topic How to get a list of workspace users who have the "unrestricted cluster create" entitlement ? in Data Engineering

How to get a list of workspace users who have the "unrestricted cluster create" entitlement ?

djburnham — Wed, 05 Jun 2024 10:57:08 GMT

Hello - I'm hoping somebody can help me with this ... I have a lot of users configured with access to a workspace (100's) and I want to write a report to see if any of the users have "unrestricted cluster create" entitlement in the workspace. This information used to be available in the UI but it looks like you have to go into each user and inspect individually - this will take me ages if I have to do this (and is bound to make me angry). What I want is a report to give me this information. I'm happy using the CLI or the API to achieve this - but I can't see it in the docs or the internal help in the CLI - has anyone done this already ? Many thanks for your help.

Kind regards, David.

Re: How to get a list of workspace users who have the "unrestricted cluster create" entitl

Yeshwanth — Thu, 06 Jun 2024 05:27:44 GMT

Hello @djburnham, good day!

Did you try using this API: https://docs.databricks.com/api/workspace/users/list

This API provides a list of all the users in the workspace and their entitlements. You can get the list of users, parse through each user's entitlements, find out who has unrestricted cluster creation permission, and then create a report on it. I believe this will help you. Please share your thoughts on this.

Best regards

Re: How to get a list of workspace users who have the "unrestricted cluster create" entitl

djburnham — Thu, 06 Jun 2024 10:47:32 GMT

Many thanks for you help @Yeshwanth it put me on the right track. The API does have a filter option and that looks like it complies with rfc7644 but my attempts to use it were rather hit and miss - I suspect as the API is preview it is not fully implemented. Getting the info out of the API was enough to allow me to parse the json using jq to get the list of users with the "allow-cluster-create" privilege. Here is the code running in a linux bash prompt to get the list of users with the privilege.

$ databricks api get /api/2.0/preview/scim/v2/Users| jq '.Resources | map(select(.entitlements != null and (.entitlements | any(.value == "allow-cluster-create")))) | map(.userName)'

This was so much easier when there was a page in the GUI to show entitlements ... Is it hidden now of have I just lost it ?

Kind regards, David