snowflakedb/terraform-provider-snowflake v2.23.0

on GitHub

2.23.0 (2026-11-05)

❗ Migration guide: v2.22.x -> v2.23.0

🎉 What's new:

• Rework the preview snowflake_alert resource and snowflake_alerts data source. (8f65b6e, 14901f6, d483e2d)
• Rework the preview snowflake_pipe resource and snowflake_pipes data source. (fac23fe, f4d2b74, 4edc13d, e51c6c5)
• Rework the preview snowflake_share resource and snowflake_shares data source. (475f89b, db133ae, d2f036c, e053edd, 4ec7382, af475d5), references #1279
• Add new preview resources and data sources:
  • snowflake_postgres_mirror resource and snowflake_postgres_mirrors data source for Postgres data mirrors. Table, schema, refresh interval, and warehouse changes apply in place. (de9476b, ee8eef1, 331a02f), references #5229
  • snowflake_replication_group and snowflake_replication_group_secondary resources and the snowflake_replication_groups data source. An external change of is_primary recreates the group. (24d3369, dfcddcc, ee5e077)
  • snowflake_projection_policy resource and snowflake_projection_policies data source. (9b336bc, e198540)
  • snowflake_code_bundle resource and snowflake_code_bundles data source. (075f22a, 07e2597, fb9975c)
  • snowflake_backup_policy resource and snowflake_backup_policies data source. The schedule is a block with one of hours, minutes, or using_cron. (869cd6d, 320ce12)
• snowflake_warehouse sends WAREHOUSE_TYPE = STANDARD when warehouse_type is omitted, including when the field is removed from an existing warehouse, so the type stays STANDARD when Snowflake changes the default to ADAPTIVE. (3731455)
• Add the token_file_path provider field. The driver re-reads that file on every new connection for OAuth, programmatic access token, and OIDC workload identity authentication. (fed96f3), references #5364
• Add version_trigger to snowflake_openflow_connector so a changed connector bundle loads in place. (f1c808d)
• Accept AWS_S3TABLES and AWS_PRIVATE_S3TABLES as rest_config.catalog_api_type on snowflake_catalog_integration_iceberg_rest. (00c6cd6), references #5344
• Enable the USER_ENABLE_DEFAULT_WORKLOAD_IDENTITY experiment by default on snowflake_service_user and snowflake_legacy_service_user. Opt out with experimental_features_disabled. (72d15ea), references #3942
• Add require_role_restriction_for_person_users and blocked_roles_list to the pat_policy block of snowflake_authentication_policy. (7f5c6a5)
• Add the opt-in IMPORT_PERMISSIVE_MODE experiment. Enforcing mode stays the default, and IMPORT_BOOLEAN_DEFAULT is opt-in again. Supported on authentication policies, backup policies, backup sets, catalog integrations, compute pools, external volumes, pipes, Postgres mirrors, shares, and warehouses.
  • Experiment switch (22d5873)
  • Authentication policy (74cb1dd)
  • Backup policy (bea3fad)
  • Catalog integrations (26ace51, 09ef9f6)
  • Compute pool (d0923c3)
  • External volume (866396c)
  • Warehouses (169f2d6, 006778e)
  • Pipe, share, and Postgres mirror (fac23fe, 475f89b, 331a02f)
• Add DATA_CONNECTIVITY_PROXY_EGRESS as a mode on snowflake_network_rule. (1bf87ae), references #5363
• Add token_accessor.min_tls_version to set the minimum TLS version for the refresh-token HTTP client. (8947efc)
• Add the opt-in WRITE_ONLY_ATTRIBUTES experiment, with write-only rsa_public_key_wo and rsa_public_key_2_wo and their version counters on snowflake_user, snowflake_service_user, and snowflake_legacy_service_user. Requires Terraform 1.11 or later. (9c643b8, 50a48ce)

🔧 Misc:

• Deprecate snowflake_notebook and snowflake_notebooks. Snowflake is disabling new Legacy Notebooks; use the preview code bundle resource and data source. (2d5de5c)
• Reject empty identifiers on snowflake_alert.warehouse, warehouse resource_monitor, snowflake_compute_pool.for_application, and replication group error_integration and primary before the request is sent. (5a547a2)
• Promote Openflow resources and data sources to stable: snowflake_openflow_connector, snowflake_openflow_deployment_byoc, snowflake_openflow_deployment_snowflake_managed, snowflake_openflow_runtime, and the matching data sources. Remove them from preview_features_enabled. (cca1a89)
• Include the resource name and id in import errors. (0312883)

🐛 Bug fixes:

• Quote Openflow deployment event_table with Snowflake identifier rules, so a lowercase SHOW PARAMETERS value matches a quoted configuration. (a065bff)
• Destroying snowflake_object_parameter runs UNSET when the Snowflake default is an empty string. (4836d90)
• Read hybrid and iceberg table parameters with SHOW PARAMETERS IN TABLE. (4836d90)
• Detect external changes to client_policy, mfa_policy, pat_policy, and workload_identity_policy on snowflake_authentication_policy. (74cb1dd)
• After snowflake_grant_ownership resumes a pipe, unset PIPE_EXECUTION_PAUSED when the pipe inherited that parameter before the transfer. (d388019)
• Removing allow_writes from snowflake_external_volume sets ALLOW_WRITES = TRUE, the Snowflake default. (866396c)
• Setting a Snowflake default explicitly plans no update for adaptive warehouse query settings, snowflake_external_volume.allow_writes, and catalog_namespace on REST and AWS Glue Iceberg tables. (79c8eae)
• Save configured snowflake_resource_monitor values in state when they already match Snowflake. (512906c)
• Save configured catalog integration and adaptive and interactive warehouse values in state when they already match Snowflake. (01305b4)
• Convert a warehouse to ADAPTIVE with ALTER WAREHOUSE directly, without suspending it. (bcee107), references #5342
• Resolve task graph roots from task-relations metadata so quoted predecessor names stay intact. (c5b3382)
• Cap expire_rotated_token_after_hours at the remaining lifetime when rotating a programmatic access token. (397e591)
• Read SNS topic ARNs in every AWS partition into snowflake_pipe.aws_sns_topic_arn. (2a1401f)
• Manage external_oauth_scope_delimiter only for CUSTOM external OAuth integrations. Other types leave it unset and omit it from SQL. (4a32747), references #5322

📦 Library updates:

Direct dependency changes (root go.mod)