@pulumi/databricks/accessControlRuleSet.d.ts

A Pulumi package for creating and managing databricks cloud resources.

import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
 * This resource allows you to manage access rules on Databricks account level resources. For convenience we allow accessing this resource through the Databricks account and workspace.
 *
 * > This resource can be used with an account or workspace-level provider.
 *
 * > Currently, we only support managing access rules on specific object resources (service principal, group, budget policies and account) through `databricks.AccessControlRuleSet`.
 *
 * !> `databricks.AccessControlRuleSet` cannot be used to manage access rules for resources supported by databricks_permissions. Refer to its documentation for more information.
 *
 * > This resource is _authoritative_ for permissions on objects. Configuring this resource for an object will **OVERWRITE** any existing permissions of the same type unless imported, and changes made outside of Pulumi will be reset.
 *
 * ## Service principal rule set usage
 *
 * Through a Databricks workspace:
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const accountId = "00000000-0000-0000-0000-000000000000";
 * // account level group
 * const ds = databricks.getGroup({
 *     displayName: "Data Science",
 * });
 * const automationSp = new databricks.ServicePrincipal("automation_sp", {displayName: "SP_FOR_AUTOMATION"});
 * const automationSpRuleSet = new databricks.AccessControlRuleSet("automation_sp_rule_set", {
 *     name: pulumi.interpolate`accounts/${accountId}/servicePrincipals/${automationSp.applicationId}/ruleSets/default`,
 *     grantRules: [{
 *         principals: [ds.then(ds => ds.aclPrincipalId)],
 *         role: "roles/servicePrincipal.user",
 *     }],
 * });
 * ```
 *
 * Through AWS Databricks account:
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const accountId = "00000000-0000-0000-0000-000000000000";
 * // account level group creation
 * const ds = new databricks.Group("ds", {displayName: "Data Science"});
 * const automationSp = new databricks.ServicePrincipal("automation_sp", {displayName: "SP_FOR_AUTOMATION"});
 * const automationSpRuleSet = new databricks.AccessControlRuleSet("automation_sp_rule_set", {
 *     name: pulumi.interpolate`accounts/${accountId}/servicePrincipals/${automationSp.applicationId}/ruleSets/default`,
 *     grantRules: [{
 *         principals: [ds.aclPrincipalId],
 *         role: "roles/servicePrincipal.user",
 *     }],
 * });
 * ```
 *
 * Through Azure Databricks account:
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const accountId = "00000000-0000-0000-0000-000000000000";
 * // account level group creation
 * const ds = new databricks.Group("ds", {displayName: "Data Science"});
 * const automationSp = new databricks.ServicePrincipal("automation_sp", {
 *     applicationId: "00000000-0000-0000-0000-000000000000",
 *     displayName: "SP_FOR_AUTOMATION",
 * });
 * const automationSpRuleSet = new databricks.AccessControlRuleSet("automation_sp_rule_set", {
 *     name: pulumi.interpolate`accounts/${accountId}/servicePrincipals/${automationSp.applicationId}/ruleSets/default`,
 *     grantRules: [{
 *         principals: [ds.aclPrincipalId],
 *         role: "roles/servicePrincipal.user",
 *     }],
 * });
 * ```
 *
 * Through GCP Databricks account:
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const accountId = "00000000-0000-0000-0000-000000000000";
 * // account level group creation
 * const ds = new databricks.Group("ds", {displayName: "Data Science"});
 * const automationSp = new databricks.ServicePrincipal("automation_sp", {displayName: "SP_FOR_AUTOMATION"});
 * const automationSpRuleSet = new databricks.AccessControlRuleSet("automation_sp_rule_set", {
 *     name: pulumi.interpolate`accounts/${accountId}/servicePrincipals/${automationSp.applicationId}/ruleSets/default`,
 *     grantRules: [{
 *         principals: [ds.aclPrincipalId],
 *         role: "roles/servicePrincipal.user",
 *     }],
 * });
 * ```
 *
 * ## Group rule set usage
 *
 * Refer to the appropriate provider configuration as shown in the examples for service principal rule set.
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const accountId = "00000000-0000-0000-0000-000000000000";
 * // account level group
 * const ds = databricks.getGroup({
 *     displayName: "Data Science",
 * });
 * const john = databricks.getUser({
 *     userName: "john.doe@example.com",
 * });
 * const dsGroupRuleSet = new databricks.AccessControlRuleSet("ds_group_rule_set", {
 *     name: `accounts/${accountId}/groups/${dsDatabricksGroup.id}/ruleSets/default`,
 *     grantRules: [{
 *         principals: [john.then(john => john.aclPrincipalId)],
 *         role: "roles/group.manager",
 *     }],
 * });
 * ```
 *
 * ## Account rule set usage
 *
 * Refer to the appropriate provider configuration as shown in the examples for service principal rule set.
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const accountId = "00000000-0000-0000-0000-000000000000";
 * // account level group
 * const ds = databricks.getGroup({
 *     displayName: "Data Science",
 * });
 * // account level group
 * const marketplaceAdmins = databricks.getGroup({
 *     displayName: "Marketplace Admins",
 * });
 * const john = databricks.getUser({
 *     userName: "john.doe@example.com",
 * });
 * const accountRuleSet = new databricks.AccessControlRuleSet("account_rule_set", {
 *     name: `accounts/${accountId}/ruleSets/default`,
 *     grantRules: [
 *         {
 *             principals: [john.then(john => john.aclPrincipalId)],
 *             role: "roles/group.manager",
 *         },
 *         {
 *             principals: [ds.then(ds => ds.aclPrincipalId)],
 *             role: "roles/servicePrincipal.manager",
 *         },
 *         {
 *             principals: [marketplaceAdmins.then(marketplaceAdmins => marketplaceAdmins.aclPrincipalId)],
 *             role: "roles/marketplace.admin",
 *         },
 *     ],
 * });
 * ```
 *
 * ## Budget policy usage
 *
 * Access to budget policies could be controlled with this resource:
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as databricks from "@pulumi/databricks";
 *
 * const accountId = "00000000-0000-0000-0000-000000000000";
 * // account level group
 * const ds = databricks.getGroup({
 *     displayName: "Data Science",
 * });
 * const john = databricks.getUser({
 *     userName: "john.doe@example.com",
 * });
 * const _this = new databricks.BudgetPolicy("this", {
 *     policyName: "data-science-budget-policy",
 *     customTags: [{
 *         key: "mykey",
 *         value: "myvalue",
 *     }],
 * });
 * const budgetPolicyUsage = new databricks.AccessControlRuleSet("budget_policy_usage", {
 *     name: pulumi.interpolate`accounts/${accountId}/budgetPolicies/${_this.policyId}/ruleSets/default`,
 *     grantRules: [
 *         {
 *             principals: [john.then(john => john.aclPrincipalId)],
 *             role: "roles/budgetPolicy.manager",
 *         },
 *         {
 *             principals: [ds.then(ds => ds.aclPrincipalId)],
 *             role: "roles/budgetPolicy.user",
 *         },
 *     ],
 * });
 * ```
 *
 * ## Related Resources
 *
 * The following resources are often used in the same context:
 *
 * * databricks.Group
 * * databricks.User
 * * databricks.ServicePrincipal
 */
export declare class AccessControlRuleSet extends pulumi.CustomResource {
    /**
     * Get an existing AccessControlRuleSet resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessControlRuleSetState, opts?: pulumi.CustomResourceOptions): AccessControlRuleSet;
    /**
     * Returns true if the given object is an instance of AccessControlRuleSet.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is AccessControlRuleSet;
    readonly etag: pulumi.Output<string>;
    /**
     * The access control rules to be granted by this rule set, consisting of a set of principals and roles to be granted to them.
     *
     * !> Name uniquely identifies a rule set resource. Ensure all the grantRules blocks for a rule set name are present in one `databricks.AccessControlRuleSet` resource block. Otherwise, after applying changes, users might lose their role assignment even if that was not intended.
     */
    readonly grantRules: pulumi.Output<outputs.AccessControlRuleSetGrantRule[] | undefined>;
    /**
     * Unique identifier of a rule set. The name determines the resource to which the rule set applies. **Changing the name recreates the resource!**. Currently, only default rule sets are supported. The following rule set formats are supported:
     * * `accounts/{account_id}/ruleSets/default` - account-level access control.
     * * `accounts/{account_id}/servicePrincipals/{service_principal_application_id}/ruleSets/default` - access control for a specific service principal.
     * * `accounts/{account_id}/groups/{group_id}/ruleSets/default` - access control for a specific group.
     * * `accounts/{account_id}/budgetPolicies/{budget_policy_id}/ruleSets/default` - access control for a specific budget policy.
     */
    readonly name: pulumi.Output<string>;
    /**
     * Create a AccessControlRuleSet resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args?: AccessControlRuleSetArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering AccessControlRuleSet resources.
 */
export interface AccessControlRuleSetState {
    etag?: pulumi.Input<string>;
    /**
     * The access control rules to be granted by this rule set, consisting of a set of principals and roles to be granted to them.
     *
     * !> Name uniquely identifies a rule set resource. Ensure all the grantRules blocks for a rule set name are present in one `databricks.AccessControlRuleSet` resource block. Otherwise, after applying changes, users might lose their role assignment even if that was not intended.
     */
    grantRules?: pulumi.Input<pulumi.Input<inputs.AccessControlRuleSetGrantRule>[]>;
    /**
     * Unique identifier of a rule set. The name determines the resource to which the rule set applies. **Changing the name recreates the resource!**. Currently, only default rule sets are supported. The following rule set formats are supported:
     * * `accounts/{account_id}/ruleSets/default` - account-level access control.
     * * `accounts/{account_id}/servicePrincipals/{service_principal_application_id}/ruleSets/default` - access control for a specific service principal.
     * * `accounts/{account_id}/groups/{group_id}/ruleSets/default` - access control for a specific group.
     * * `accounts/{account_id}/budgetPolicies/{budget_policy_id}/ruleSets/default` - access control for a specific budget policy.
     */
    name?: pulumi.Input<string>;
}
/**
 * The set of arguments for constructing a AccessControlRuleSet resource.
 */
export interface AccessControlRuleSetArgs {
    /**
     * The access control rules to be granted by this rule set, consisting of a set of principals and roles to be granted to them.
     *
     * !> Name uniquely identifies a rule set resource. Ensure all the grantRules blocks for a rule set name are present in one `databricks.AccessControlRuleSet` resource block. Otherwise, after applying changes, users might lose their role assignment even if that was not intended.
     */
    grantRules?: pulumi.Input<pulumi.Input<inputs.AccessControlRuleSetGrantRule>[]>;
    /**
     * Unique identifier of a rule set. The name determines the resource to which the rule set applies. **Changing the name recreates the resource!**. Currently, only default rule sets are supported. The following rule set formats are supported:
     * * `accounts/{account_id}/ruleSets/default` - account-level access control.
     * * `accounts/{account_id}/servicePrincipals/{service_principal_application_id}/ruleSets/default` - access control for a specific service principal.
     * * `accounts/{account_id}/groups/{group_id}/ruleSets/default` - access control for a specific group.
     * * `accounts/{account_id}/budgetPolicies/{budget_policy_id}/ruleSets/default` - access control for a specific budget policy.
     */
    name?: pulumi.Input<string>;
}