Databricks Workspace Access and Permissions

[karthiknuvepro]

Hi Team,

• The GCP Databricks URL https://accounts.gcp.databricks.com/ for GCP Databricks is linked to the GCP Billing Account.
• We have two clients with separate GCP Organizations:
  • client1.example.com
  • client2.example.com
• Both GCP Organizations share the same GCP Billing Account.
• The GCP provides a single Billing Account for the company.

To create a Databricks Workspace, the AccountAdmin permission must be assigned to the GCP IAM user through User Management.

If we grant AccountAdmin permissions to both clients, they will be able to:

• View other client workspaces.
• Modify or delete workspaces belonging to other clients.

We want guidance on how to:

1. Restrict GCP IAM users so they can create workspaces but only access the workspaces they create.
2. Ensure other workspaces are neither visible nor accessible to them.

Please let us know how this can be achieved.

Regards,
Karthik Kumar P L
Lead Cloud Support

[Alberto_Umana]

HIi @karthiknuvepro,

To isolate resources you can follow these steps:

• Create Separate GCP Projects for Each Client:

  • Create a separate GCP project for each client within their respective GCP Organizations.
  • This ensures that each client has isolated resources and permissions.

• Assign AccountAdmin Permissions at the Project Level:

  • Grant the AccountAdmin permission to the GCP IAM user at the project level, not at the organization level.
  • This limits their permissions to only the resources within their specific project.

[karthiknuvepro]

Hi @Alberto_Umana ,

In the Databricks Account, we can only see Account Admin permissions and no permissions at the project level. Please provide reference screenshots indicating where to grant permissions at the project level.

Note: In GCP IAM, all permissions are assigned solely at the project level."

[mnorland]

@karthiknuvepro The Databricks Account should be handled by a third-party Cloud Administration team.  The workspace admins can work with them to set up the necessary cloud resources to support their catalogs and user adds/remove from their selected authentication method of choice.  Otherwise, one client should create a new Databricks Account under a new billing account and migrate there.