@pulumi/databricks
Version:
A Pulumi package for creating and managing databricks cloud resources.
172 lines • 9.82 kB
JavaScript
;
// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.ServicePrincipal = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("./utilities");
/**
* Directly manage [Service Principals](https://docs.databricks.com/administration-guide/users-groups/service-principals.html) that could be added to databricks.Group in Databricks account or workspace.
*
* There are different types of service principals:
*
* * Databricks-managed - exists only inside the Databricks platform (all clouds) and couldn't be used for accessing non-Databricks services.
* * Azure-managed - existing Azure service principal (enterprise application) is registered inside Databricks. It could be used to work with other Azure services.
*
* > To assign account level service principals to workspace use databricks_mws_permission_assignment.
*
* > Entitlements, like, `allowClusterCreate`, `allowInstancePoolCreate`, `databricksSqlAccess`, `workspaceAccess` applicable only for workspace-level service principals. Use databricks.Entitlements resource to assign entitlements inside a workspace to account-level service principals.
*
* To create service principals in the Databricks account, the provider must be configured with `host = "https://accounts.cloud.databricks.com"` on AWS deployments or `host = "https://accounts.azuredatabricks.net"` and authenticate using the supported authentication method for account operations.
*
* The default behavior when deleting a `databricks.ServicePrincipal` resource depends on whether the provider is configured at the workspace-level or account-level. When the provider is configured at the workspace-level, the service principal will be deleted from the workspace. When the provider is configured at the account-level, the service principal will be deactivated but not deleted. When the provider is configured at the account level, to delete the service principal from the account when the resource is deleted, set `disableAsUserDeletion = false`. Conversely, when the provider is configured at the account-level, to deactivate the service principal when the resource is deleted, set `disableAsUserDeletion = true`.
*
* ## Example Usage
*
* Creating regular Databricks-managed service principal:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const sp = new databricks.ServicePrincipal("sp", {displayName: "Admin SP"});
* ```
*
* Creating service principal with administrative permissions - referencing special `admins` databricks.Group in databricks.GroupMember resource:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const admins = databricks.getGroup({
* displayName: "admins",
* });
* const sp = new databricks.ServicePrincipal("sp", {displayName: "Admin SP"});
* const i_am_admin = new databricks.GroupMember("i-am-admin", {
* groupId: admins.then(admins => admins.id),
* memberId: sp.id,
* });
* ```
*
* Creating Azure-managed service principal with cluster create permissions:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const sp = new databricks.ServicePrincipal("sp", {
* applicationId: "00000000-0000-0000-0000-000000000000",
* displayName: "Example service principal",
* allowClusterCreate: true,
* });
* ```
*
* Creating Databricks-managed service principal in AWS Databricks account:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const sp = new databricks.ServicePrincipal("sp", {displayName: "Automation-only SP"});
* ```
*
* Creating Azure-managed service principal in Azure Databricks account:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const sp = new databricks.ServicePrincipal("sp", {applicationId: "00000000-0000-0000-0000-000000000000"});
* ```
*
* ## Related Resources
*
* The following resources are often used in the same context:
*
* - End to end workspace management guide.
* - databricks.Group to manage [groups in Databricks Workspace](https://docs.databricks.com/administration-guide/users-groups/groups.html) or [Account Console](https://accounts.cloud.databricks.com/) (for AWS deployments).
* - databricks.Group data to retrieve information about databricks.Group members, entitlements and instance profiles.
* - databricks.GroupMember to attach users and groups as group members.
* - databricks.Permissions to manage [access control](https://docs.databricks.com/security/access-control/index.html) in Databricks workspace.
* - databricks.SqlPermissions to manage data object access control lists in Databricks workspaces for things like tables, views, databases, and more to manage secrets for the service principal (only for AWS deployments)
*
* ## Import
*
* The resource scim service principal can be imported using its id, for example `2345678901234567`. To get the service principal ID, call [Get service principals](https://docs.databricks.com/dev-tools/api/latest/scim/scim-sp.html#get-service-principals).
*
* bash
*
* ```sh
* $ pulumi import databricks:index/servicePrincipal:ServicePrincipal me <service-principal-id>
* ```
*/
class ServicePrincipal extends pulumi.CustomResource {
/**
* Get an existing ServicePrincipal resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name, id, state, opts) {
return new ServicePrincipal(name, state, Object.assign(Object.assign({}, opts), { id: id }));
}
/**
* Returns true if the given object is an instance of ServicePrincipal. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj) {
if (obj === undefined || obj === null) {
return false;
}
return obj['__pulumiType'] === ServicePrincipal.__pulumiType;
}
constructor(name, argsOrState, opts) {
let resourceInputs = {};
opts = opts || {};
if (opts.id) {
const state = argsOrState;
resourceInputs["aclPrincipalId"] = state ? state.aclPrincipalId : undefined;
resourceInputs["active"] = state ? state.active : undefined;
resourceInputs["allowClusterCreate"] = state ? state.allowClusterCreate : undefined;
resourceInputs["allowInstancePoolCreate"] = state ? state.allowInstancePoolCreate : undefined;
resourceInputs["applicationId"] = state ? state.applicationId : undefined;
resourceInputs["databricksSqlAccess"] = state ? state.databricksSqlAccess : undefined;
resourceInputs["disableAsUserDeletion"] = state ? state.disableAsUserDeletion : undefined;
resourceInputs["displayName"] = state ? state.displayName : undefined;
resourceInputs["externalId"] = state ? state.externalId : undefined;
resourceInputs["force"] = state ? state.force : undefined;
resourceInputs["forceDeleteHomeDir"] = state ? state.forceDeleteHomeDir : undefined;
resourceInputs["forceDeleteRepos"] = state ? state.forceDeleteRepos : undefined;
resourceInputs["home"] = state ? state.home : undefined;
resourceInputs["repos"] = state ? state.repos : undefined;
resourceInputs["workspaceAccess"] = state ? state.workspaceAccess : undefined;
}
else {
const args = argsOrState;
resourceInputs["aclPrincipalId"] = args ? args.aclPrincipalId : undefined;
resourceInputs["active"] = args ? args.active : undefined;
resourceInputs["allowClusterCreate"] = args ? args.allowClusterCreate : undefined;
resourceInputs["allowInstancePoolCreate"] = args ? args.allowInstancePoolCreate : undefined;
resourceInputs["applicationId"] = args ? args.applicationId : undefined;
resourceInputs["databricksSqlAccess"] = args ? args.databricksSqlAccess : undefined;
resourceInputs["disableAsUserDeletion"] = args ? args.disableAsUserDeletion : undefined;
resourceInputs["displayName"] = args ? args.displayName : undefined;
resourceInputs["externalId"] = args ? args.externalId : undefined;
resourceInputs["force"] = args ? args.force : undefined;
resourceInputs["forceDeleteHomeDir"] = args ? args.forceDeleteHomeDir : undefined;
resourceInputs["forceDeleteRepos"] = args ? args.forceDeleteRepos : undefined;
resourceInputs["home"] = args ? args.home : undefined;
resourceInputs["repos"] = args ? args.repos : undefined;
resourceInputs["workspaceAccess"] = args ? args.workspaceAccess : undefined;
}
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
super(ServicePrincipal.__pulumiType, name, resourceInputs, opts);
}
}
exports.ServicePrincipal = ServicePrincipal;
/** @internal */
ServicePrincipal.__pulumiType = 'databricks:index/servicePrincipal:ServicePrincipal';
//# sourceMappingURL=servicePrincipal.js.map