cancel
Showing results for 
Search instead for 
Did you mean: 
Administration & Architecture
Explore discussions on Databricks administration, deployment strategies, and architectural best practices. Connect with administrators and architects to optimize your Databricks environment for performance, scalability, and security.
cancel
Showing results for 
Search instead for 
Did you mean: 

How to setup service principal to assing account-level groups to workspaces using terraform

DavidZS
New Contributor

Based on best practices, we have set up SCIM provisioning using Microsoft Entra ID to synchronize Entra ID groups to our Databricks account. All workspaces have identity federation enabled.

However, how should workspace administrators assign account-level groups to their workspaces via terraform once they have been synchronized to the Databricks account? The Databricks provider documentation for the "databricks_permission_assignment" resource provides an example that uses a dedicated provider on account level. When attempting to read the group on account-level using a service principal with workspace adminstrator rights only returns an error (status 401). Based on some (more or less cryptic) descriptions, any account-level API can only be accessed by credentials with "Account Admin" rights (example reference).

For obvious reasons, service principals used to manage terraform state of a specific workspace should not be granted "Account Admin" rights. How can the service principal set up in a way that allows fetching the group id without granting "Account Admin" rights? Are there additional workspace-level APIs that I'm not aware of that can be used instead?

1 REPLY 1

Walter_C
Honored Contributor
Honored Contributor

Have you tried giving Manager role on the group to the service principal which is workspace admin? Once you do this you may be able to use the settings to  In workspace context, adding account-level group to a workspace in databricks_permission_assignment

Join 100K+ Data Experts: Register Now & Grow with Us!

Excited to expand your horizons with us? Click here to Register and begin your journey to success!

Already a member? Login and join your local regional user group! If there isn’t one near you, fill out this form and we’ll create one for you to join!