Terraform Failed to get oauth access token. Please retry after logout and login again. with GCP

NelsonE
New Contributor III

‎08-17-2024 02:54 PM

Hi I'm having trouble creating a databricks_mws_vpc_endpoint with Terraform.

I already created 2 Private Service Connect (PSC) and I'm trying to create the vpc endpoint for Databricks but I'm getting this error:

BAD_REQUEST: Failed to get oauth access token. Please retry after logout and login again.

This is my terraform:

 

 

 

 

 

provider "databricks" {
    alias = "accounts"
    profile = "DEFAULT"
}

resource "databricks_mws_vpc_endpoint" "backend_rest_vpce" {
    provider = databricks.accounts
    account_id = var.databricks_account_id
    vpc_endpoint_name = "vpce-backend-rest-ven"
    gcp_vpc_endpoint_info {
        project_id = var.network_project_id
        psc_endpoint_name = var.backend_rest_psce
        endpoint_region = google_compute_subnetwork.network-with-private-secondary-ip-ranges.region
    }
}

 

 

 

 

I Configure my credentials inside the .databrickscfg and I'm using a service principal to create databricks resources. Also I tested my credentials with the databricks CLI and the work perfectly.

If I created manually they are working fine as well.

Thanks

0 Kudos

Retired_mod
Esteemed Contributor III

‎08-19-2024 06:24 AM

Hi @NelsonE, Please try databricks auth login again. Also, could you please share some error stacks?
Additionally, please share the workspace ID (send an email to community@databricks.com) / GCP region so that we can investigate on it further.

 

0 Kudos

NelsonE
New Contributor III
In response to Retired_mod

‎08-27-2024 08:15 AM - edited ‎08-27-2024 08:16 AM

The solution was the type of auth type that I was using with Databricks. It start working when I created a service account in my GCP project, then I changed that I could make request on behalf of that user and I added the user into Databricks account.

That worked for me. Now the auth_type in the provider is something like:
auth_type = "google-id"

wlam1
Databricks Partner

‎11-17-2024 10:26 PM

Thank you @NelsonE ! This helped me as well. Tried messing around with all kinds of authentication methods but this was what worked.

For the record, I am also using service account impersonation to register VPC endpoints on Terraform / GCP for Databricks. My .databrickscfg profile looks like this:

[GCP_ID_ACCOUNT]
host                    = https://accounts.gcp.databricks.com
account_id              = <acc-id>
google_service_account  = <service-account-email>
0 Kudos

andres_garcia
Databricks Employee
Databricks Employee

Thursday

On Google Cloud Platform (GCP), the account-level Databricks Terraform Provider or account API does not use standard Databricks tokens or standard Databricks OAuth. Instead, it relies on Google Cloud ID (OIDC) tokens generated via a Google Cloud service account.

provider "databricks" {
  alias                  = "accounts"
  host                   = "https://accounts.gcp.databricks.com"
  account_id             = var.databricks_account_id
  google_service_account = var.databricks_google_service_account
}
resource "databricks_mws_vpc_endpoint" "backend_rest_vpce" {
    provider = databricks.accounts
    account_id = var.databricks_account_id
    vpc_endpoint_name = "vpce-backend-rest-ven"
    gcp_vpc_endpoint_info {
        project_id = var.network_project_id
        psc_endpoint_name = var.backend_rest_psce
        endpoint_region = google_compute_subnetwork.network-with-private-secondary-ip-ranges.region
    }
}

 

0 Kudos