service principal control plane access management

[antonionuzzo]

hi, our account admin has created a service principal to automate job execution. however, our security team is concerned that, by design, anyone with the service principal credentials might access the control plane, where the service principal is defined. In theory, this behavior should be impossible, but I would like to know if there is a specific section in the Databricks documentation that explicitly addresses this.

#Databricks #Security

[Walter_C · Accepted solution]

On the docs it states: Service principals give automated tools and scripts API-only access to Databricks resources, providing greater security than using users accounts.

https://docs.databricks.com/gcp/en/admin/users-groups/service-principals#what-is-a-service-principal