topic Re: Databricks Workspace Access and Permissions in Administration & Architecture

Databricks Workspace Access and Permissions

karthiknuvepro — Wed, 22 Jan 2025 09:07:25 GMT

Hi Team,

The GCP Databricks URL https://accounts.gcp.databricks.com/ for GCP Databricks is linked to the GCP Billing Account.
We have two clients with separate GCP Organizations:
- client1.example.com
- client2.example.com
Both GCP Organizations share the same GCP Billing Account.
The GCP provides a single Billing Account for the company.

To create a Databricks Workspace, the AccountAdmin permission must be assigned to the GCP IAM user through User Management.

If we grant AccountAdmin permissions to both clients, they will be able to:

View other client workspaces.
Modify or delete workspaces belonging to other clients.

We want guidance on how to:

Restrict GCP IAM users so they can create workspaces but only access the workspaces they create.
Ensure other workspaces are neither visible nor accessible to them.

Please let us know how this can be achieved.

Regards,
Karthik Kumar P L
Lead Cloud Support

Re: Databricks Workspace Access and Permissions

Alberto_Umana — Wed, 22 Jan 2025 12:59:17 GMT

HIi @karthiknuvepro,

To isolate resources you can follow these steps:

Create Separate GCP Projects for Each Client:
- Create a separate GCP project for each client within their respective GCP Organizations.
- This ensures that each client has isolated resources and permissions.
Assign AccountAdmin Permissions at the Project Level:
- Grant the AccountAdmin permission to the GCP IAM user at the project level, not at the organization level.
- This limits their permissions to only the resources within their specific project.

Re: Databricks Workspace Access and Permissions

karthiknuvepro — Thu, 23 Jan 2025 14:03:46 GMT

Hi @Alberto_Umana ,

In the Databricks Account, we can only see Account Admin permissions and no permissions at the project level. Please provide reference screenshots indicating where to grant permissions at the project level.

Note: In GCP IAM, all permissions are assigned solely at the project level."

Re: Databricks Workspace Access and Permissions

mnorland — Mon, 10 Mar 2025 22:04:13 GMT

@karthiknuvepro The Databricks Account should be handled by a third-party Cloud Administration team. The workspace admins can work with them to set up the necessary cloud resources to support their catalogs and user adds/remove from their selected authentication method of choice. Otherwise, one client should create a new Databricks Account under a new billing account and migrate there.