incremental models not visible to snowflake roles after build

[wdunlap]

i have an issue with my snowflake roles permissions related to my incremental models…when I run dbt build -s <incremental_model> , snowflake roles with select permissions on the table suddenly lose visibility to the table (though I know table is there because when I switch to accountadmin I can see it). And when I run dbt build -s <incremental_model> --full-refresh , there is no problem - snowflake roles retain permissions. Below are the grants on the role that loses visibility:

grant usage on database db_analytics_dev to role wd_test;
grant usage on all schemas in database db_analytics_dev to role wd_test;
grant usage on future schemas in database db_analytics_dev to role wd_test;
grant create schema on database db_analytics_dev to role wd_test;
grant create table on all schemas in database db_analytics_dev to role wd_test;
grant create view on all schemas in database db_analytics_dev to role wd_test;
grant select on all tables in database db_analytics_dev to role wd_test;
grant select on all views in database db_analytics_dev to role wd_test;
grant select on future tables in database db_analytics_dev to role wd_test;
grant select on future views in database db_analytics_dev to role wd_test;

This is important because our client wants to view tables in snowflake.

I’ve found a work around by adding a grant statement to the dbt_project file (granting select to all tables in the schema). But this feels like a work around…

[joellabes]

Are you attaching the permissions using post-hooks (old-behaviour) or the new grant configs? grants | dbt Developer Hub

In either case, I don’t think it should be removing permissions from the table though; have you had a look at the full logs from your run to see whether any revoke commands are being run?

[wdunlap]

HI Joel, thanks for your response! Yes! there is a revoke being run. And it turns out it’s related to the grants I’d added to my dbt_project.yml

If the role is not explicitly listed here, then the permission is revoked. Oddly that revoke does not run on a full-refresh dbt run. Only when you perform the dbt build. Thanks for your help!