 
          SNOWFLAKE_ACCOUNT: ${{ vars.SNOWFLAKE_ACCOUNT }} 
          SNOWFLAKE_USER: ${{ vars.SNOWFLAKE_USER }} 
          TF_VAR_private_key: ${{ secrets.TF_VAR_PRIVATE_KEY }} 
          SNOWFLAKE_PRIVATE_KEY: ${{ secrets.TF_VAR_PRIVATE_KEY }}