Impossible to access Terraform created external location?!

Teo12333 — Tue, 22 Apr 2025 09:14:42 GMT

Hi all,

There seems to be an external location created that nobody within the organization can actually see or manage, because it has been created with a Google service account in Terraform.

Here is the problem:

DESCRIBE EXTERNAL LOCATION `gcsbucketname`;

this returns

[UNAUTHORIZED_ACCESS] Unauthorized access: PERMISSION_DENIED: User does not have any non-BROWSE privileges on External Location 'gcsbucketname'. SQLSTATE: 42501

this confirms that there IS an external location by this name in my workspace, however, as an admin, I am unable to see it in the external locations, neither is anybody else in my organization. I am unable to recreate the external location.... because it already exists. It seems this was created by mistake with terraform, the terraform configuration has since then changed to no longer include this. Now even if we want to recreate this with terraform, we can't because the google bucket location is already taken.

I expect, as an admin, to be able to see everything to manage my organization. Is this not the case with Databricks? To me it seems that our only way out now is to create a new bucket or recreate the workspace alltogether. Am I missing something? Is there a superadmin button somewhere that I am not aware of? It seems a bit silly that nobody within my organization can see ANY external locations, even working ones. We found out there are additional external locations which currently cannot be managed at all, since they are created by the service account (which we can't use to log in the workspace with since its a gcs service account).

I hope I'm just missing an obvious super admin button somewhere but it really seems that databricks allows users to create inaccessible external locations.

Thanks in advance for your input!

Re: Impossible to access Terraform created external location?!

Walter_C — Tue, 22 Apr 2025 15:43:20 GMT

Are you a workspace admin or a metastore admin? Only Metastore admins should see all UC objects created.

Re: Impossible to access Terraform created external location?!

mnorland — Tue, 22 Apr 2025 23:33:50 GMT

I would agree that the metastore admin(s) should be able to see the external location. This issue can happen with terraform scripts if the script doesn't grant additional rights on the external location.

topic Re: Impossible to access Terraform created external location?! in Administration & Architecture

Impossible to access Terraform created external location?!

Re: Impossible to access Terraform created external location?!

Re: Impossible to access Terraform created external location?!