I'm designing an enterprise Unity Catalog RBAC model in Databricks and would like feedback on whether this follows best practices.

My current design is:

• A single Service Principal is used by Terraform to provision all Unity Catalog objects.

• The Service Principal is a member of the Metastore Admin group.

• Using Terraform, the Service Principal:

  • Creates the Storage Credentials and External Locations.

  • Creates the Catalog, then transfers ownership to the appropriate Catalog Owner group.

  • Creates the Schema, then transfers ownership to the appropriate Schema Owner group.

• The Service Principal remains the automation identity, while business ownership is transferred to the respective owner groups.

My RBAC roles are:

• Metastore Admin

• Catalog Owner

• Schema Owner

• Schema Write

• Schema Read

Is this considered a good enterprise-scale design and aligned with Databricks Unity Catalog best practices?

Specifically:

1. Is it a best practice to use a single Terraform Service Principal that belongs to the Metastore Admin group for provisioning?

2. Should the Metastore Admin group continue to own Storage Credentials and External Locations, while Catalog and Schema ownership is transferred to the respective owner groups?

3. Are these RBAC roles sufficient for a large enterprise, or would you recommend adding or changing any roles?