Databricks Apps - Automating Unity Catalog Privileges for Databricks Apps Service Principals

[ismaelhenzel]

I am using Databricks Apps, and I want to grant privileges to the auto-generated service principal from the app to read specific Unity Catalog schemas. I can't find a way to do this automatically using Asset Bundles.

I prefer to query using a service principal rather than users to avoid making frequent changes to groups or schemas for general apps. However, it is very tedious to grant the permissions manually when managing QA and Prod environments.

My thoughts are:

1. Should I create an external service principal for this kind of data app?

2. Should I use the service principal created automatically in the app? how to automatize ? maybe with terraform instead asset bundles ?

3. Should I create a group for each app and apply it to the schemas that I need?

I really want to use the second option, but I need it to be fully automated.

[Coffee77]

Why not to run a databricks cli script for first assign proper permissions (https://docs.databricks.com/aws/en/dev-tools/cli/reference/account-commands) and then run DAB? This was my approach to deploy some components not already available in previous versions of DAB until they were incorporated. On the other hand, I also agree that everything with an automation flavor should use service principals 🙂

[ismaelhenzel]

This is a possible solution. The Databricks service principal for the data app only exists after its deployment in the platform. Then, after deployment, I could get the ID that the principal of the data app received, and then apply the necessary read grants inside the CI/CD. But I hope that Databricks incorporates this in the future. As you said, this could be a temporary fix until a release incorporates the feature directly in the bundle. Thanks for the answer.

[Coffee77]

I also hope so 🙂