I am unable to create a databricks workspace with vnet injection. I get this error:

│ {
│   "status": "Failed",
│   "error": {
│     "code": "InternalServerError",
│     "message": "INTERNAL_ERROR: Unexpected error: Cannot call getCertifiedMetastoreForRegion: metastore certification is not enabled."
│   }
│ }

 I get the same error from Azure portal and terraform.

Template from Azure portal:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "location": {
            "type": "String"
        },
        "workspaceName": {
            "type": "String"
        },
        "tier": {
            "defaultValue": "premium",
            "type": "String"
        },
        "tagValues": {
            "type": "Object"
        },
        "managedResourceGroupName": {
            "defaultValue": "",
            "type": "String"
        },
        "enableNoPublicIp": {
            "type": "Bool"
        }
    },
    "variables": {
        "managedResourceGroupName": "[if(not(empty(parameters('managedResourceGroupName'))), parameters('managedResourceGroupName'), concat('databricks-rg-', parameters('workspaceName'), '-', uniqueString(parameters('workspaceName'), resourceGroup().id)))]",
        "trimmedMRGName": "[substring(variables('managedResourceGroupName'), 0, min(length(variables('managedResourceGroupName')), 90))]",
        "managedResourceGroupId": "[concat(subscription().id, '/resourceGroups/', variables('trimmedMRGName'))]"
    },
    "resources": [
        {
            "type": "Microsoft.Databricks/workspaces",
            "apiVersion": "2024-05-01",
            "name": "[parameters('workspaceName')]",
            "location": "[parameters('location')]",
            "dependsOn": [],
            "tags": "[parameters('tagValues')]",
            "sku": {
                "name": "[parameters('tier')]"
            },
            "properties": {
                "ManagedResourceGroupId": "[variables('managedResourceGroupId')]",
                "parameters": {
                    "enableNoPublicIp": {
                        "value": "[parameters('enableNoPublicIp')]"
                    }
                },
                "defaultCatalog": {
                    "initialType": "UnityCatalog",
                    "initialName": ""
                }
            }
        }
    ]
}

Terraform config:

variable "databricks_location" {
  description = "The location for the Databricks workspace"
  type        = string
  default     = "northeurope"
}

resource "azurerm_resource_group" "databricks_rg" {
  name     = "rg-databricks-${terraform.workspace}"
  location = var.databricks_location
  tags     = local.ai_tags
}

resource "azurerm_virtual_network" "databricks_vnet" {
  name                = "vnet-databricks-${terraform.workspace}"
  address_space       = ["10.2.0.0/16"]
  location            = azurerm_resource_group.databricks_rg.location
  resource_group_name = azurerm_resource_group.databricks_rg.name
  tags                = local.ai_tags
}

resource "azurerm_subnet" "databricks_public" {
  name                 = "snet-databricks-public-${terraform.workspace}"
  resource_group_name  = azurerm_resource_group.databricks_rg.name
  virtual_network_name = azurerm_virtual_network.databricks_vnet.name
  address_prefixes     = ["10.2.1.0/24"]

  delegation {
    name = "databricks-del-public"
    service_delegation {
      name    = "Microsoft.Databricks/workspaces"
      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action", "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action", "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"]
    }
  }
}

resource "azurerm_subnet" "databricks_private" {
  name                 = "snet-databricks-private-${terraform.workspace}"
  resource_group_name  = azurerm_resource_group.databricks_rg.name
  virtual_network_name = azurerm_virtual_network.databricks_vnet.name
  address_prefixes     = ["10.2.2.0/24"]

  delegation {
    name = "databricks-del-private"
    service_delegation {
      name    = "Microsoft.Databricks/workspaces"
      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action", "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action", "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"]
    }
  }
}

resource "azurerm_subnet" "databricks_pe" {
  name                 = "snet-databricks-pe-${terraform.workspace}"
  resource_group_name  = azurerm_resource_group.databricks_rg.name
  virtual_network_name = azurerm_virtual_network.databricks_vnet.name
  address_prefixes     = ["10.2.3.0/24"]

  private_endpoint_network_policies_enabled = true
}

resource "azurerm_network_security_group" "databricks_nsg" {
  name                = "nsg-databricks-${terraform.workspace}"
  location            = azurerm_resource_group.databricks_rg.location
  resource_group_name = azurerm_resource_group.databricks_rg.name
  tags                = local.ai_tags
}

resource "azurerm_subnet_network_security_group_association" "databricks_private_nsg" {
  subnet_id                 = azurerm_subnet.databricks_private.id
  network_security_group_id = azurerm_network_security_group.databricks_nsg.id
}

resource "azurerm_subnet_network_security_group_association" "databricks_public_nsg" {
  subnet_id                 = azurerm_subnet.databricks_public.id
  network_security_group_id = azurerm_network_security_group.databricks_nsg.id
}

resource "azurerm_databricks_workspace" "this" {
  name                        = "dbw-${terraform.workspace}"
  resource_group_name         = azurerm_resource_group.databricks_rg.name
  location                    = azurerm_resource_group.databricks_rg.location
  sku                         = "premium"
  managed_resource_group_name = "rg-databricks-managed-${terraform.workspace}"

  public_network_access_enabled         = true       # Changed from false to true
  network_security_group_rules_required = "AllRules" # Changed from "NoAzureDatabricksRules" to "AllRules"

  custom_parameters {
    no_public_ip        = false # Changed from true to false
    public_subnet_name  = azurerm_subnet.databricks_public.name
    private_subnet_name = azurerm_subnet.databricks_private.name
    virtual_network_id  = azurerm_virtual_network.databricks_vnet.id

    public_subnet_network_security_group_association_id  = azurerm_subnet_network_security_group_association.databricks_public_nsg.id
    private_subnet_network_security_group_association_id = azurerm_subnet_network_security_group_association.databricks_private_nsg.id
  }

  tags = local.ai_tags

  depends_on = [
    azurerm_subnet_network_security_group_association.databricks_public_nsg,
    azurerm_subnet_network_security_group_association.databricks_private_nsg
  ]
}

resource "azurerm_private_dns_zone" "databricks_dns" {
  name                = "privatelink.azuredatabricks.net"
  resource_group_name = azurerm_resource_group.databricks_rg.name
}

resource "azurerm_private_dns_zone_virtual_network_link" "databricks_dns_link" {
  name                  = "databricks-dns-link"
  resource_group_name   = azurerm_resource_group.databricks_rg.name
  private_dns_zone_name = azurerm_private_dns_zone.databricks_dns.name
  virtual_network_id    = azurerm_virtual_network.databricks_vnet.id
}

resource "azurerm_private_endpoint" "databricks_pe" {
  name                = "pe-databricks-${terraform.workspace}"
  location            = azurerm_resource_group.databricks_rg.location
  resource_group_name = azurerm_resource_group.databricks_rg.name
  subnet_id           = azurerm_subnet.databricks_pe.id

  private_service_connection {
    name                           = "psc-databricks-${terraform.workspace}"
    is_manual_connection           = false
    private_connection_resource_id = azurerm_databricks_workspace.this.id
    subresource_names              = ["databricks_ui_api"]
  }

  private_dns_zone_group {
    name                 = "privatelink-databricks-${terraform.workspace}"
    private_dns_zone_ids = [azurerm_private_dns_zone.databricks_dns.id]
  }

  depends_on = [azurerm_databricks_workspace.this]
}

resource "azurerm_virtual_network_peering" "databricks_to_ai" {
  name                      = "peer-databricks-to-ai"
  resource_group_name       = azurerm_resource_group.databricks_rg.name
  virtual_network_name      = azurerm_virtual_network.databricks_vnet.name
  remote_virtual_network_id = azurerm_virtual_network.local.id
}

resource "azurerm_virtual_network_peering" "ai_to_databricks" {
  name                      = "peer-ai-to-databricks"
  resource_group_name       = azurerm_resource_group.this.name
  virtual_network_name      = azurerm_virtual_network.local.name
  remote_virtual_network_id = azurerm_virtual_network.databricks_vnet.id
}