@pulumi/databricks/credential.d.ts

A Pulumi package for creating and managing databricks cloud resources.

import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
 * > This resource can only be used with a workspace-level provider.
 *
 * A credential represents an authentication and authorization mechanism for accessing services on your cloud tenant. Each credential is subject to Unity Catalog access-control policies that control which users and groups can access the credential.
 *
 * The type of credential to be created is determined by the `purpose` field, which should be either `SERVICE` or `STORAGE`.
 * The caller must be a metastore admin or have the metastore privilege `CREATE_STORAGE_CREDENTIAL` for storage credentials, or `CREATE_SERVICE_CREDENTIAL` for service credentials. The user who creates the credential can delegate ownership to another user or group to manage permissions on it
 *
 * On AWS, the IAM role for a credential requires a trust policy. See [documentation](https://docs.databricks.com/en/connect/unity-catalog/cloud-services/service-credentials.html#step-1-create-an-iam-role) for more details. The data source databricks.getAwsUnityCatalogAssumeRolePolicy can be used to create the necessary AWS Unity Catalog assume role policy.
 *
 * ## Example Usage
 *
 * For AWS
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const external = new databricks.Credential("external", {
 *     name: externalDataAccess.name,
 *     awsIamRole: {
 *         roleArn: externalDataAccess.arn,
 *     },
 *     purpose: "SERVICE",
 *     comment: "Managed by TF",
 * });
 * const externalCreds = new databricks.Grants("external_creds", {
 *     credential: external.id,
 *     grants: [{
 *         principal: "Data Engineers",
 *         privileges: ["ACCESS"],
 *     }],
 * });
 * ```
 *
 * For Azure
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const externalMi = new databricks.Credential("external_mi", {
 *     name: "mi_credential",
 *     azureManagedIdentity: {
 *         accessConnectorId: example.id,
 *     },
 *     purpose: "SERVICE",
 *     comment: "Managed identity credential managed by TF",
 * });
 * const externalCreds = new databricks.Grants("external_creds", {
 *     credential: externalMi.id,
 *     grants: [{
 *         principal: "Data Engineers",
 *         privileges: ["ACCESS"],
 *     }],
 * });
 * ```
 *
 * For GCP
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const externalGcpSa = new databricks.Credential("external_gcp_sa", {
 *     name: "gcp_sa_credential",
 *     databricksGcpServiceAccount: {},
 *     purpose: "SERVICE",
 *     comment: "GCP SA credential managed by TF",
 * });
 * const externalCreds = new databricks.Grants("external_creds", {
 *     credential: externalGcpSa.id,
 *     grants: [{
 *         principal: "Data Engineers",
 *         privileges: ["ACCESS"],
 *     }],
 * });
 * ```
 *
 * ## Import
 *
 * This resource can be imported by name:
 *
 * bash
 *
 * ```sh
 * $ pulumi import databricks:index/credential:Credential this <name>
 * ```
 */
export declare class Credential extends pulumi.CustomResource {
    /**
     * Get an existing Credential resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: CredentialState, opts?: pulumi.CustomResourceOptions): Credential;
    /**
     * Returns true if the given object is an instance of Credential.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is Credential;
    readonly awsIamRole: pulumi.Output<outputs.CredentialAwsIamRole | undefined>;
    readonly azureManagedIdentity: pulumi.Output<outputs.CredentialAzureManagedIdentity | undefined>;
    readonly azureServicePrincipal: pulumi.Output<outputs.CredentialAzureServicePrincipal | undefined>;
    readonly comment: pulumi.Output<string | undefined>;
    readonly createdAt: pulumi.Output<number>;
    readonly createdBy: pulumi.Output<string>;
    /**
     * Unique ID of the credential.
     */
    readonly credentialId: pulumi.Output<string>;
    readonly databricksGcpServiceAccount: pulumi.Output<outputs.CredentialDatabricksGcpServiceAccount>;
    /**
     * Delete credential regardless of its dependencies.
     */
    readonly forceDestroy: pulumi.Output<boolean | undefined>;
    /**
     * Update credential regardless of its dependents.
     */
    readonly forceUpdate: pulumi.Output<boolean | undefined>;
    readonly fullName: pulumi.Output<string>;
    /**
     * Whether the credential is accessible from all workspaces or a specific set of workspaces. Can be `ISOLATION_MODE_ISOLATED` or `ISOLATION_MODE_OPEN`. Setting the credential to `ISOLATION_MODE_ISOLATED` will automatically restrict access to only from the current workspace.
     *
     * `awsIamRole` optional configuration block for credential details for AWS:
     */
    readonly isolationMode: pulumi.Output<string>;
    readonly metastoreId: pulumi.Output<string>;
    /**
     * Name of Credentials, which must be unique within the databricks_metastore. Change forces creation of a new resource.
     */
    readonly name: pulumi.Output<string>;
    /**
     * Username/groupname/sp applicationId of the credential owner.
     */
    readonly owner: pulumi.Output<string>;
    /**
     * Indicates the purpose of the credential. Can be `SERVICE` or `STORAGE`.
     */
    readonly purpose: pulumi.Output<string>;
    /**
     * Indicates whether the credential is only usable for read operations. Only applicable when purpose is `STORAGE`.
     */
    readonly readOnly: pulumi.Output<boolean | undefined>;
    /**
     * Suppress validation errors if any & force save the credential.
     */
    readonly skipValidation: pulumi.Output<boolean | undefined>;
    readonly updatedAt: pulumi.Output<number>;
    readonly updatedBy: pulumi.Output<string>;
    readonly usedForManagedStorage: pulumi.Output<boolean>;
    /**
     * Create a Credential resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: CredentialArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering Credential resources.
 */
export interface CredentialState {
    awsIamRole?: pulumi.Input<inputs.CredentialAwsIamRole>;
    azureManagedIdentity?: pulumi.Input<inputs.CredentialAzureManagedIdentity>;
    azureServicePrincipal?: pulumi.Input<inputs.CredentialAzureServicePrincipal>;
    comment?: pulumi.Input<string>;
    createdAt?: pulumi.Input<number>;
    createdBy?: pulumi.Input<string>;
    /**
     * Unique ID of the credential.
     */
    credentialId?: pulumi.Input<string>;
    databricksGcpServiceAccount?: pulumi.Input<inputs.CredentialDatabricksGcpServiceAccount>;
    /**
     * Delete credential regardless of its dependencies.
     */
    forceDestroy?: pulumi.Input<boolean>;
    /**
     * Update credential regardless of its dependents.
     */
    forceUpdate?: pulumi.Input<boolean>;
    fullName?: pulumi.Input<string>;
    /**
     * Whether the credential is accessible from all workspaces or a specific set of workspaces. Can be `ISOLATION_MODE_ISOLATED` or `ISOLATION_MODE_OPEN`. Setting the credential to `ISOLATION_MODE_ISOLATED` will automatically restrict access to only from the current workspace.
     *
     * `awsIamRole` optional configuration block for credential details for AWS:
     */
    isolationMode?: pulumi.Input<string>;
    metastoreId?: pulumi.Input<string>;
    /**
     * Name of Credentials, which must be unique within the databricks_metastore. Change forces creation of a new resource.
     */
    name?: pulumi.Input<string>;
    /**
     * Username/groupname/sp applicationId of the credential owner.
     */
    owner?: pulumi.Input<string>;
    /**
     * Indicates the purpose of the credential. Can be `SERVICE` or `STORAGE`.
     */
    purpose?: pulumi.Input<string>;
    /**
     * Indicates whether the credential is only usable for read operations. Only applicable when purpose is `STORAGE`.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Suppress validation errors if any & force save the credential.
     */
    skipValidation?: pulumi.Input<boolean>;
    updatedAt?: pulumi.Input<number>;
    updatedBy?: pulumi.Input<string>;
    usedForManagedStorage?: pulumi.Input<boolean>;
}
/**
 * The set of arguments for constructing a Credential resource.
 */
export interface CredentialArgs {
    awsIamRole?: pulumi.Input<inputs.CredentialAwsIamRole>;
    azureManagedIdentity?: pulumi.Input<inputs.CredentialAzureManagedIdentity>;
    azureServicePrincipal?: pulumi.Input<inputs.CredentialAzureServicePrincipal>;
    comment?: pulumi.Input<string>;
    createdAt?: pulumi.Input<number>;
    createdBy?: pulumi.Input<string>;
    databricksGcpServiceAccount?: pulumi.Input<inputs.CredentialDatabricksGcpServiceAccount>;
    /**
     * Delete credential regardless of its dependencies.
     */
    forceDestroy?: pulumi.Input<boolean>;
    /**
     * Update credential regardless of its dependents.
     */
    forceUpdate?: pulumi.Input<boolean>;
    fullName?: pulumi.Input<string>;
    /**
     * Whether the credential is accessible from all workspaces or a specific set of workspaces. Can be `ISOLATION_MODE_ISOLATED` or `ISOLATION_MODE_OPEN`. Setting the credential to `ISOLATION_MODE_ISOLATED` will automatically restrict access to only from the current workspace.
     *
     * `awsIamRole` optional configuration block for credential details for AWS:
     */
    isolationMode?: pulumi.Input<string>;
    metastoreId?: pulumi.Input<string>;
    /**
     * Name of Credentials, which must be unique within the databricks_metastore. Change forces creation of a new resource.
     */
    name?: pulumi.Input<string>;
    /**
     * Username/groupname/sp applicationId of the credential owner.
     */
    owner?: pulumi.Input<string>;
    /**
     * Indicates the purpose of the credential. Can be `SERVICE` or `STORAGE`.
     */
    purpose: pulumi.Input<string>;
    /**
     * Indicates whether the credential is only usable for read operations. Only applicable when purpose is `STORAGE`.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Suppress validation errors if any & force save the credential.
     */
    skipValidation?: pulumi.Input<boolean>;
    updatedAt?: pulumi.Input<number>;
    updatedBy?: pulumi.Input<string>;
    usedForManagedStorage?: pulumi.Input<boolean>;
}