@pulumi/databricks/storageCredential.d.ts

A Pulumi package for creating and managing databricks cloud resources.

import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
 * > This resource can be used with an account or workspace-level provider.
 *
 * To work with external tables, Unity Catalog introduces two new objects to access and work with external cloud storage:
 *
 * - `databricks.StorageCredential` represents authentication methods to access cloud storage (e.g. an IAM role for Amazon S3 or a service principal/managed identity for Azure Storage). Storage credentials are access-controlled to determine which users can use the credential.
 * - databricks.ExternalLocation are objects that combine a cloud storage path with a Storage Credential that can be used to access the location.
 *
 * On AWS, the IAM role for a storage credential requires a trust policy. See [documentation](https://docs.databricks.com/en/connect/unity-catalog/cloud-storage/storage-credentials.html#step-1-create-an-iam-role) for more details. The data source databricks.getAwsUnityCatalogAssumeRolePolicy can be used to create the necessary AWS Unity Catalog assume role policy.
 *
 * ## Example Usage
 *
 * For AWS
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const external = new databricks.StorageCredential("external", {
 *     name: externalDataAccess.name,
 *     awsIamRole: {
 *         roleArn: externalDataAccess.arn,
 *     },
 *     comment: "Managed by TF",
 * });
 * const externalCreds = new databricks.Grants("external_creds", {
 *     storageCredential: external.id,
 *     grants: [{
 *         principal: "Data Engineers",
 *         privileges: ["CREATE_EXTERNAL_TABLE"],
 *     }],
 * });
 * ```
 *
 * For Azure
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const externalMi = new databricks.StorageCredential("external_mi", {
 *     name: "mi_credential",
 *     azureManagedIdentity: {
 *         accessConnectorId: example.id,
 *     },
 *     comment: "Managed identity credential managed by TF",
 * });
 * const externalCreds = new databricks.Grants("external_creds", {
 *     storageCredential: externalMi.id,
 *     grants: [{
 *         principal: "Data Engineers",
 *         privileges: ["CREATE_EXTERNAL_TABLE"],
 *     }],
 * });
 * ```
 *
 * For GCP
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const external = new databricks.StorageCredential("external", {
 *     name: "the-creds",
 *     databricksGcpServiceAccount: {},
 * });
 * const externalCreds = new databricks.Grants("external_creds", {
 *     storageCredential: external.id,
 *     grants: [{
 *         principal: "Data Engineers",
 *         privileges: ["CREATE_EXTERNAL_TABLE"],
 *     }],
 * });
 * ```
 *
 * ## Import
 *
 * This resource can be imported by name:
 *
 * bash
 *
 * ```sh
 * $ pulumi import databricks:index/storageCredential:StorageCredential this <name>
 * ```
 */
export declare class StorageCredential extends pulumi.CustomResource {
    /**
     * Get an existing StorageCredential resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: StorageCredentialState, opts?: pulumi.CustomResourceOptions): StorageCredential;
    /**
     * Returns true if the given object is an instance of StorageCredential.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is StorageCredential;
    readonly awsIamRole: pulumi.Output<outputs.StorageCredentialAwsIamRole | undefined>;
    readonly azureManagedIdentity: pulumi.Output<outputs.StorageCredentialAzureManagedIdentity | undefined>;
    readonly azureServicePrincipal: pulumi.Output<outputs.StorageCredentialAzureServicePrincipal | undefined>;
    readonly cloudflareApiToken: pulumi.Output<outputs.StorageCredentialCloudflareApiToken | undefined>;
    readonly comment: pulumi.Output<string | undefined>;
    readonly databricksGcpServiceAccount: pulumi.Output<outputs.StorageCredentialDatabricksGcpServiceAccount>;
    /**
     * Delete storage credential regardless of its dependencies.
     */
    readonly forceDestroy: pulumi.Output<boolean | undefined>;
    /**
     * Update storage credential regardless of its dependents.
     */
    readonly forceUpdate: pulumi.Output<boolean | undefined>;
    readonly gcpServiceAccountKey: pulumi.Output<outputs.StorageCredentialGcpServiceAccountKey | undefined>;
    /**
     * Whether the storage credential is accessible from all workspaces or a specific set of workspaces. Can be `ISOLATION_MODE_ISOLATED` or `ISOLATION_MODE_OPEN`. Setting the credential to `ISOLATION_MODE_ISOLATED` will automatically allow access from the current workspace.
     *
     * `awsIamRole` optional configuration block for credential details for AWS:
     */
    readonly isolationMode: pulumi.Output<string>;
    /**
     * Unique identifier of the parent Metastore. If set for workspace-level, it must match the ID of the metastore assigned to the worspace. When changing the metastore assigned to a workspace, this field becomes required.
     */
    readonly metastoreId: pulumi.Output<string>;
    /**
     * Name of Storage Credentials, which must be unique within the databricks_metastore. Change forces creation of a new resource.
     */
    readonly name: pulumi.Output<string>;
    /**
     * Username/groupname/sp applicationId of the storage credential owner.
     */
    readonly owner: pulumi.Output<string>;
    /**
     * Indicates whether the storage credential is only usable for read operations.
     */
    readonly readOnly: pulumi.Output<boolean | undefined>;
    /**
     * Suppress validation errors if any & force save the storage credential.
     */
    readonly skipValidation: pulumi.Output<boolean | undefined>;
    /**
     * Unique ID of storage credential.
     */
    readonly storageCredentialId: pulumi.Output<string>;
    /**
     * Create a StorageCredential resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args?: StorageCredentialArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering StorageCredential resources.
 */
export interface StorageCredentialState {
    awsIamRole?: pulumi.Input<inputs.StorageCredentialAwsIamRole>;
    azureManagedIdentity?: pulumi.Input<inputs.StorageCredentialAzureManagedIdentity>;
    azureServicePrincipal?: pulumi.Input<inputs.StorageCredentialAzureServicePrincipal>;
    cloudflareApiToken?: pulumi.Input<inputs.StorageCredentialCloudflareApiToken>;
    comment?: pulumi.Input<string>;
    databricksGcpServiceAccount?: pulumi.Input<inputs.StorageCredentialDatabricksGcpServiceAccount>;
    /**
     * Delete storage credential regardless of its dependencies.
     */
    forceDestroy?: pulumi.Input<boolean>;
    /**
     * Update storage credential regardless of its dependents.
     */
    forceUpdate?: pulumi.Input<boolean>;
    gcpServiceAccountKey?: pulumi.Input<inputs.StorageCredentialGcpServiceAccountKey>;
    /**
     * Whether the storage credential is accessible from all workspaces or a specific set of workspaces. Can be `ISOLATION_MODE_ISOLATED` or `ISOLATION_MODE_OPEN`. Setting the credential to `ISOLATION_MODE_ISOLATED` will automatically allow access from the current workspace.
     *
     * `awsIamRole` optional configuration block for credential details for AWS:
     */
    isolationMode?: pulumi.Input<string>;
    /**
     * Unique identifier of the parent Metastore. If set for workspace-level, it must match the ID of the metastore assigned to the worspace. When changing the metastore assigned to a workspace, this field becomes required.
     */
    metastoreId?: pulumi.Input<string>;
    /**
     * Name of Storage Credentials, which must be unique within the databricks_metastore. Change forces creation of a new resource.
     */
    name?: pulumi.Input<string>;
    /**
     * Username/groupname/sp applicationId of the storage credential owner.
     */
    owner?: pulumi.Input<string>;
    /**
     * Indicates whether the storage credential is only usable for read operations.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Suppress validation errors if any & force save the storage credential.
     */
    skipValidation?: pulumi.Input<boolean>;
    /**
     * Unique ID of storage credential.
     */
    storageCredentialId?: pulumi.Input<string>;
}
/**
 * The set of arguments for constructing a StorageCredential resource.
 */
export interface StorageCredentialArgs {
    awsIamRole?: pulumi.Input<inputs.StorageCredentialAwsIamRole>;
    azureManagedIdentity?: pulumi.Input<inputs.StorageCredentialAzureManagedIdentity>;
    azureServicePrincipal?: pulumi.Input<inputs.StorageCredentialAzureServicePrincipal>;
    cloudflareApiToken?: pulumi.Input<inputs.StorageCredentialCloudflareApiToken>;
    comment?: pulumi.Input<string>;
    databricksGcpServiceAccount?: pulumi.Input<inputs.StorageCredentialDatabricksGcpServiceAccount>;
    /**
     * Delete storage credential regardless of its dependencies.
     */
    forceDestroy?: pulumi.Input<boolean>;
    /**
     * Update storage credential regardless of its dependents.
     */
    forceUpdate?: pulumi.Input<boolean>;
    gcpServiceAccountKey?: pulumi.Input<inputs.StorageCredentialGcpServiceAccountKey>;
    /**
     * Whether the storage credential is accessible from all workspaces or a specific set of workspaces. Can be `ISOLATION_MODE_ISOLATED` or `ISOLATION_MODE_OPEN`. Setting the credential to `ISOLATION_MODE_ISOLATED` will automatically allow access from the current workspace.
     *
     * `awsIamRole` optional configuration block for credential details for AWS:
     */
    isolationMode?: pulumi.Input<string>;
    /**
     * Unique identifier of the parent Metastore. If set for workspace-level, it must match the ID of the metastore assigned to the worspace. When changing the metastore assigned to a workspace, this field becomes required.
     */
    metastoreId?: pulumi.Input<string>;
    /**
     * Name of Storage Credentials, which must be unique within the databricks_metastore. Change forces creation of a new resource.
     */
    name?: pulumi.Input<string>;
    /**
     * Username/groupname/sp applicationId of the storage credential owner.
     */
    owner?: pulumi.Input<string>;
    /**
     * Indicates whether the storage credential is only usable for read operations.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Suppress validation errors if any & force save the storage credential.
     */
    skipValidation?: pulumi.Input<boolean>;
}