@pulumi/databricks
Version:
A Pulumi package for creating and managing databricks cloud resources.
256 lines (255 loc) • 10.5 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
* This resource is used to assign account-level users, service principals and groups to a Databricks workspace. To configure additional entitlements such as cluster creation, please use databricks.Entitlements
*
* > This resource can only be used with a workspace-level provider!
*
* ## Example Usage
*
* ### Assign using `principalId`
*
* In workspace context, adding account-level user to a workspace:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* // Use the account provider
* const me = databricks.getUser({
* userName: "me@example.com",
* });
* const addUser = new databricks.PermissionAssignment("add_user", {
* principalId: me.then(me => me.id),
* permissions: ["USER"],
* });
* ```
*
* In workspace context, adding account-level service principal to a workspace:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* // Use the account provider
* const sp = databricks.getServicePrincipal({
* displayName: "Automation-only SP",
* });
* const addAdminSpn = new databricks.PermissionAssignment("add_admin_spn", {
* principalId: sp.then(sp => sp.id),
* permissions: ["ADMIN"],
* });
* ```
*
* In workspace context, adding account-level group to a workspace:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* // Use the account provider
* const accountLevel = databricks.getGroup({
* displayName: "example-group",
* });
* // Use the workspace provider
* const _this = new databricks.PermissionAssignment("this", {
* principalId: accountLevel.then(accountLevel => accountLevel.id),
* permissions: ["USER"],
* });
* const workspaceLevel = databricks.getGroup({
* displayName: "example-group",
* });
* export const databricksGroupId = workspaceLevel.then(workspaceLevel => workspaceLevel.id);
* ```
*
* ### Assign using `userName`, `groupName`, or `servicePrincipalName`
*
* In workspace context, adding account-level user to a workspace:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const addUser = new databricks.PermissionAssignment("add_user", {
* userName: "me@example.com",
* permissions: ["USER"],
* });
* ```
*
* In workspace context, adding account-level service principal to a workspace:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const addAdminSpn = new databricks.PermissionAssignment("add_admin_spn", {
* servicePrincipalName: "00000000-0000-0000-0000-000000000000",
* permissions: ["ADMIN"],
* });
* ```
*
* In workspace context, adding account-level group to a workspace:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as databricks from "@pulumi/databricks";
*
* const _this = new databricks.PermissionAssignment("this", {
* groupName: "example-group",
* permissions: ["USER"],
* });
* ```
*
* ## Related Resources
*
* The following resources are used in the same context:
*
* * databricks.Group to manage [Account-level](https://docs.databricks.com/aws/en/admin/users-groups/groups) or [Workspace-level](https://docs.databricks.com/aws/en/admin/users-groups/workspace-local-groups) groups.
* * databricks.Group data to retrieve information about databricks.Group members, entitlements and instance profiles.
* * databricks.GroupMember to attach users and groups as group members.
* * databricks.MwsPermissionAssignment to manage permission assignment from an account context
*
* ## Import
*
* The resource `databricks_permission_assignment` can be imported using the principal id:
*
* hcl
*
* import {
*
* to = databricks_permission_assignment.this
*
* id = "<principal_id>"
*
* }
*
* Alternatively, when using `terraform` version 1.4 or earlier, import using the `pulumi import` command:
*
* bash
*
* ```sh
* $ pulumi import databricks:index/permissionAssignment:PermissionAssignment this "<principal_id>"
* ```
*/
export declare class PermissionAssignment extends pulumi.CustomResource {
/**
* Get an existing PermissionAssignment resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PermissionAssignmentState, opts?: pulumi.CustomResourceOptions): PermissionAssignment;
/**
* Returns true if the given object is an instance of PermissionAssignment. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is PermissionAssignment;
/**
* the display name of the assigned principal.
*/
readonly displayName: pulumi.Output<string>;
/**
* the group name to assign to a workspace.
*/
readonly groupName: pulumi.Output<string>;
/**
* The list of workspace permissions to assign to the principal:
* * `"USER"` - Adds principal to the workspace `users` group. This gives basic workspace access.
* * `"ADMIN"` - Adds principal to the workspace `admins` group. This gives workspace admin privileges to manage users and groups, workspace configurations, and more.
*/
readonly permissions: pulumi.Output<string[]>;
/**
* Databricks ID of the user, service principal, or group. The principal ID can be retrieved using the account-level SCIM API, or using databricks_user, databricks.ServicePrincipal or databricks.Group data sources with account API (and has to be an account admin). A more sensible approach is to retrieve the list of `principalId` as outputs from another Pulumi stack.
*/
readonly principalId: pulumi.Output<string>;
/**
* Configure the provider for management through account provider. This block consists of the following fields:
*/
readonly providerConfig: pulumi.Output<outputs.PermissionAssignmentProviderConfig | undefined>;
/**
* the application ID of service principal to assign to a workspace.
*/
readonly servicePrincipalName: pulumi.Output<string>;
/**
* the user name (email) to assign to a workspace.
*/
readonly userName: pulumi.Output<string>;
/**
* Create a PermissionAssignment resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: PermissionAssignmentArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering PermissionAssignment resources.
*/
export interface PermissionAssignmentState {
/**
* the display name of the assigned principal.
*/
displayName?: pulumi.Input<string>;
/**
* the group name to assign to a workspace.
*/
groupName?: pulumi.Input<string>;
/**
* The list of workspace permissions to assign to the principal:
* * `"USER"` - Adds principal to the workspace `users` group. This gives basic workspace access.
* * `"ADMIN"` - Adds principal to the workspace `admins` group. This gives workspace admin privileges to manage users and groups, workspace configurations, and more.
*/
permissions?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Databricks ID of the user, service principal, or group. The principal ID can be retrieved using the account-level SCIM API, or using databricks_user, databricks.ServicePrincipal or databricks.Group data sources with account API (and has to be an account admin). A more sensible approach is to retrieve the list of `principalId` as outputs from another Pulumi stack.
*/
principalId?: pulumi.Input<string>;
/**
* Configure the provider for management through account provider. This block consists of the following fields:
*/
providerConfig?: pulumi.Input<inputs.PermissionAssignmentProviderConfig>;
/**
* the application ID of service principal to assign to a workspace.
*/
servicePrincipalName?: pulumi.Input<string>;
/**
* the user name (email) to assign to a workspace.
*/
userName?: pulumi.Input<string>;
}
/**
* The set of arguments for constructing a PermissionAssignment resource.
*/
export interface PermissionAssignmentArgs {
/**
* the group name to assign to a workspace.
*/
groupName?: pulumi.Input<string>;
/**
* The list of workspace permissions to assign to the principal:
* * `"USER"` - Adds principal to the workspace `users` group. This gives basic workspace access.
* * `"ADMIN"` - Adds principal to the workspace `admins` group. This gives workspace admin privileges to manage users and groups, workspace configurations, and more.
*/
permissions: pulumi.Input<pulumi.Input<string>[]>;
/**
* Databricks ID of the user, service principal, or group. The principal ID can be retrieved using the account-level SCIM API, or using databricks_user, databricks.ServicePrincipal or databricks.Group data sources with account API (and has to be an account admin). A more sensible approach is to retrieve the list of `principalId` as outputs from another Pulumi stack.
*/
principalId?: pulumi.Input<string>;
/**
* Configure the provider for management through account provider. This block consists of the following fields:
*/
providerConfig?: pulumi.Input<inputs.PermissionAssignmentProviderConfig>;
/**
* the application ID of service principal to assign to a workspace.
*/
servicePrincipalName?: pulumi.Input<string>;
/**
* the user name (email) to assign to a workspace.
*/
userName?: pulumi.Input<string>;
}