Added `databricks_mws_permission_assignment` resource #1491

nfx · 2022-07-21T22:25:12Z

databricks_mws_permission_assignment Resource

These resources are invoked in the account context. Provider must have account_id attribute configured.

Example Usage

In account context, adding account-level group to a workspace:

provider "databricks" {
  // <other properties>
  account_id = "<databricks account id>"
}

resource "databricks_group" "data_eng" {
  display_name = "Data Engineering"
}

resource "databricks_mws_permission_assignment" "add_admin_group" {
  workspace_id = databricks_mws_workspaces.this.workspace_id
  principal_id = databricks_group.data_eng.id
  permissions  = ["ADMIN"]
}

In account context, adding account-level user to a workspace:

provider "databricks" {
  // <other properties>
  account_id = "<databricks account id>"
}

resource "databricks_user" "me" {
  user_name = "me@example.com"
}

resource "databricks_mws_permission_assignment" "add_user" {
  workspace_id = databricks_mws_workspaces.this.workspace_id
  principal_id = databricks_user.me.id
  permissions  = ["USER"]
}

In account context, adding account-level service principal to a workspace:

provider "databricks" {
  // <other properties>
  account_id = "<databricks account id>"
}

resource "databricks_service_principal" "sp" {
  display_name = "Automation-only SP"
}

resource "databricks_mws_permission_assignment" "add_admin_spn" {
  workspace_id = databricks_mws_workspaces.this.workspace_id
  principal_id = databricks_service_principal.sp.id
  permissions  = ["ADMIN"]
}

Fix #1458

codecov-commenter · 2022-07-21T22:54:08Z

Codecov Report

Merging #1491 (7f689f0) into master (c72250b) will decrease coverage by 0.34%.
The diff coverage is 60.46%.

@@            Coverage Diff             @@
##           master    #1491      +/-   ##
==========================================
- Coverage   90.13%   89.79%   -0.35%     
==========================================
  Files         130      132       +2     
  Lines       10434    10551     +117     
==========================================
+ Hits         9405     9474      +69     
- Misses        658      704      +46     
- Partials      371      373       +2

Impacted Files	Coverage Δ
access/resource_permissionassignment.go	`0.00% <0.00%> (ø)`
internal/acceptance/acceptance.go	`0.00% <0.00%> (ø)`
common/pair.go	`93.10% <63.63%> (-3.33%)`	⬇️
qa/testing.go	`81.04% <75.00%> (-0.17%)`	⬇️
mws/resource_mws_permission_assignment.go	`96.92% <96.92%> (ø)`
catalog/resource_metastore_assignment.go	`95.23% <100.00%> (+0.23%)`	⬆️
provider/provider.go	`95.17% <100.00%> (+0.06%)`	⬆️

alexott · 2022-07-22T06:11:11Z

Is it only for MWS, or it covers all clouds? can we also change name to databricks_mws_permission_assignment - it's easier to read

docs/resources/permissionassignment.md

access/resource_permissionassignment.go

mws/resource_mws_permission_assignment.go

rohitgupta10 · 2022-08-01T22:15:42Z

docs/resources/mws_permission_assignment.md

+In account context, adding account-level group to a workspace:
+


I see that we only have docs for updating role assignment in the account context. I think thats fine and sufficient but it will not work for workspace admin personas who are not account admins.

yes, we'll add that "workspace level account scim user listing" in one of the following releases.

baishen-db

Overall LGTM. I'm very new to terraform so will defer to Rohit to do another round of review

baishen-db · 2022-08-02T00:47:19Z

docs/resources/mws_permission_assignment.md

+---
+# databricks_mws_permission_assignment Resource
+
+These resources are invoked in the account context. Provider must have `account_id` attribute configured.


+1 will there be a documentation for access/permission_assignment? For that one API doesn't need workspace id or account id, they can be derived from the workspace url.

we don't have a way to retrieve account-level IDs from workspace in the provider yet. please "publish" the api ;)

docs/resources/mws_permission_assignment.md

baishen-db · 2022-08-02T00:52:53Z

mws/acceptance/mws_permissionassignments_test.go

+ "github.com/databricks/terraform-provider-databricks/qa"
+)
+
+func TestAccAssignGroupToWorkspace(t *testing.T) {


Just curious, what does this test do? Does it test that the template can be accepted?

it does create, read, update, and delete test assignments of test principals

baishen-db · 2022-08-02T00:54:44Z

mws/resource_mws_permission_assignment_test.go

+ Read: true,
+ Removed: true,
+ AccountID: "abc",
+ ID: "123|456",


What does this ID mean?

https://youtu.be/HE3eAMrVnXY?t=414

mws/resource_mws_permission_assignment_test.go

baishen-db · 2022-08-02T00:58:44Z

mws/resource_mws_permission_assignment_test.go

+ qa.CornerCaseAccountID("abc"))
+}
+
+func TestPermssionAssignmentFuzz_ApiErrors(t *testing.T) {


How does this test work? Do we need to verify that API errors are properly handled?

yes. it does some fuzzing. see CONTRIBUTING.md for details

Fix #1458

nfx

👍

These resources are invoked in the account context. Provider must have `account_id` attribute configured. Example usage in account context, adding account-level group to a workspace: ```hcl provider "databricks" { // <other properties> account_id = "<databricks account id>" } resource "databricks_group" "data_eng" { display_name = "Data Engineering" } resource "databricks_mws_permission_assignment" "add_admin_group" { workspace_id = databricks_mws_workspaces.this.workspace_id principal_id = databricks_group.data_eng.id permissions = ["ADMIN"] } ```

nfx requested a review from rohitgupta10 July 21, 2022 22:25

nfx changed the title ~~Added databricks_mws_permissionassignments resource~~ Added databricks_mws_permissionassignment resource Jul 21, 2022

smiralshah requested a review from baishen-db July 26, 2022 17:21

rohitgupta10 reviewed Jul 26, 2022

View reviewed changes

docs/resources/permissionassignment.md Outdated Show resolved Hide resolved

rohitgupta10 reviewed Jul 26, 2022

View reviewed changes

docs/resources/permissionassignment.md Outdated Show resolved Hide resolved

nfx force-pushed the feature/identity-federation branch 2 times, most recently from f6844bf to 58dbcc0 Compare July 28, 2022 19:34

nfx changed the title ~~Added databricks_mws_permissionassignment resource~~ Added databricks_mws_permission_assignment resource Jul 28, 2022

nfx requested a review from rohitgupta10 July 28, 2022 19:41

rohitgupta10 reviewed Aug 1, 2022

View reviewed changes

access/resource_permissionassignment.go Outdated Show resolved Hide resolved

rohitgupta10 reviewed Aug 1, 2022

View reviewed changes

mws/resource_mws_permission_assignment.go Show resolved Hide resolved

rohitgupta10 reviewed Aug 1, 2022

View reviewed changes

baishen-db reviewed Aug 2, 2022

View reviewed changes

nfx added 7 commits August 4, 2022 16:26

Added databricks_mws_permissionassignments resource

503fb85

Fix #1458

Added databricks_permissionassignment resource

7696fe7

make fmt-docs

68f3690

add tests

9298ffd

add tests

a62a4fd

Removing doc for workspace-level resource for now

0a28533

added more coverage and fixed minor issues

06cae22

nfx force-pushed the feature/identity-federation branch from 7f689f0 to 06cae22 Compare August 4, 2022 14:55

nfx commented Aug 4, 2022

View reviewed changes

nfx merged commit b72863a into master Aug 4, 2022

nfx deleted the feature/identity-federation branch August 4, 2022 15:01

nfx mentioned this pull request Aug 4, 2022

Release v1.2.0 #1519

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added `databricks_mws_permission_assignment` resource #1491

Added `databricks_mws_permission_assignment` resource #1491

nfx commented Jul 21, 2022 •

edited

Loading

codecov-commenter commented Jul 21, 2022 •

edited

Loading

alexott commented Jul 22, 2022

rohitgupta10 Aug 1, 2022

nfx Aug 4, 2022

baishen-db left a comment

baishen-db Aug 2, 2022

nfx Aug 4, 2022

baishen-db Aug 2, 2022

nfx Aug 4, 2022

baishen-db Aug 2, 2022

nfx Aug 4, 2022

baishen-db Aug 2, 2022

nfx Aug 4, 2022

nfx left a comment

Added databricks_mws_permission_assignment resource #1491

Added databricks_mws_permission_assignment resource #1491

Conversation

nfx commented Jul 21, 2022 • edited Loading

databricks_mws_permission_assignment Resource

Example Usage

codecov-commenter commented Jul 21, 2022 • edited Loading

Codecov Report

alexott commented Jul 22, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

baishen-db left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nfx left a comment

Choose a reason for hiding this comment

Added `databricks_mws_permission_assignment` resource #1491

Added `databricks_mws_permission_assignment` resource #1491

nfx commented Jul 21, 2022 •

edited

Loading

codecov-commenter commented Jul 21, 2022 •

edited

Loading