feat: custom cluster policy

Author: owlleg6

main.tf

@@ -41,12 +41,24 @@ resource "azurerm_role_assignment" "this" {
   principal_id         = each.value.object_id
 }
 
+resource "databricks_cluster_policy" "this" {
+  for_each = {
+  for param in var.custom_cluster_policies : (param.name) => param.definition
+  if param.definition != null
+  }
+
+  name       = each.key
+  definition = jsonencode(each.value)
+}
+
 resource "databricks_cluster" "this" {
   cluster_name   = "shared autoscaling"
   spark_version  = var.spark_version
   spark_conf     = var.spark_conf
   spark_env_vars = var.spark_env_vars
 
+  policy_id      = one([for policy in var.custom_cluster_policies : databricks_cluster_policy.this[policy.name].id if policy.assigned])
+
   data_security_mode      = var.data_security_mode
   node_type_id            = var.node_type
   autotermination_minutes = var.autotermination_minutes

outputs.tf

@@ -7,3 +7,11 @@ output "cluster_id" {
   value       = databricks_cluster.this.id
   description = "Databricks Cluster Id"
 }
+
+output "cluster_policies_object" {
+  value = [for policy in var.custom_cluster_policies : {
+    id      = databricks_cluster_policy.this[policy.name].id
+    name    = databricks_cluster_policy.this[policy.name].name
+    can_use = policy.can_use
+  }]
+}

variables.tf

@@ -101,6 +101,32 @@ variable "permissions" {
   ]
 }
 
+variable "custom_cluster_policies" {
+  type = list(object({
+    name       = string
+    can_use    = list(string)
+    definition = any
+    assigned   = bool
+  }))
+  description = <<-EOT
+Provides an ability to create custom cluster policy, assign it to cluster and grant CAN_USE permissions on it to certain custom groups
+name - name of custom policy;
+can_use - list of string, where values are custom group names, there groups have to be created with Terraform
+definition - JSON document expressed in Databricks Policy Definition Language. No need to call 'jsonencode()' function on it when providing a value
+assigned - boolean flag which assigns policy to default 'shared autoscaling' cluster, only single custom policy could be assigned
+EOT
+  default = [{
+    name       = null
+    can_use    = null
+    definition = null
+    assigned   = null
+  }]
+  validation {
+    condition     = length([for policy in var.custom_cluster_policies : policy.assigned if policy.assigned]) <= 1
+    error_message = "Only single cluster policy assignment allowed. Please set 'assigned' parameter to 'true' for exact one or none policy"
+  }
+}
+
 variable "data_security_mode" {
   type        = string
   description = "Security features of the cluster"