Terraform provider

Authentication

In the Espresso dashboard, select an existing account, open Tools → API Keys, choose Generate API key → Organization key, and copy the complete ok_ secret. It cannot be displayed again. Set it as ESPRESSO_API_KEY.

Snowflake credentials

resource "espresso_account" "production" {
  slug         = "acme_snowflake_production"
  display_name = "Acme Snowflake Production"
  product      = "snowflake"
}

data "espresso_snowflake_public_key" "production" {
  account = espresso_account.production.slug
}

resource "snowflake_service_user" "espresso" {
  name              = "ESPRESSO_AI_USER"
  default_role      = "ESPRESSO_AI_ROLE"
  default_warehouse = "ESPRESSO_AI_WH"
  rsa_public_key    = data.espresso_snowflake_public_key.production.public_key
}

resource "espresso_snowflake_credentials" "production" {
  account           = espresso_account.production.slug
  snowflake_account = "acme-org-acme-production"
  host              = "acme-org-acme-production.snowflakecomputing.com"
  username           = snowflake_service_user.espresso.name
  role               = "ESPRESSO_AI_ROLE"
  warehouse          = "ESPRESSO_AI_WH"
}

espresso_snowflake_public_key only reads the public half of an existing Espresso keypair. Configure the keypair through Espresso onboarding before reading it, then assign the value to the Snowflake service user before creating espresso_snowflake_credentials. The credentials resource always uses the stored keypair and tests the Snowflake connection before saving the remaining connection settings. Omit host to derive it from snowflake_account.

An account's display_name can be updated in place. Its slug and product are immutable. Removing an account or credentials resource from Terraform stops managing it but does not delete the account or stored credentials from Espresso.

Warehouse Agent settings

resource "espresso_snowflake_warehouse_agent" "production" {
  account     = espresso_account.production.slug
  enabled     = true
  auto_opt_in = true
  notes       = "Managed by Terraform"
}

locals {
  transforming = {
    min_clusters   = 1
    max_clusters   = 4
    scaling_policy = "STANDARD"
  }
}

resource "snowflake_warehouse" "transforming" {
  name              = "TRANSFORMING"
  min_cluster_count = local.transforming.min_clusters
  max_cluster_count = local.transforming.max_clusters
  scaling_policy    = local.transforming.scaling_policy

  lifecycle {
    ignore_changes = [min_cluster_count, max_cluster_count, scaling_policy]
  }
}

resource "espresso_snowflake_warehouse_agent_warehouse" "transforming" {
  account        = espresso_account.production.slug
  name           = snowflake_warehouse.transforming.name
  enabled        = true
  min_clusters   = local.transforming.min_clusters
  max_clusters   = local.transforming.max_clusters
  scaling_policy = local.transforming.scaling_policy
}

The lifecycle list prevents the Snowflake and Espresso providers from fighting over Warehouse Agent settings. Terraform lifecycle values cannot be conditional. To return control safely, first set the Espresso warehouse's enabled to false and apply, then remove its ignore_changes entries and apply again. The Snowflake provider then reconciles the warehouse to the configured values.

Each Warehouse Agent warehouse configuration is managed as a discrete resource. Its settings fields are optional, so an account and name can adopt the current values without changing them. Removing a Warehouse Agent resource stops Terraform management without changing the current Espresso settings or the underlying warehouse.