Get resource permissions using terraform

[fkseki]

Is there a way to retrieve resources (cluster, job, volume, catalog and all other objects) permissions?

On terraform docs there's a resource databricks_permissions but I didn't find a data source databricks_permissions, grants ou similar.

How can I get current resource permissions so I can "append" a new permission to the resource?

Regards,

[fkseki]

Adding some info, I understand that the "import" functionality is not the way to go because I couldn't use it's return to add or remove principals to the resource's permission

[Ashwin_DSA · Accepted solution]

Hi @fkseki,

There isn’t a data "databricks_permissions" (or similar) in the Databricks Terraform, only the databricks_permissions resource, and that resource is authoritative for the full ACL of the object. That means Terraform can’t read the current permissions and append another during a plan.

Your options are to make Terraform the source of truth by using the Permissions API / Databricks CLI (or the Terraform exporter) once to pull the current ACL for the object and turn that into a databricks_permissions resource. You can then, whenever you want to append a permission, add another access_control block to that resource and terraform apply. Terraform manages the entire ACL declaratively.

Alternatively, you can manage ACLs outside Terraform by skipping databricks_permissions for that object and instead call the Permissions API or CLI directly (e.g., using PATCH where supported) to add/remove principals.

Hope this helps.

If this answer resolves your question, could you mark it as “Accept as Solution”? That helps other users quickly find the correct fix.

[fkseki]

Hi Ashwin, thanks for the reply

Is it on the roadmap to have a "data databricks_permission" in the future?

We are using terraform to provide the users a self service platform so they can create resources (clusters, volumes, external location, connections, etc) in a controled way using only terraform and this would be essential for a good user experience.

Regards