@pulumi/databricks
Version:
A Pulumi package for creating and managing databricks cloud resources.
305 lines (304 loc) • 16.1 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
/**
* This resource allows you to manage [users in Databricks Workspace](https://docs.databricks.com/administration-guide/users-groups/users.html), [Databricks Account Console](https://accounts.cloud.databricks.com/) or [Azure Databricks Account Console](https://accounts.azuredatabricks.net). You can also associate Databricks users to databricks_group. Upon user creation the user will receive a welcome email. You can also get information about caller identity using databricks.getCurrentUser data source.
*
* > To assign account level users to workspace use databricks_mws_permission_assignment.
*
* > Entitlements, like, `allowClusterCreate`, `allowInstancePoolCreate`, `databricksSqlAccess`, `workspaceAccess` applicable only for workspace-level users. Use databricks.Entitlements resource to assign entitlements inside a workspace to account-level users.
*
* To create users in the Databricks account, the provider must be configured with `host = "https://accounts.cloud.databricks.com"` on AWS deployments or `host = "https://accounts.azuredatabricks.net"` and authenticate using AAD tokens on Azure deployments.
*
* The default behavior when deleting a `databricks.User` resource depends on whether the provider is configured at the workspace-level or account-level. When the provider is configured at the workspace-level, the user will be deleted from the workspace. When the provider is configured at the account-level, the user will be deactivated but not deleted. When the provider is configured at the account level, to delete the user from the account when the resource is deleted, set `disableAsUserDeletion = false`. Conversely, when the provider is configured at the account-level, to deactivate the user when the resource is deleted, set `disableAsUserDeletion = true`.
*
* ## Example Usage
*
* Creating regular user:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const me = new databricks.User("me", {userName: "me@example.com"});
* ```
*
* Creating user with administrative permissions - referencing special `admins` databricks.Group in databricks.GroupMember resource:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const admins = databricks.getGroup({
* displayName: "admins",
* });
* const me = new databricks.User("me", {userName: "me@example.com"});
* const i_am_admin = new databricks.GroupMember("i-am-admin", {
* groupId: admins.then(admins => admins.id),
* memberId: me.id,
* });
* ```
*
* Creating user with cluster create permissions:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const me = new databricks.User("me", {
* userName: "me@example.com",
* displayName: "Example user",
* allowClusterCreate: true,
* });
* ```
*
* Creating user in AWS Databricks account:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const accountUser = new databricks.User("account_user", {
* userName: "me@example.com",
* displayName: "Example user",
* });
* ```
*
* Creating user in Azure Databricks account:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const accountUser = new databricks.User("account_user", {
* userName: "me@example.com",
* displayName: "Example user",
* });
* ```
*
* ## Related Resources
*
* The following resources are often used in the same context:
*
* * End to end workspace management guide.
* * databricks.Group to manage [groups in Databricks Workspace](https://docs.databricks.com/administration-guide/users-groups/groups.html) or [Account Console](https://accounts.cloud.databricks.com/) (for AWS deployments).
* * databricks.Group data to retrieve information about databricks.Group members, entitlements and instance profiles.
* * databricks.GroupInstanceProfile to attach databricks.InstanceProfile (AWS) to databricks_group.
* * databricks.GroupMember to attach users and groups as group members.
* * databricks.InstanceProfile to manage AWS EC2 instance profiles that users can launch databricks.Cluster and access data, like databricks_mount.
* * databricks.User data to retrieve information about databricks_user.
*
* ## Import
*
* The resource scim user can be imported using id:
*
* bash
*
* ```sh
* $ pulumi import databricks:index/user:User me <user-id>
* ```
*/
export declare class User extends pulumi.CustomResource {
/**
* Get an existing User resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: UserState, opts?: pulumi.CustomResourceOptions): User;
/**
* Returns true if the given object is an instance of User. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is User;
/**
* identifier for use in databricks_access_control_rule_set, e.g. `users/mr.foo@example.com`.
*/
readonly aclPrincipalId: pulumi.Output<string>;
/**
* Either user is active or not. True by default, but can be set to false in case of user deactivation with preserving user assets.
*/
readonly active: pulumi.Output<boolean | undefined>;
/**
* Allow the user to have cluster create privileges. Defaults to false. More fine grained permissions could be assigned with databricks.Permissions and `clusterId` argument. Everyone without `allowClusterCreate` argument set, but with permission to use Cluster Policy would be able to create clusters, but within boundaries of that specific policy.
*/
readonly allowClusterCreate: pulumi.Output<boolean | undefined>;
/**
* Allow the user to have instance pool create privileges. Defaults to false. More fine grained permissions could be assigned with databricks.Permissions and instancePoolId argument.
*/
readonly allowInstancePoolCreate: pulumi.Output<boolean | undefined>;
/**
* This is a field to allow the group to have access to [Databricks SQL](https://databricks.com/product/databricks-sql) feature in User Interface and through databricks_sql_endpoint.
*/
readonly databricksSqlAccess: pulumi.Output<boolean | undefined>;
/**
* Deactivate the user when deleting the resource, rather than deleting the user entirely. Defaults to `true` when the provider is configured at the account-level and `false` when configured at the workspace-level. This flag is exclusive to forceDeleteRepos and forceDeleteHomeDir flags.
*/
readonly disableAsUserDeletion: pulumi.Output<boolean>;
/**
* This is an alias for the username that can be the full name of the user.
*/
readonly displayName: pulumi.Output<string>;
/**
* ID of the user in an external identity provider.
*/
readonly externalId: pulumi.Output<string | undefined>;
/**
* Ignore `cannot create user: User with username X already exists` errors and implicitly import the specific user into Pulumi state, enforcing entitlements defined in the instance of resource. _This functionality is experimental_ and is designed to simplify corner cases, like Azure Active Directory synchronisation.
*/
readonly force: pulumi.Output<boolean | undefined>;
/**
* This flag determines whether the user's home directory is deleted when the user is deleted. It will have not impact when in the accounts SCIM API. False by default.
*/
readonly forceDeleteHomeDir: pulumi.Output<boolean | undefined>;
/**
* This flag determines whether the user's repo directory is deleted when the user is deleted. It will have no impact when in the accounts SCIM API. False by default.
*/
readonly forceDeleteRepos: pulumi.Output<boolean | undefined>;
/**
* Home folder of the user, e.g. `/Users/mr.foo@example.com`.
*/
readonly home: pulumi.Output<string>;
/**
* Personal Repos location of the user, e.g. `/Repos/mr.foo@example.com`.
*/
readonly repos: pulumi.Output<string>;
/**
* This is the username of the given user and will be their form of access and identity. Provided username will be converted to lower case if it contains upper case characters.
*/
readonly userName: pulumi.Output<string>;
readonly workspaceAccess: pulumi.Output<boolean | undefined>;
/**
* Create a User resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: UserArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering User resources.
*/
export interface UserState {
/**
* identifier for use in databricks_access_control_rule_set, e.g. `users/mr.foo@example.com`.
*/
aclPrincipalId?: pulumi.Input<string>;
/**
* Either user is active or not. True by default, but can be set to false in case of user deactivation with preserving user assets.
*/
active?: pulumi.Input<boolean>;
/**
* Allow the user to have cluster create privileges. Defaults to false. More fine grained permissions could be assigned with databricks.Permissions and `clusterId` argument. Everyone without `allowClusterCreate` argument set, but with permission to use Cluster Policy would be able to create clusters, but within boundaries of that specific policy.
*/
allowClusterCreate?: pulumi.Input<boolean>;
/**
* Allow the user to have instance pool create privileges. Defaults to false. More fine grained permissions could be assigned with databricks.Permissions and instancePoolId argument.
*/
allowInstancePoolCreate?: pulumi.Input<boolean>;
/**
* This is a field to allow the group to have access to [Databricks SQL](https://databricks.com/product/databricks-sql) feature in User Interface and through databricks_sql_endpoint.
*/
databricksSqlAccess?: pulumi.Input<boolean>;
/**
* Deactivate the user when deleting the resource, rather than deleting the user entirely. Defaults to `true` when the provider is configured at the account-level and `false` when configured at the workspace-level. This flag is exclusive to forceDeleteRepos and forceDeleteHomeDir flags.
*/
disableAsUserDeletion?: pulumi.Input<boolean>;
/**
* This is an alias for the username that can be the full name of the user.
*/
displayName?: pulumi.Input<string>;
/**
* ID of the user in an external identity provider.
*/
externalId?: pulumi.Input<string>;
/**
* Ignore `cannot create user: User with username X already exists` errors and implicitly import the specific user into Pulumi state, enforcing entitlements defined in the instance of resource. _This functionality is experimental_ and is designed to simplify corner cases, like Azure Active Directory synchronisation.
*/
force?: pulumi.Input<boolean>;
/**
* This flag determines whether the user's home directory is deleted when the user is deleted. It will have not impact when in the accounts SCIM API. False by default.
*/
forceDeleteHomeDir?: pulumi.Input<boolean>;
/**
* This flag determines whether the user's repo directory is deleted when the user is deleted. It will have no impact when in the accounts SCIM API. False by default.
*/
forceDeleteRepos?: pulumi.Input<boolean>;
/**
* Home folder of the user, e.g. `/Users/mr.foo@example.com`.
*/
home?: pulumi.Input<string>;
/**
* Personal Repos location of the user, e.g. `/Repos/mr.foo@example.com`.
*/
repos?: pulumi.Input<string>;
/**
* This is the username of the given user and will be their form of access and identity. Provided username will be converted to lower case if it contains upper case characters.
*/
userName?: pulumi.Input<string>;
workspaceAccess?: pulumi.Input<boolean>;
}
/**
* The set of arguments for constructing a User resource.
*/
export interface UserArgs {
/**
* identifier for use in databricks_access_control_rule_set, e.g. `users/mr.foo@example.com`.
*/
aclPrincipalId?: pulumi.Input<string>;
/**
* Either user is active or not. True by default, but can be set to false in case of user deactivation with preserving user assets.
*/
active?: pulumi.Input<boolean>;
/**
* Allow the user to have cluster create privileges. Defaults to false. More fine grained permissions could be assigned with databricks.Permissions and `clusterId` argument. Everyone without `allowClusterCreate` argument set, but with permission to use Cluster Policy would be able to create clusters, but within boundaries of that specific policy.
*/
allowClusterCreate?: pulumi.Input<boolean>;
/**
* Allow the user to have instance pool create privileges. Defaults to false. More fine grained permissions could be assigned with databricks.Permissions and instancePoolId argument.
*/
allowInstancePoolCreate?: pulumi.Input<boolean>;
/**
* This is a field to allow the group to have access to [Databricks SQL](https://databricks.com/product/databricks-sql) feature in User Interface and through databricks_sql_endpoint.
*/
databricksSqlAccess?: pulumi.Input<boolean>;
/**
* Deactivate the user when deleting the resource, rather than deleting the user entirely. Defaults to `true` when the provider is configured at the account-level and `false` when configured at the workspace-level. This flag is exclusive to forceDeleteRepos and forceDeleteHomeDir flags.
*/
disableAsUserDeletion?: pulumi.Input<boolean>;
/**
* This is an alias for the username that can be the full name of the user.
*/
displayName?: pulumi.Input<string>;
/**
* ID of the user in an external identity provider.
*/
externalId?: pulumi.Input<string>;
/**
* Ignore `cannot create user: User with username X already exists` errors and implicitly import the specific user into Pulumi state, enforcing entitlements defined in the instance of resource. _This functionality is experimental_ and is designed to simplify corner cases, like Azure Active Directory synchronisation.
*/
force?: pulumi.Input<boolean>;
/**
* This flag determines whether the user's home directory is deleted when the user is deleted. It will have not impact when in the accounts SCIM API. False by default.
*/
forceDeleteHomeDir?: pulumi.Input<boolean>;
/**
* This flag determines whether the user's repo directory is deleted when the user is deleted. It will have no impact when in the accounts SCIM API. False by default.
*/
forceDeleteRepos?: pulumi.Input<boolean>;
/**
* Home folder of the user, e.g. `/Users/mr.foo@example.com`.
*/
home?: pulumi.Input<string>;
/**
* Personal Repos location of the user, e.g. `/Repos/mr.foo@example.com`.
*/
repos?: pulumi.Input<string>;
/**
* This is the username of the given user and will be their form of access and identity. Provided username will be converted to lower case if it contains upper case characters.
*/
userName: pulumi.Input<string>;
workspaceAccess?: pulumi.Input<boolean>;
}