[Fix] Add Sufficient Network Privileges to the Databricks Default Cross Account Policy #4027
+473
−2
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
caldempsey
requested review from
hectorcast-db
and removed request for
a team
caldempsey
changed the title
…ces, is a VPC op.
|
Thanks! |
tanmay-db
approved these changes
Oct 7, 2024
github-merge-queue bot
pushed a commit
that referenced
this pull request
Oct 7, 2024
### New Features and Improvements * Add `databricks_budget` resource ([#3955](#3955)). * Add `databricks_mlflow_models` data source ([#3874](#3874)). * Add computed attribute `table_serving_url` to `databricks_online_table` ([#4048](#4048)). * Add support for Identity Column in `databricks_sql_table` ([#4035](#4035)). ### Bug Fixes * Add Sufficient Network Privileges to the Databricks Default Cross Account Policy ([#4027](#4027)) * Ignore presence or absence of `/Workspace` prefix for dashboard resource ([#4061](#4061)). * Refactor `databricks_permissions` and allow the current user to set their own permissions ([#3956](#3956)). * Set ID for online table resource if creation succeeds but it isn't available yet ([#4072](#4072)). ### Documentation * Update CONTRIBUTING guide for plugin framework resources ([#4078](#4078)) * Add guide for OIDC authentication ([#4016](#4016)). * Correctly use native markdown callouts supported by TF Registry ([#4073](#4073)). * Fixing links to `databricks_service_principal` in TF guides ([#4020](#4020)). ### Internal Changes * Fix Permissions Dashboard Test ([#4071](#4071)). * Bump Go SDK to latest and generate TF structs ([#4062](#4062)). * Skip Budget tests on GCP ([#4070](#4070)). * Update to latest OpenAPI spec and bump Go SDK ([#4069](#4069)).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
Currently, the Databricks-provided Cross Account Policy IAM Role does not include all the necessary permissions to set up a workspace. Attempting to set up a workspace using this policy results in the following error (see Issue #4026):
This makes it difficult for new engineers to onboard to Databricks without troubleshooting unexpected errors. This PR adds the missing network permissions to the Databricks Managed VPC policy types ("managed" and "customer"), ensuring that all required permissions are included for successful workspace deployment. These changes are not applied to the "restricted" policy type to avoid allowing Elastic IP allocations, which may not be desirable for some Databricks customers. See the bottom of the description for the full list.
Tests
This change has been tested locally and is running in our staging workspace using the same configuration. As this is a fix for 'managed' type Databricks deployment configurations, I have matched this with positive and negative unit tests to guard precise and expected roles. I have then added extra tests to confirm the expected policies across each branch, 'managed', 'customer', and 'restricted'. Feel free to remove these if overboard, as I recognise you could make a similar weaker assertion using 'len'.
make testrun locallydocs/folder (if necessary)internal/acceptanceThe full list of permissions which align with the Databricks documentation, now included in the "managed" policy type, are:
Resolves #4026