Group manage permission using terraform

[eshwari]

I am creating groups in databricks using terraform. The service principal used to create these groups automatically get Manage permission on respective groups, but I want to assign this manage permission on all groups to one specific admin group. I can't find the terraform module to do that. Please let me know if there is one and if there isn't then what could be workaround in terraform.

[balajij8]

You can add a post Terraform step in the process for it. You can use the Group Manager role assigned for the members in it if feasible. It helps in management of group membership. You can do it in Account Console or Workspace Admin Settings page manually.

You can also do it using Account Access Control Interfaces in the post terraform step.

resource "databricks_group" "groups" {
  for_each     = toset(["group1", "group2"])
  display_name = each.value
}

resource "null_resource" "assign_group_managers" {
  for_each = databricks_group.groups

  provisioner "local-exec" {
    command = <<EOT
      curl -X POST \
        "${var.workspace_url}/api/2.0/preview/accounts/access-control/assignable-roles" \
        -H "Authorization: Bearer ${var.databricks_token}" \
        -H "Content-Type: application/json" \
        -d '{
          "principal": "${var.admin_group_id}",
          "role": "roles/group.manager",
          "resource": "groups/${each.value.id}"
        }'
    EOT
  }

  depends_on = [databricks_group.groups]
}

Note it works only with account level groups and it's in public preview. More details here

[binlogreader]

Group manager is not a permission in `databricks_permissions`, it is an account-level role, and the resource that assigns those roles is `databricks_access_control_rule_set`.

If you want your admin group to manage every group in the account, including ones created later, a single account-level rule set covers it:

```hcl

data "databricks_group" "admins" {

display_name = "my-admin-group"

}

resource "databricks_access_control_rule_set" "account" {

name = "accounts/${var.account_id}/ruleSets/default"

grant_rules {

principals = [data.databricks_group.admins.acl_principal_id]

role = "roles/group.manager"

}

}

```

If you would rather scope it to just the groups your Terraform creates, the same resource works per group with a `for_each`, using `name = "accounts/${var.account_id}/groups/${each.value.id}/ruleSets/default"` and the same grant rule.

One thing to know before you apply, this resource is authoritative, so each apply replaces the whole rule set it names. Keep all grants for a given rule set path in one resource (two resources on the same name overwrite each other), and if roles were already assigned outside Terraform, import the rule set or re-declare those grants, because an apply that doesn't include them removes them. It works with either a workspace-level or account-level provider; the docs page has examples for both. The creating SP's implicit manager access is separate and stays either way; this just adds the explicit assignment you want.