Hi @Jordi Casanella​ ,

I have been working with terraform for databricks lately and I would say that I had to switch my approach couple of times due to issues like you have right now (account vs workspace level API).

I assume that with this part you didn't have issues and you were able to:

• create group
• create SP
• add SP to the group

resource "databricks_group" "group_account_level" {
      display_name               = "databricks_deployments"
      allow_cluster_create       = true
      allow_instance_pool_create = true
      workspace_access           = true
     
      provider = databricks.account_level
    }
     
    resource "databricks_service_principal" "spark_account_level" {
      display_name = "SVC_SPARK"
      provider     = databricks.account_level
    }
     
    resource "databricks_group_member" "spark_deployments" {
      group_id  = databricks_group.group_account_level.id
      member_id = databricks_service_principal.spark_account_level.id
     
      provider = databricks.account_level
    }

to be able to use the SP on the workspace level, as you have mentioned:

databricks_permissions, databricks_group_role, databrics_secret_acl you need to assign the group to the workspace, you can achieve this using `mws_permission_assignment`:

resource "databricks_mws_permission_assignment" "ws_access" {
  provider     = databricks.account_level
  workspace_id = <YOUR_WORKSPACE_ID>
  principal_id = databricks_group.group_account_level.id
  permissions  = ["USER"]
}

https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/mws_permission_a...

then you can use that group in you workspace:

resource "databricks_permissions" "this" {
  provider      = databricks.workspace
  authorization = "tokens"
  access_control {
    group_name       = databricks_group.group_account_level.display_name
    permission_level = "CAN_USE"
  }
}

thanks,

Pat.