Can't set account admin using Terraform

[niklas]

I want to set the account admin for a service principal in order to create the Unity Catalog metastore. The Terraform code looks like this:

data "databricks_service_principal" "application" {
  count = var.environment == "dev" ? 1 : 0

  application_id = "00000000-0000-0000-0000-000000000000"
}

resource "databricks_service_principal_role" "account_admin" {
  count = var.environment == "dev" ? 1 : 0

  service_principal_id = data.databricks_service_principal.application[0].id
  role                 = "account_admin"
}

This should theoretically work according to the answers in this thread.

But unfortunately I get following error from Terraform for the resource "databricks_service_principal_role": Error: cannot read service principal role: Service Principal has no role

For me this error message is not very useful and I don't know what is wrong here. Is this maybe a bug in the Databricks Terraform provider?

Site notes (if relevant):

• I'm using the newest Databricks Terraform provider (V 1.21)
• The Databricks workspace is deployed in Azure.
• Using the "databrick_user_role" resource and trying to assign the account_admin role to a Databricks user will produce the same error message: User has no role

Looking at the source code on GitHub (Databricks Terraform provider) I found the error message from above but I don't understand why the "ReadContext" section in there is even executed.

It would be really nice if someone can help me, as I have to enable the Unity Catalog metastore very soon 🙂

[Kaniz]

Hi @niklas, The error message "cannot read service principal role" is likely indicating that the user attempting to read the service principal is not assigned the Service Principal Manager role. This role allows users to manage functions on a service principal, including setting the Service Principal Manager and Service Principal User roles. If a service principal was created before the creator of the service principal, they do not have the Service Principal Manager role by default and must be granted it by an account admin. The service Principal User role allows users to run jobs as the service principal, but Service Principal Managers do not inherit this role. They must explicitly assign it to themselves if they want to use the service principal to execute jobs.

Sources: https://docs.databricks.com/security/auth-authz/access-control/service-principal-acl.html and https://docs.databricks.com/administration-guide/users-groups/service-principals.html

[niklas · Accepted solution]

Hi Kaniz, thank you very much for your reply!
Here is the solution to the problem from above: https://stackoverflow.com/questions/76762299/cant-set-databricks-account-admin-using-terraform/76763...