Grant permissions to existing catalogs/schemas using Databricks Asset Bundles

vjussiiih
New Contributor

‎02-18-2026 02:29 AM

Hi,

I’m trying to use Databricks Asset Bundles (DAB) to assign Unity Catalog grants to catalogs and schemas that already exist in my workspace.

These catalogs and schemas were not originally created through DAB, but I would now like to manage their grants using a bundle.

For example, I am adding an existing schema like this:

resources:
  schemas:
    schema_name:
      name: schema_name
      catalog_name: catalog_name
      grants:
        - principal: some_principal_name
          privileges:
            - USE_SCHEMA
            - SELECT
 

However, regarding schemas (or catalogs) originally created by DAB, I get the following warning:

This action will result in the deletion or recreation of the following UC schemas.
Any underlying data may be lost:

delete resources.schemas.dab_test_catalog
delete resources.schemas.dab_test_schema

Error: the deployment requires destructive actions, but current console does not support prompting.
Please specify --auto-approve if you would like to skip prompts and proceed

And when the schema already exists but was NOT created by DAB, the deployment fails with:

Error: cannot create resources.schemas.<name>: Schema already exists

My question:

Is there any supported way to use Databricks Asset Bundles to grant permissions on an existing catalog or schema without:

  • DAB trying to create the catalog/schema
  • DAB trying to delete and recreate them
  • DAB attempting destructive changes
  • Having to explicitly define every table/volume inside the schema

In short:
👉 I only want to apply grants, not manage the lifecycle of the schema/catalog itself.

What I’ve tried / observed:

  • If a schema is defined under resources.schemas, DAB treats it as a fully managed resource, meaning it wants to create or drop it.
  • This triggers destructive plans, because DAB does not support a “grant‑only” mode for Unity Catalog objects.
  • I also tried with catalogs, but Bundles always attempts to create the catalog via POST /catalogs, which requires CREATE CATALOG on the metastore — which I do not have.

Is there any non-destructive pattern or best practice for this scenario?

Something like managing only permissions for existing UC objects, without having DAB take ownership of the entire schema/catalog?

Thanks in advance to anyone who can clarify whether this is supported. SQL tasks might be the only safe option and that is what AIs are also suggesting.

Labels:
0 Kudos