Configure job access_control_list block from a single place outside of job definition

[noorbasha534]

Hi all

Is it possible to configure the access_control_list block ((basically that contains permissions)) from a single place outside of Databricks job definition? This is changing as we are re-defining our permissions model, and each time resulting into 100+ jobs definition changes...

[SP_6721]

Hi @noorbasha534 ,

You can define top-level permissions in your bundle YAML file, this applies them to all jobs and resources, so changes only require a single update, not edits to every job.

https://docs.databricks.com/aws/en/dev-tools/bundles/settings#permissions

[Pilsner]

Hello @noorbasha534 

If you are trying to alter the permissions across many jobs at scale, I believe there are a couple of options to help speed up the process. 

Firstly, creating groups of users should help, as you can then easily change an entire group's permissions at once or add/remove users from the group, which will, in turn, add/remove their user permissions to all jobs granted to the group. 

Secondly, if you are looking to change permissions to jobs on mass, I believe you can use the Databricks command line interface (CLI) to programmatically alter the permissions. I found this article, which contains examples of how this can be done: https://docs.databricks.com/aws/en/dev-tools/cli/reference/permissions-commands.

I hope I have understood your problem correctly and been able to help - please let me know how you get on!

Regards - Pilsner