How to add instance profile permission to all user via databricks-sdk workspace client

[samarth_solanki]

How to add instance profile permission to all user via databricks-sdk workspace client. Just like terraform where we can give "users" for all users , how can we don same using databricks-sdk workspace-client. I cannot find permission for instance profile in documentation and all user case anywhere.

[Kaniz_Fatma]

Hi @samarth_solanki, 

To manage instance profiles in Databricks and grant access to users, you can follow these steps:

1. Using the Admin Settings Page:

   • As a workspace admin, go to the admin settings page.
   • Click the Instance Profiles tab.
   • Select the instance profile you want to update.
   • In the dropdown below the instance profile details, select or enter the user, group, or service principal.
   • Click Add¹.

2. Assigning Instance Profiles to Groups:

   • Navigate to the admin settings page.
   • Click on the Identity and Access tab.
   • Under Groups, click Manage.
   • Select the group you want to update.
   • On the Instance Profiles tab, click + Add Instance Profiles to Group.
   • Choose the instance profiles you want to add.
   • Click Add¹.

3. Using the API:

   • Workspace admins can manage access to instance profiles using workspace-level SCIM APIs for users, service principals, and groups.
   • To grant a group access to an instance profile, use the following pattern:

     curl --netrc -X PATCH \
     https://<databricks-instance>/api/2.0/preview/scim/v2/Groups/<group-id> \
     --header 'Content-type: application/scim+json' \
     --data @update-group.json
     

     Replace:
     • <group-id> with the ID of the group.
     • <instance-profile-role-arn> with the Amazon Resource Name (ARN) of the instance profile role (e.g., ...¹.

Remember that instance profiles allow users to deploy clusters with specific permissions defined by the profile. If you encounter any issues, refer to the official documentation for more details. 

[samarth_solanki]

I want to give it to all users. How can i give that permission? do i have to write each group/user name