[ISSUE] Issue with databricks_grants resource

[beszabo-hiya]

Configuration

resource "databricks_grants" "catalog_access" {
  catalog = element(split(".", var.schema), 0)
  grant {
    principal  = "principal-1"
    privileges = ["USE_CATALOG"]
  }
  grant {
    principal  = "principal-1-ro"
    privileges = ["USE_CATALOG"]
  }
}

resource "databricks_grants" "catalog_access_princ2" {
  catalog = element(split(".", var.schema), 0)
  grant {
    principal  = "principal-2"
    privileges = ["USE_CATALOG"]
  }
  grant {
    principal  = "principal-2-ro"
    privileges = ["USE_CATALOG"]
  }
}

Expected Behavior

After the first apply, no changes should take place

Actual Behavior

Running apply multiple times gives different results

Steps to Reproduce

1. terraform apply-->
2. terraform apply-->
3. terraform apply-->

Terraform and provider versions

Latest

Issue description

First run of terraform apply

  # module.permission_grants_princ1_ro.databricks_grants.catalog_access will be created
  + resource "databricks_grants" "catalog_access" {
      + catalog = "datalake"
      + id      = (known after apply)

      + grant {
          + principal  = "principal-1"
          + privileges = [
              + "USE_CATALOG",
            ]
        }
      + grant {
          + principal  = "principal-1-ro"
          + privileges = [
              + "USE_CATALOG",
            ]
        }
    }

  # module.permission_grants_princ1_ro.databricks_grants.catalog_access_princ2 will be created
  + resource "databricks_grants" "catalog_access_princ2" {
      + catalog = "datalake"
      + id      = (known after apply)

      + grant {
          + principal  = "principal-2"
          + privileges = [
              + "USE_CATALOG",
            ]
        }
      + grant {
          + principal  = "principal-2-ro"
          + privileges = [
              + "USE_CATALOG",
            ]
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

After running this see both princ1, princ1-ro, princ2, princ2-ro on the grants page of the Catalog. Which is the expected behaviour

Second run of terraform apply. No code changes were made.

  # module.permission_grants_princ1_ro.databricks_grants.catalog_access will be updated in-place
  ~ resource "databricks_grants" "catalog_access" {
        id      = "catalog/datalake"
        # (1 unchanged attribute hidden)

      - grant {
          - principal  = "principal-2" -> null
          - privileges = [
              - "USE_CATALOG",
            ] -> null
        }
      - grant {
          - principal  = "principal-2-ro" -> null
          - privileges = [
              - "USE_CATALOG",
            ] -> null
        }

        # (2 unchanged blocks hidden)
    }

  # module.permission_grants_princ1_ro.databricks_grants.catalog_access_princ2 will be updated in-place
  ~ resource "databricks_grants" "catalog_access_princ2" {
        id      = "catalog/datalake"
        # (1 unchanged attribute hidden)

      - grant {
          - principal  = "principal-1" -> null
          - privileges = [
              - "USE_CATALOG",
            ] -> null
        }
      - grant {
          - principal  = "principal-1-ro" -> null
          - privileges = [
              - "USE_CATALOG",
            ] -> null
        }

        # (2 unchanged blocks hidden)
    }

After applying i got the error:
Error: cannot read grants: got empty permissions list.
Also deleted all the grants from the Catalog.

3rd apply

  # module.permission_grants_princ1_ro.databricks_grants.catalog_access will be created
  + resource "databricks_grants" "catalog_access" {
      + catalog = "datalake"
      + id      = (known after apply)

      + grant {
          + principal  = "principal-1"
          + privileges = [
              + "USE_CATALOG",
            ]
        }
      + grant {
          + principal  = "principal-1-ro"
          + privileges = [
              + "USE_CATALOG",
            ]
        }
    }

  # module.permission_grants_princ1_ro.databricks_grants.catalog_access_princ2 will be created
  + resource "databricks_grants" "catalog_access_princ2" {
      + catalog = "datalake"
      + id      = (known after apply)

      + grant {
          + principal  = "principal-2"
          + privileges = [
              + "USE_CATALOG",
            ]
        }
      + grant {
          + principal  = "principal-2-ro"
          + privileges = [
              + "USE_CATALOG",
            ]
        }
    }

After applying everything is there again.

[nkvuong]

@beszabo-hiya this is spelled out in the doc - https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/grants

It is required to define all permissions for a securable in a single resource, otherwise Terraform cannot guarantee config drift prevention.

[scheleaap]

See also #1976