Skip to content

Latest commit

 

History

History
121 lines (92 loc) · 6.22 KB

service_principal.md

File metadata and controls

121 lines (92 loc) · 6.22 KB
Raw
subcategory
Security

databricks_service_principal Resource

Directly manage Service Principals that could be added to databricks_group in Databricks workspace or account.

-> Note To assign account level service principals to workspace use databricks_mws_permission_assignment.

To create service principals in the Databricks account, the provider must be configured with host = "https://accounts.cloud.databricks.com" on AWS deployments or host = "https://accounts.azuredatabricks.net" and authenticate using AAD tokens on Azure deployments

Example Usage

Creating regular service principal:

resource "databricks_service_principal" "sp" {
  application_id = "00000000-0000-0000-0000-000000000000"
}

Creating service principal with administrative permissions - referencing special admins databricks_group in databricks_group_member resource:

data "databricks_group" "admins" {
  display_name = "admins"
}

resource "databricks_service_principal" "sp" {
  application_id = "00000000-0000-0000-0000-000000000000"
}

resource "databricks_group_member" "i-am-admin" {
  group_id  = data.databricks_group.admins.id
  member_id = databricks_service_principal.sp.id
}

Creating service principal with cluster create permissions:

resource "databricks_service_principal" "sp" {
  application_id       = "00000000-0000-0000-0000-000000000000"
  display_name         = "Example service principal"
  allow_cluster_create = true
}

Creating service principal in AWS Databricks account:

// initialize provider at account-level
provider "databricks" {
  alias      = "mws"
  host       = "https://accounts.cloud.databricks.com"
  account_id = "00000000-0000-0000-0000-000000000000"
  username   = var.databricks_account_username
  password   = var.databricks_account_password
}

resource "databricks_service_principal" "sp" {
  provider     = databricks.mws
  display_name = "Automation-only SP"
}

Creating group in Azure Databricks account:

// initialize provider at Azure account-level
provider "databricks" {
  alias      = "azure_account"
  host       = "https://accounts.azuredatabricks.net"
  account_id = "00000000-0000-0000-0000-000000000000"
  auth_type  = "azure-cli"
}

resource "databricks_service_principal" "sp" {
  provider       = databricks.azure_account
  application_id = "00000000-0000-0000-0000-000000000000"
}

Argument Reference

-> application_id is required on Azure Databricks and is not allowed on other clouds. display_name is required on all clouds except Azure.

The following arguments are available:

  • application_id - This is the application id of the given service principal and will be their form of access and identity. On other clouds than Azure this value is auto-generated.
  • display_name - (Required) This is an alias for the service principal and can be the full name of the service principal.
  • external_id - (Optional) ID of the service principal in an external identity provider.
  • allow_cluster_create - (Optional) Allow the service principal to have cluster create privileges. Defaults to false. More fine grained permissions could be assigned with databricks_permissions and cluster_id argument. Everyone without allow_cluster_create argument set, but with permission to use Cluster Policy would be able to create clusters, but within the boundaries of that specific policy.
  • allow_instance_pool_create - (Optional) Allow the service principal to have instance pool create privileges. Defaults to false. More fine grained permissions could be assigned with databricks_permissions and instance_pool_id argument.
  • databricks_sql_access - (Optional) This is a field to allow the group to have access to Databricks SQL feature through databricks_sql_endpoint.
  • workspace_access - (Optional) This is a field to allow the group to have access to Databricks Workspace.
  • active - (Optional) Either service principal is active or not. True by default, but can be set to false in case of service principal deactivation with preserving service principal assets.
  • force - (Optional) Ignore cannot create service principal: Service principal with application ID X already exists errors and implicitly import the specified service principal into Terraform state, enforcing entitlements defined in the instance of resource. This functionality is experimental and is designed to simplify corner cases, like Azure Active Directory synchronisation.

Attribute Reference

In addition to all arguments above, the following attributes are exported:

  • id - Canonical unique identifier for the service principal.

Import

The resource scim service principal can be imported using id:

$ terraform import databricks_service_principal.me <service-principal-id>

Related Resources

The following resources are often used in the same context: