Hi,

In our company's project we created a databricks_user for a service account (which is needed for our deployment process) via OpenTofu and afterwards adjusted permissions to that "user's" user folder using the databricks_permissions resource.

resource "databricks_user" "databricks_deployment_sa" {
  allow_cluster_create = true
  display_name         = "Databricks Deployment SA"
  provider             = databricks.workspace
  user_name            = var.google_service_account_email
  workspace_access     = true
}

resource "databricks_permissions" "add_folder_permission" {
  #  directory_path = databricks_directory.sa_user_folder.path
  directory_path = databricks_user.databricks_deployment_sa.home

  dynamic "access_control" {
    for_each = [
      data.databricks_group.xxx,
      data.databricks_group.xxx
    ]
    content {
      group_name       = access_control.value
      permission_level = "CAN_MANAGE"
    }
  }
  access_control {
    permission_level = "CAN_MANAGE"
    user_name        = var.google_service_account_email
  }
  provider = databricks.workspace
}

If I want to destroy these resources however, tofu throws an error, saying that it cannot remove the CAN_MANAGE permission of the service account..

Error: cannot delete permissions: Cannot remove <service_account_email>'s CAN_MANAGE permission on 716423664771912

So now it seems to me, that I am no longer able to destroy my tofu managed workspace as long as I have this databricks_permissions block in my tofu code.

The databricks workspace in question is part of a test environment to test infrastructural changes without effecting the productive work so it would really be necessary to destroy tofu managed infrastructure.

Are there any ideas how I could accomplish this? Help would be much appreciated!