Environments
Four Terraform environment directories exist under platform/terraform/: env-staging, env-prod, env-master, env-ci. There is no env-dev in this repo.
env-staging and env-prod: symlinked, not duplicated
env-staging is the source of truth. Almost every .tf file in env-prod is a symlink back to the matching file in env-staging — roles, databases, IAM, Snowpipes, warehouses, network policy, tags, the AWS/GCP files, all of it.
Only three files in env-prod are real, not symlinks:
main.tf— prod's own backend/provider block.variables.tf— prod-specific defaults (different bucket names, API gateway URLs,client_domain).main.snowflake.alerts.tf— prod-only PagerDuty task alerting. Not symlinked into staging, and not present there at all.
What this buys you: one definition of every role, grant, and pipe — no risk of staging and prod's RBAC quietly drifting apart.
What it costs you: a change to shared logic (a role's grants, a warehouse setting) applies to both environments the moment it's merged. There's no way to roll out a role change to staging only and hold it back from prod — the symlink doesn't support partial divergence, only the three real files do.
env-master
A separate Terraform Cloud workspace (drive-snowflake-master) connecting to the Snowflake account directly at the organization level, not per-environment. Two of its three files are real (main.tf, variables.tf); main.iam.tf is currently a no-op stub.
It also has one symlink, main.snowflake.roles-readonly.tf -> ../env-staging/main.snowflake.roles-readonly.tf. That file references resources and locals (snowflake_database.databases, local.warehouses, local.env_upper) that aren't defined anywhere in env-master's own files — worth confirming before relying on this symlink; it doesn't look wired up correctly as checked in.
env-ci
A separate concern from the AWS/Snowflake infrastructure above. Its own Terraform Cloud workspace (snowflake-ci) provisions CircleCI project and context environment variables, sourced from SSM and GCP Secret Manager. No symlinks — it doesn't share files with the other three environments.