feat: Add SnowDDL to Terraform generator command

[db-tycoon-stephen]

Summary

Add uv run generate-terraform command to convert SnowDDL YAML configurations into equivalent Terraform HCL files, enabling migration from SnowDDL to Terraform-managed infrastructure.

Motivation

• Migration path: Provides a clear path to migrate from SnowDDL to Terraform
• Standard IaC: Terraform is widely adopted and may be preferred in some organizations
• Flexibility: Allows users to choose their preferred IaC tool

Proposed Command

uv run generate-terraform                      # Output to stdout
uv run generate-terraform --output terraform/  # Write to directory structure
uv run generate-terraform --format hcl         # HCL format (default)
uv run generate-terraform --format json        # JSON format for Terraform

Output Structure

terraform/
├── main.tf           # Provider configuration
├── users.tf          # snowflake_user resources
├── warehouses.tf     # snowflake_warehouse resources
├── roles.tf          # snowflake_account_role resources
├── grants.tf         # snowflake_grant_* resources
├── policies.tf       # Network, auth, password, session policies
├── databases.tf      # snowflake_database + snowflake_schema
├── imports.tf        # Import blocks for existing resources
└── variables.tf      # Configurable variables (account, etc.)

Resource Mapping

SnowDDL Config	Terraform Resource
user.yaml	snowflake_user
warehouse.yaml	snowflake_warehouse
tech_role.yaml	snowflake_account_role + snowflake_grant_privileges_to_account_role
business_role.yaml	snowflake_account_role + snowflake_grant_account_role
network_policy.yaml	snowflake_network_policy
authentication_policy.yaml	snowflake_authentication_policy
password_policy.yaml	snowflake_password_policy
session_policy.yaml	snowflake_session_policy
resource_monitor.yaml	snowflake_resource_monitor
{DB}/params.yaml	snowflake_database + snowflake_schema

Implementation Considerations

1. Grants expansion: SnowDDL's compact format (TABLE:SELECT,INSERT: [DB1, DB2]) needs expansion into separate Terraform grant resources

2. Import blocks: Generate Terraform 1.5+ import blocks for seamless migration of existing resources

3. Dependencies: Use Terraform references (not depends_on) for proper ordering

4. Sensitive data:

   • RSA keys should use sensitive = true
   • Encrypted passwords need special handling (or exclude from output)

5. Provider configuration: Generate with variables for account/credentials

Example Transformation

Input (warehouse.yaml):

MAIN_WAREHOUSE:
  auto_suspend: 60
  comment: SnowTower team warehouse
  resource_monitor: DEV_ENVIRONMENT_MONITOR
  size: X-Small

Output (warehouses.tf):

resource "snowflake_warehouse" "main_warehouse" {
  name             = "MAIN_WAREHOUSE"
  warehouse_size   = "XSMALL"
  auto_suspend     = 60
  auto_resume      = true
  comment          = "SnowTower team warehouse"
  resource_monitor = snowflake_resource_monitor.dev_environment_monitor.name
}

Output (imports.tf):

import {
  to = snowflake_warehouse.main_warehouse
  id = "MAIN_WAREHOUSE"
}

Acceptance Criteria

• Command registered in pyproject.toml as generate-terraform
• Generates valid Terraform HCL for all SnowDDL config types
• Includes import blocks for migration
• Provider configuration with variables
• Unit tests for each transformer
• Documentation in docs/guide/

References

• Snowflake Terraform Provider
• Terraform Import Blocks

[db-tycoon-stephen]

Completed in PR #26 (merged to v0.3)