Group manager is not a permission in `databricks_permissions`, it is an account-level role, and the resource that assigns those roles is `databricks_access_control_rule_set`.

If you want your admin group to manage every group in the account, including ones created later, a single account-level rule set covers it:

```hcl

data "databricks_group" "admins" {

display_name = "my-admin-group"

}

resource "databricks_access_control_rule_set" "account" {

name = "accounts/${var.account_id}/ruleSets/default"

grant_rules {

principals = [data.databricks_group.admins.acl_principal_id]

role = "roles/group.manager"

}

}

```

If you would rather scope it to just the groups your Terraform creates, the same resource works per group with a `for_each`, using `name = "accounts/${var.account_id}/groups/${each.value.id}/ruleSets/default"` and the same grant rule.

One thing to know before you apply, this resource is authoritative, so each apply replaces the whole rule set it names. Keep all grants for a given rule set path in one resource (two resources on the same name overwrite each other), and if roles were already assigned outside Terraform, import the rule set or re-declare those grants, because an apply that doesn't include them removes them. It works with either a workspace-level or account-level provider; the docs page has examples for both. The creating SP's implicit manager access is separate and stays either way; this just adds the explicit assignment you want.