@pulumi/databricks 0.0.1-alpha.1648473134

package/mwsCredentials.js

@@ -0,0 +1,115 @@
+"use strict";
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MwsCredentials = void 0;
+const pulumi = require("@pulumi/pulumi");
+const utilities = require("./utilities");
+/**
+ * ## Example Usage
+ *
+ * > **Note** This resource has an evolving API, which may change in future versions of the provider.
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ * import * as databricks from "@pulumi/databricks";
+ *
+ * const config = new pulumi.Config();
+ * const databricksAccountId = config.requireObject("databricksAccountId");
+ * const thisAwsAssumeRolePolicy = databricks.getAwsAssumeRolePolicy({
+ *     externalId: databricksAccountId,
+ * });
+ * const crossAccountRole = new aws.iam.Role("crossAccountRole", {
+ *     assumeRolePolicy: thisAwsAssumeRolePolicy.then(thisAwsAssumeRolePolicy => thisAwsAssumeRolePolicy.json),
+ *     tags: _var.tags,
+ * });
+ * const thisAwsCrossAccountPolicy = databricks.getAwsCrossAccountPolicy({});
+ * const thisRolePolicy = new aws.iam.RolePolicy("thisRolePolicy", {
+ *     role: crossAccountRole.id,
+ *     policy: thisAwsCrossAccountPolicy.then(thisAwsCrossAccountPolicy => thisAwsCrossAccountPolicy.json),
+ * });
+ * const thisMwsCredentials = new databricks.MwsCredentials("thisMwsCredentials", {
+ *     accountId: databricksAccountId,
+ *     credentialsName: `${local.prefix}-creds`,
+ *     roleArn: crossAccountRole.arn,
+ * }, {
+ *     provider: databricks.mws,
+ * });
+ * ```
+ * ## Related Resources
+ *
+ * The following resources are used in the same context:
+ *
+ * * Provisioning Databricks on AWS guide.
+ * * databricks.MwsCustomerManagedKeys to configure KMS keys for new workspaces within AWS.
+ * * databricks.MwsLogDelivery to configure delivery of [billable usage logs](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html) and [audit logs](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html).
+ * * databricks.MwsNetworks to [configure VPC](https://docs.databricks.com/administration-guide/cloud-configurations/aws/customer-managed-vpc.html) & subnets for new workspaces within AWS.
+ * * databricks.MwsStorageConfigurations to configure root bucket new workspaces within AWS.
+ * * databricks.MwsWorkspaces to set up [workspaces in E2 architecture on AWS](https://docs.databricks.com/getting-started/overview.html#e2-architecture-1).
+ *
+ * ## Import
+ *
+ * -> **Note** Importing this resource is not currently supported.
+ */
+class MwsCredentials extends pulumi.CustomResource {
+    constructor(name, argsOrState, opts) {
+        let resourceInputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState;
+            resourceInputs["accountId"] = state ? state.accountId : undefined;
+            resourceInputs["creationTime"] = state ? state.creationTime : undefined;
+            resourceInputs["credentialsId"] = state ? state.credentialsId : undefined;
+            resourceInputs["credentialsName"] = state ? state.credentialsName : undefined;
+            resourceInputs["externalId"] = state ? state.externalId : undefined;
+            resourceInputs["roleArn"] = state ? state.roleArn : undefined;
+        }
+        else {
+            const args = argsOrState;
+            if ((!args || args.accountId === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'accountId'");
+            }
+            if ((!args || args.credentialsName === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'credentialsName'");
+            }
+            if ((!args || args.roleArn === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'roleArn'");
+            }
+            resourceInputs["accountId"] = args ? args.accountId : undefined;
+            resourceInputs["credentialsName"] = args ? args.credentialsName : undefined;
+            resourceInputs["roleArn"] = args ? args.roleArn : undefined;
+            resourceInputs["creationTime"] = undefined /*out*/;
+            resourceInputs["credentialsId"] = undefined /*out*/;
+            resourceInputs["externalId"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(MwsCredentials.__pulumiType, name, resourceInputs, opts);
+    }
+    /**
+     * Get an existing MwsCredentials resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name, id, state, opts) {
+        return new MwsCredentials(name, state, Object.assign(Object.assign({}, opts), { id: id }));
+    }
+    /**
+     * Returns true if the given object is an instance of MwsCredentials.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === MwsCredentials.__pulumiType;
+    }
+}
+exports.MwsCredentials = MwsCredentials;
+/** @internal */
+MwsCredentials.__pulumiType = 'databricks:index/mwsCredentials:MwsCredentials';
+//# sourceMappingURL=mwsCredentials.js.map

package/mwsCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mwsCredentials.js","sourceRoot":"","sources":["../mwsCredentials.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAa,cAAe,SAAQ,MAAM,CAAC,cAAc;IA0DrD,YAAY,IAAY,EAAE,WAAsD,EAAE,IAAmC;QACjH,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAA8C,CAAC;YAC7D,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,cAAc,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,cAAc,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;SACjE;aAAM;YACH,MAAM,IAAI,GAAG,WAA6C,CAAC;YAC3D,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACtD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;aAC5D;YACD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;aAClE;YACD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;aAC1D;YACD,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACpD,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACpD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAxFD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAA2B,EAAE,IAAmC;QACzH,OAAO,IAAI,cAAc,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IACrE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,cAAc,CAAC,YAAY,CAAC;IAC/D,CAAC;;AA1BL,wCA0FC;AA5EG,gBAAgB;AACO,2BAAY,GAAG,gDAAgD,CAAC"}

package/mwsCustomerManagedKeys.d.ts

@@ -0,0 +1,257 @@
+import * as pulumi from "@pulumi/pulumi";
+import { input as inputs, output as outputs } from "./types";
+/**
+ * ## Example Usage
+ *
+ * > **Note** If you've used the resource before, please add `useCases = ["MANAGED_SERVICES"]` to keep the previous behaviour.
+ * ### Customer-managed key for managed services
+ *
+ * You must configure this during workspace creation
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ * import * as databricks from "@pulumi/databricks";
+ *
+ * const config = new pulumi.Config();
+ * const databricksAccountId = config.requireObject("databricksAccountId");
+ * const databricksManagedServicesCmk = aws.iam.getPolicyDocument({
+ *     version: "2012-10-17",
+ *     statements: [
+ *         {
+ *             sid: "Enable IAM User Permissions",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: ["*"],
+ *             }],
+ *             actions: ["kms:*"],
+ *             resources: ["*"],
+ *         },
+ *         {
+ *             sid: "Allow Databricks to use KMS key for control plane managed services",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: ["arn:aws:iam::414351767826:root"],
+ *             }],
+ *             actions: [
+ *                 "kms:Encrypt",
+ *                 "kms:Decrypt",
+ *             ],
+ *             resources: ["*"],
+ *         },
+ *     ],
+ * });
+ * const managedServicesCustomerManagedKey = new aws.kms.Key("managedServicesCustomerManagedKey", {policy: databricksManagedServicesCmk.then(databricksManagedServicesCmk => databricksManagedServicesCmk.json)});
+ * const managedServicesCustomerManagedKeyAlias = new aws.kms.Alias("managedServicesCustomerManagedKeyAlias", {targetKeyId: managedServicesCustomerManagedKey.keyId});
+ * const managedServices = new databricks.MwsCustomerManagedKeys("managedServices", {
+ *     accountId: databricksAccountId,
+ *     awsKeyInfo: {
+ *         keyArn: managedServicesCustomerManagedKey.arn,
+ *         keyAlias: managedServicesCustomerManagedKeyAlias.name,
+ *     },
+ *     useCases: ["MANAGED_SERVICES"],
+ * });
+ * ```
+ * ### Customer-managed key for workspace storage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ * import * as databricks from "@pulumi/databricks";
+ *
+ * const config = new pulumi.Config();
+ * const databricksAccountId = config.requireObject("databricksAccountId");
+ * const databricksCrossAccountRole = config.requireObject("databricksCrossAccountRole");
+ * const databricksStorageCmk = aws.iam.getPolicyDocument({
+ *     version: "2012-10-17",
+ *     statements: [
+ *         {
+ *             sid: "Enable IAM User Permissions",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: ["*"],
+ *             }],
+ *             actions: ["kms:*"],
+ *             resources: ["*"],
+ *         },
+ *         {
+ *             sid: "Allow Databricks to use KMS key for DBFS",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: ["arn:aws:iam::414351767826:root"],
+ *             }],
+ *             actions: [
+ *                 "kms:Encrypt",
+ *                 "kms:Decrypt",
+ *                 "kms:ReEncrypt*",
+ *                 "kms:GenerateDataKey*",
+ *                 "kms:DescribeKey",
+ *             ],
+ *             resources: ["*"],
+ *         },
+ *         {
+ *             sid: "Allow Databricks to use KMS key for DBFS (Grants)",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: ["arn:aws:iam::414351767826:root"],
+ *             }],
+ *             actions: [
+ *                 "kms:CreateGrant",
+ *                 "kms:ListGrants",
+ *                 "kms:RevokeGrant",
+ *             ],
+ *             resources: ["*"],
+ *             conditions: [{
+ *                 test: "Bool",
+ *                 variable: "kms:GrantIsForAWSResource",
+ *                 values: ["true"],
+ *             }],
+ *         },
+ *         {
+ *             sid: "Allow Databricks to use KMS key for EBS",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: [databricksCrossAccountRole],
+ *             }],
+ *             actions: [
+ *                 "kms:Decrypt",
+ *                 "kms:GenerateDataKey*",
+ *                 "kms:CreateGrant",
+ *                 "kms:DescribeKey",
+ *             ],
+ *             resources: ["*"],
+ *             conditions: [{
+ *                 test: "ForAnyValue:StringLike",
+ *                 variable: "kms:ViaService",
+ *                 values: ["ec2.*.amazonaws.com"],
+ *             }],
+ *         },
+ *     ],
+ * });
+ * const storageCustomerManagedKey = new aws.kms.Key("storageCustomerManagedKey", {policy: databricksStorageCmk.then(databricksStorageCmk => databricksStorageCmk.json)});
+ * const storageCustomerManagedKeyAlias = new aws.kms.Alias("storageCustomerManagedKeyAlias", {targetKeyId: storageCustomerManagedKey.keyId});
+ * const storage = new databricks.MwsCustomerManagedKeys("storage", {
+ *     accountId: databricksAccountId,
+ *     awsKeyInfo: {
+ *         keyArn: storageCustomerManagedKey.arn,
+ *         keyAlias: storageCustomerManagedKeyAlias.name,
+ *     },
+ *     useCases: ["STORAGE"],
+ * });
+ * ```
+ * ## Related Resources
+ *
+ * The following resources are used in the same context:
+ *
+ * * Provisioning Databricks on AWS guide.
+ * * databricks.MwsCredentials to configure the cross-account role for creation of new workspaces within AWS.
+ * * databricks.MwsLogDelivery to configure delivery of [billable usage logs](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html) and [audit logs](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html).
+ * * databricks.MwsNetworks to [configure VPC](https://docs.databricks.com/administration-guide/cloud-configurations/aws/customer-managed-vpc.html) & subnets for new workspaces within AWS.
+ * * databricks.MwsStorageConfigurations to configure root bucket new workspaces within AWS.
+ * * databricks.MwsWorkspaces to set up [workspaces in E2 architecture on AWS](https://docs.databricks.com/getting-started/overview.html#e2-architecture-1).
+ *
+ * ## Import
+ *
+ * -> **Note** Importing this resource is not currently supported.
+ */
+export declare class MwsCustomerManagedKeys extends pulumi.CustomResource {
+    /**
+     * Get an existing MwsCustomerManagedKeys resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: MwsCustomerManagedKeysState, opts?: pulumi.CustomResourceOptions): MwsCustomerManagedKeys;
+    /**
+     * Returns true if the given object is an instance of MwsCustomerManagedKeys.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj: any): obj is MwsCustomerManagedKeys;
+    /**
+     * Account Id that could be found in the bottom left corner of [Accounts Console](https://accounts.cloud.databricks.com/)
+     */
+    readonly accountId: pulumi.Output<string>;
+    /**
+     * This field is a block and is documented below.
+     */
+    readonly awsKeyInfo: pulumi.Output<outputs.MwsCustomerManagedKeysAwsKeyInfo>;
+    /**
+     * (Integer) Time in epoch milliseconds when the customer key was created.
+     */
+    readonly creationTime: pulumi.Output<number>;
+    /**
+     * (String) ID of the encryption key configuration object.
+     */
+    readonly customerManagedKeyId: pulumi.Output<string>;
+    /**
+     * *(since v0.3.4)* List of use cases for which this key will be used. *If you've used the resource before, please add `useCases = ["MANAGED_SERVICES"]` to keep the previous behaviour.* Possible values are:
+     */
+    readonly useCases: pulumi.Output<string[]>;
+    /**
+     * Create a MwsCustomerManagedKeys resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: MwsCustomerManagedKeysArgs, opts?: pulumi.CustomResourceOptions);
+}
+/**
+ * Input properties used for looking up and filtering MwsCustomerManagedKeys resources.
+ */
+export interface MwsCustomerManagedKeysState {
+    /**
+     * Account Id that could be found in the bottom left corner of [Accounts Console](https://accounts.cloud.databricks.com/)
+     */
+    accountId?: pulumi.Input<string>;
+    /**
+     * This field is a block and is documented below.
+     */
+    awsKeyInfo?: pulumi.Input<inputs.MwsCustomerManagedKeysAwsKeyInfo>;
+    /**
+     * (Integer) Time in epoch milliseconds when the customer key was created.
+     */
+    creationTime?: pulumi.Input<number>;
+    /**
+     * (String) ID of the encryption key configuration object.
+     */
+    customerManagedKeyId?: pulumi.Input<string>;
+    /**
+     * *(since v0.3.4)* List of use cases for which this key will be used. *If you've used the resource before, please add `useCases = ["MANAGED_SERVICES"]` to keep the previous behaviour.* Possible values are:
+     */
+    useCases?: pulumi.Input<pulumi.Input<string>[]>;
+}
+/**
+ * The set of arguments for constructing a MwsCustomerManagedKeys resource.
+ */
+export interface MwsCustomerManagedKeysArgs {
+    /**
+     * Account Id that could be found in the bottom left corner of [Accounts Console](https://accounts.cloud.databricks.com/)
+     */
+    accountId: pulumi.Input<string>;
+    /**
+     * This field is a block and is documented below.
+     */
+    awsKeyInfo: pulumi.Input<inputs.MwsCustomerManagedKeysAwsKeyInfo>;
+    /**
+     * (Integer) Time in epoch milliseconds when the customer key was created.
+     */
+    creationTime?: pulumi.Input<number>;
+    /**
+     * (String) ID of the encryption key configuration object.
+     */
+    customerManagedKeyId?: pulumi.Input<string>;
+    /**
+     * *(since v0.3.4)* List of use cases for which this key will be used. *If you've used the resource before, please add `useCases = ["MANAGED_SERVICES"]` to keep the previous behaviour.* Possible values are:
+     */
+    useCases: pulumi.Input<pulumi.Input<string>[]>;
+}

package/mwsCustomerManagedKeys.js

@@ -0,0 +1,226 @@
+"use strict";
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MwsCustomerManagedKeys = void 0;
+const pulumi = require("@pulumi/pulumi");
+const utilities = require("./utilities");
+/**
+ * ## Example Usage
+ *
+ * > **Note** If you've used the resource before, please add `useCases = ["MANAGED_SERVICES"]` to keep the previous behaviour.
+ * ### Customer-managed key for managed services
+ *
+ * You must configure this during workspace creation
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ * import * as databricks from "@pulumi/databricks";
+ *
+ * const config = new pulumi.Config();
+ * const databricksAccountId = config.requireObject("databricksAccountId");
+ * const databricksManagedServicesCmk = aws.iam.getPolicyDocument({
+ *     version: "2012-10-17",
+ *     statements: [
+ *         {
+ *             sid: "Enable IAM User Permissions",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: ["*"],
+ *             }],
+ *             actions: ["kms:*"],
+ *             resources: ["*"],
+ *         },
+ *         {
+ *             sid: "Allow Databricks to use KMS key for control plane managed services",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: ["arn:aws:iam::414351767826:root"],
+ *             }],
+ *             actions: [
+ *                 "kms:Encrypt",
+ *                 "kms:Decrypt",
+ *             ],
+ *             resources: ["*"],
+ *         },
+ *     ],
+ * });
+ * const managedServicesCustomerManagedKey = new aws.kms.Key("managedServicesCustomerManagedKey", {policy: databricksManagedServicesCmk.then(databricksManagedServicesCmk => databricksManagedServicesCmk.json)});
+ * const managedServicesCustomerManagedKeyAlias = new aws.kms.Alias("managedServicesCustomerManagedKeyAlias", {targetKeyId: managedServicesCustomerManagedKey.keyId});
+ * const managedServices = new databricks.MwsCustomerManagedKeys("managedServices", {
+ *     accountId: databricksAccountId,
+ *     awsKeyInfo: {
+ *         keyArn: managedServicesCustomerManagedKey.arn,
+ *         keyAlias: managedServicesCustomerManagedKeyAlias.name,
+ *     },
+ *     useCases: ["MANAGED_SERVICES"],
+ * });
+ * ```
+ * ### Customer-managed key for workspace storage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ * import * as databricks from "@pulumi/databricks";
+ *
+ * const config = new pulumi.Config();
+ * const databricksAccountId = config.requireObject("databricksAccountId");
+ * const databricksCrossAccountRole = config.requireObject("databricksCrossAccountRole");
+ * const databricksStorageCmk = aws.iam.getPolicyDocument({
+ *     version: "2012-10-17",
+ *     statements: [
+ *         {
+ *             sid: "Enable IAM User Permissions",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: ["*"],
+ *             }],
+ *             actions: ["kms:*"],
+ *             resources: ["*"],
+ *         },
+ *         {
+ *             sid: "Allow Databricks to use KMS key for DBFS",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: ["arn:aws:iam::414351767826:root"],
+ *             }],
+ *             actions: [
+ *                 "kms:Encrypt",
+ *                 "kms:Decrypt",
+ *                 "kms:ReEncrypt*",
+ *                 "kms:GenerateDataKey*",
+ *                 "kms:DescribeKey",
+ *             ],
+ *             resources: ["*"],
+ *         },
+ *         {
+ *             sid: "Allow Databricks to use KMS key for DBFS (Grants)",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: ["arn:aws:iam::414351767826:root"],
+ *             }],
+ *             actions: [
+ *                 "kms:CreateGrant",
+ *                 "kms:ListGrants",
+ *                 "kms:RevokeGrant",
+ *             ],
+ *             resources: ["*"],
+ *             conditions: [{
+ *                 test: "Bool",
+ *                 variable: "kms:GrantIsForAWSResource",
+ *                 values: ["true"],
+ *             }],
+ *         },
+ *         {
+ *             sid: "Allow Databricks to use KMS key for EBS",
+ *             effect: "Allow",
+ *             principals: [{
+ *                 type: "AWS",
+ *                 identifiers: [databricksCrossAccountRole],
+ *             }],
+ *             actions: [
+ *                 "kms:Decrypt",
+ *                 "kms:GenerateDataKey*",
+ *                 "kms:CreateGrant",
+ *                 "kms:DescribeKey",
+ *             ],
+ *             resources: ["*"],
+ *             conditions: [{
+ *                 test: "ForAnyValue:StringLike",
+ *                 variable: "kms:ViaService",
+ *                 values: ["ec2.*.amazonaws.com"],
+ *             }],
+ *         },
+ *     ],
+ * });
+ * const storageCustomerManagedKey = new aws.kms.Key("storageCustomerManagedKey", {policy: databricksStorageCmk.then(databricksStorageCmk => databricksStorageCmk.json)});
+ * const storageCustomerManagedKeyAlias = new aws.kms.Alias("storageCustomerManagedKeyAlias", {targetKeyId: storageCustomerManagedKey.keyId});
+ * const storage = new databricks.MwsCustomerManagedKeys("storage", {
+ *     accountId: databricksAccountId,
+ *     awsKeyInfo: {
+ *         keyArn: storageCustomerManagedKey.arn,
+ *         keyAlias: storageCustomerManagedKeyAlias.name,
+ *     },
+ *     useCases: ["STORAGE"],
+ * });
+ * ```
+ * ## Related Resources
+ *
+ * The following resources are used in the same context:
+ *
+ * * Provisioning Databricks on AWS guide.
+ * * databricks.MwsCredentials to configure the cross-account role for creation of new workspaces within AWS.
+ * * databricks.MwsLogDelivery to configure delivery of [billable usage logs](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html) and [audit logs](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html).
+ * * databricks.MwsNetworks to [configure VPC](https://docs.databricks.com/administration-guide/cloud-configurations/aws/customer-managed-vpc.html) & subnets for new workspaces within AWS.
+ * * databricks.MwsStorageConfigurations to configure root bucket new workspaces within AWS.
+ * * databricks.MwsWorkspaces to set up [workspaces in E2 architecture on AWS](https://docs.databricks.com/getting-started/overview.html#e2-architecture-1).
+ *
+ * ## Import
+ *
+ * -> **Note** Importing this resource is not currently supported.
+ */
+class MwsCustomerManagedKeys extends pulumi.CustomResource {
+    constructor(name, argsOrState, opts) {
+        let resourceInputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState;
+            resourceInputs["accountId"] = state ? state.accountId : undefined;
+            resourceInputs["awsKeyInfo"] = state ? state.awsKeyInfo : undefined;
+            resourceInputs["creationTime"] = state ? state.creationTime : undefined;
+            resourceInputs["customerManagedKeyId"] = state ? state.customerManagedKeyId : undefined;
+            resourceInputs["useCases"] = state ? state.useCases : undefined;
+        }
+        else {
+            const args = argsOrState;
+            if ((!args || args.accountId === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'accountId'");
+            }
+            if ((!args || args.awsKeyInfo === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'awsKeyInfo'");
+            }
+            if ((!args || args.useCases === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'useCases'");
+            }
+            resourceInputs["accountId"] = args ? args.accountId : undefined;
+            resourceInputs["awsKeyInfo"] = args ? args.awsKeyInfo : undefined;
+            resourceInputs["creationTime"] = args ? args.creationTime : undefined;
+            resourceInputs["customerManagedKeyId"] = args ? args.customerManagedKeyId : undefined;
+            resourceInputs["useCases"] = args ? args.useCases : undefined;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(MwsCustomerManagedKeys.__pulumiType, name, resourceInputs, opts);
+    }
+    /**
+     * Get an existing MwsCustomerManagedKeys resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name, id, state, opts) {
+        return new MwsCustomerManagedKeys(name, state, Object.assign(Object.assign({}, opts), { id: id }));
+    }
+    /**
+     * Returns true if the given object is an instance of MwsCustomerManagedKeys.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === MwsCustomerManagedKeys.__pulumiType;
+    }
+}
+exports.MwsCustomerManagedKeys = MwsCustomerManagedKeys;
+/** @internal */
+MwsCustomerManagedKeys.__pulumiType = 'databricks:index/mwsCustomerManagedKeys:MwsCustomerManagedKeys';
+//# sourceMappingURL=mwsCustomerManagedKeys.js.map

package/mwsCustomerManagedKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mwsCustomerManagedKeys.js","sourceRoot":"","sources":["../mwsCustomerManagedKeys.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AAEzC,yCAAyC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+JG;AACH,MAAa,sBAAuB,SAAQ,MAAM,CAAC,cAAc;IAyD7D,YAAY,IAAY,EAAE,WAAsE,EAAE,IAAmC;QACjI,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAAsD,CAAC;YACrE,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,cAAc,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;SACnE;aAAM;YACH,MAAM,IAAI,GAAG,WAAqD,CAAC;YACnE,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACtD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;aAC5D;YACD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACvD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;aAC7D;YACD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;aAC3D;YACD,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,cAAc,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;SACjE;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;IArFD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAmC,EAAE,IAAmC;QACjI,OAAO,IAAI,sBAAsB,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IAC7E,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,sBAAsB,CAAC,YAAY,CAAC;IACvE,CAAC;;AA1BL,wDAuFC;AAzEG,gBAAgB;AACO,mCAAY,GAAG,gEAAgE,CAAC"}