[ISSUE] Issue with databricks_permission silently removes "tokens" permissions

[yegorski]

👋 I looked around at others issues like #2268, #2131, #2104, and #1976 but they don't quite describe my issue.

My issue is that the databricks_permissions resource removed all tokens when adding a new one when it is invoked with authorization = "tokens". The documentation warns about this behavior:

Configuring this resource for an object will OVERWRITE any existing permissions of the same type unless imported, and changes made outside of Terraform will be reset unless the changes are also reflected in the configuration.

But it would be great if the Databricks Terraform provider (we tested on 1.18.0) makes an extra DB API call to check and warn when removing tokens. Right now it silently removes previous token grants.

Configuration

For example we were unaware that we managing token permissions in 2 TF repos. This one:

resource "databricks_permissions" "token_permissions" {
  authorization = "tokens"

  access_control {
    service_principal_name = databricks_service_principal.service_account.application_id
    permission_level       = "CAN_USE"
  }
}

overrode this one:

resource "databricks_permissions" "token_permissions" {
  authorization = "tokens"

  access_control {
    group_name       = data.databricks_group.all_users.display_name
    permission_level = "CAN_USE"
  }
}

And removed token access for all our users❗

In the end we figured it out and combined them:

resource "databricks_permissions" "token_permissions" {
  authorization = "tokens"

  access_control {
    group_name       = data.databricks_group.all_users.display_name
    permission_level = "CAN_USE"
  }

  access_control {
    service_principal_name = databricks_service_principal.service_account.application_id
    permission_level       = "CAN_USE"
  }
}

Expected Behavior

databricks_permission resource warns when there are existing token permissions about to be removed.

Actual Behavior

databricks_permission resource silently removes other token permissions.

Steps to Reproduce

See Configuration section above.

[nkvuong]

There is a feature request #2395

[yegorski]

That request looks good to me, would be a satisfactory solution.

[jlakshmipathi]

@yegorski Are there any workarounds?

[yegorski]

No, not until #2395 is implemented

[alexott]

Closing in favor of #2395