Hi, We have some problems to create some resources using terraform, after the Unity catalog migration. We have created a group and SVC Principal under account as in the doc using terraform. (AWS infrastructure) (https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/group)

resource "databricks_group" "group_account_level" {
  display_name               = "databricks_deployments"
  allow_cluster_create       = true
  allow_instance_pool_create = true
  workspace_access           = true
 
  provider = databricks.account_level
}
 
resource "databricks_service_principal" "spark_account_level" {
  display_name = "SVC_SPARK"
  provider     = databricks.account_level
}
 
resource "databricks_group_member" "spark_deployments" {
  group_id  = databricks_group.group_account_level.id
  member_id = databricks_service_principal.spark_account_level.id
 
  provider = databricks.account_level
}

The provider uses the databricks host as in the documentation. (https://accounts.cloud.databricks.com)

We need to use the SVC Principal with the following resources:

• databricks_permissions (authorization token, permission_level = "CAN_USE")
• databricks_group_role (to assign an instance profile that exists and workspace level)
• databricks_secret_acl (some secrets that were present before the unity catalog migration)

All failed I tried the following combinations:

. Using the databricks provider used to create the service principal at account level:

resource "databricks_group_role" "instance_profile_group_deployments" {
  group_id = databricks_group.group_account_level.id
  role     = databricks_instance_profile.ds.id
 
  provider = databricks.account_level
}

Looks like the API is not defined under account level

. Using the provider under workspace

resource "databricks_group_role" "instance_profile_group_deployments" {
  group_id = databricks_group.group_account_level.id
  role     = databricks_instance_profile.ds.id
 
  provider = databricks.workspace_url
}

then it complains can not find the group with the id XXXX, however the group exists but under account level

Any help will be appreciated