ALL PRIVILEGES not working in Terraform databricks_grants configuration

Andrei_Radulesc — Mon, 14 Nov 2022 16:12:54 GMT

I'm trying to create a UC catalog in Terraform on AWS, and grant "account users" ALL PRIVILEGES. Here is my code:

resource "databricks_catalog" "test" {

provider = databricks.workspace

metastore_id = var.metastore_id

name = "test"

owner = "account users"

comment = "Managed by Terraform"

properties = {

purpose = "testing"

}

When applying the config the 1st time, everything is fine. I can verify in the UI that the config was set. However, when applying the config a 2nd time, I get the error below:

Error: ALL PRIVILEGES is not allowed on catalog

Runnint terraform with TF_LOG=DEBUG gives me more detail about the error:

022-11-14T11:10:46.638-0500 [WARN] Provider "registry.terraform.io/databricks/databricks" produced an unexpected new value for module.unity_ca

talog.databricks_grants.test during refresh.

- .grant: planned set element cty.ObjectVal(map[string]cty.Value{"principal":cty.StringVal("account users"), "privileges":cty.SetVal([]cty

.Value{cty.StringVal("ALL PRIVILEGES")})}) does not correlate with any element in actual

2022-11-14T11:10:46.646-0500 [ERROR] provider.terraform-provider-databricks_v1.2.0: Response contains error diagnostic: tf_resource_type=databri

cks_grants @caller=/home/runner/work/terraform-provider-databricks/terraform-provider-databricks/vendor/github.com/hashicorp/terraform-plugin-go

/tfprotov5/internal/diag/diagnostics.go:56 @module=sdk.proto diagnostic_detail= diagnostic_severity=ERROR tf_provider_addr=provider tf_req_id=32

a078b5-8e24-7103-bc75-20127e8a24fa tf_rpc=PlanResourceChange diagnostic_summary="ALL PRIVILEGES is not allowed on catalog" tf_proto_version=5.3

timestamp=2022-11-14T11:10:46.646-0500

}

resource "databricks_grants" "test" {

provider = databricks.workspace

catalog = databricks_catalog.test.name

grant {

principal = "account users"

privileges = ["ALL PRIVILEGES"]

}

Any suggestion on how to set UC catalog permissions in Terraform?

Re: ALL PRIVILEGES not working in Terraform databricks_grants configuration

Pat — Tue, 22 Nov 2022 08:12:42 GMT

Hi @Andrei Radulescu-Banu ,

I believe you should use ALL_PRIVILEGES:

resource "databricks_grants" "test" {
 
 provider = databricks.workspace
 
 catalog = databricks_catalog.test.name
 
 grant {
 
   principal = "account users"
 
   privileges = ["ALL_PRIVILEGES"]
 
 }
 
}

if not, please try 'ALL'.

I did this in the past, but I've removed catalog creation from TF before pushing the code, so no history in repo.

docs: https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/grants#catalog-grants

Re: ALL PRIVILEGES not working in Terraform databricks_grants configuration

Andrei_Radulesc — Tue, 22 Nov 2022 20:55:16 GMT

Yes! I was missing the underbar, "ALL_PRIVILEGES". It works now. Thank you!

topic Re: ALL PRIVILEGES not working in Terraform databricks_grants configuration in Warehousing & Analytics

ALL PRIVILEGES not working in Terraform databricks_grants configuration

Re: ALL PRIVILEGES not working in Terraform databricks_grants configuration

Re: ALL PRIVILEGES not working in Terraform databricks_grants configuration