pulumi-databricks 1.78.0a1762407761__py3-none-any.whl → 1.79.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (86) hide show
  1. pulumi_databricks/__init__.py +23 -0
  2. pulumi_databricks/_inputs.py +1630 -181
  3. pulumi_databricks/access_control_rule_set.py +81 -0
  4. pulumi_databricks/account_federation_policy.py +24 -0
  5. pulumi_databricks/account_network_policy.py +50 -0
  6. pulumi_databricks/account_setting_v2.py +181 -12
  7. pulumi_databricks/alert_v2.py +74 -2
  8. pulumi_databricks/app.py +71 -7
  9. pulumi_databricks/apps_settings_custom_template.py +102 -0
  10. pulumi_databricks/catalog.py +8 -8
  11. pulumi_databricks/cluster_policy.py +120 -0
  12. pulumi_databricks/config/__init__.pyi +4 -0
  13. pulumi_databricks/config/vars.py +8 -0
  14. pulumi_databricks/credential.py +7 -7
  15. pulumi_databricks/dashboard.py +94 -0
  16. pulumi_databricks/data_quality_monitor.py +2 -2
  17. pulumi_databricks/data_quality_refresh.py +78 -2
  18. pulumi_databricks/database_synced_database_table.py +212 -0
  19. pulumi_databricks/external_location.py +131 -7
  20. pulumi_databricks/feature_engineering_feature.py +52 -19
  21. pulumi_databricks/feature_engineering_kafka_config.py +463 -0
  22. pulumi_databricks/feature_engineering_materialized_feature.py +47 -0
  23. pulumi_databricks/file.py +2 -2
  24. pulumi_databricks/get_account_setting_v2.py +16 -16
  25. pulumi_databricks/get_alert_v2.py +2 -2
  26. pulumi_databricks/get_alerts_v2.py +2 -2
  27. pulumi_databricks/get_aws_assume_role_policy.py +14 -14
  28. pulumi_databricks/get_aws_bucket_policy.py +10 -10
  29. pulumi_databricks/get_aws_unity_catalog_assume_role_policy.py +10 -10
  30. pulumi_databricks/get_aws_unity_catalog_policy.py +10 -10
  31. pulumi_databricks/get_cluster.py +54 -0
  32. pulumi_databricks/get_current_config.py +4 -4
  33. pulumi_databricks/get_dashboards.py +32 -0
  34. pulumi_databricks/get_data_quality_monitor.py +2 -2
  35. pulumi_databricks/get_data_quality_monitors.py +2 -2
  36. pulumi_databricks/get_data_quality_refresh.py +2 -2
  37. pulumi_databricks/get_data_quality_refreshes.py +2 -2
  38. pulumi_databricks/get_feature_engineering_feature.py +12 -1
  39. pulumi_databricks/get_feature_engineering_kafka_config.py +182 -0
  40. pulumi_databricks/get_feature_engineering_kafka_configs.py +103 -0
  41. pulumi_databricks/get_feature_engineering_materialized_feature.py +16 -2
  42. pulumi_databricks/get_metastore.py +6 -6
  43. pulumi_databricks/get_notebook.py +20 -1
  44. pulumi_databricks/get_policy_info.py +36 -2
  45. pulumi_databricks/get_policy_infos.py +34 -2
  46. pulumi_databricks/get_service_principals.py +93 -7
  47. pulumi_databricks/get_spark_version.py +2 -2
  48. pulumi_databricks/get_tag_policies.py +2 -2
  49. pulumi_databricks/get_tag_policy.py +2 -2
  50. pulumi_databricks/get_users.py +194 -0
  51. pulumi_databricks/get_workspace_entity_tag_assignment.py +180 -0
  52. pulumi_databricks/get_workspace_entity_tag_assignments.py +171 -0
  53. pulumi_databricks/get_workspace_setting_v2.py +16 -16
  54. pulumi_databricks/instance_profile.py +0 -182
  55. pulumi_databricks/lakehouse_monitor.py +2 -2
  56. pulumi_databricks/metastore.py +81 -7
  57. pulumi_databricks/metastore_data_access.py +48 -0
  58. pulumi_databricks/mlflow_webhook.py +4 -4
  59. pulumi_databricks/mws_credentials.py +10 -10
  60. pulumi_databricks/mws_customer_managed_keys.py +0 -288
  61. pulumi_databricks/mws_log_delivery.py +146 -0
  62. pulumi_databricks/mws_storage_configurations.py +16 -16
  63. pulumi_databricks/mws_vpc_endpoint.py +56 -56
  64. pulumi_databricks/mws_workspaces.py +115 -55
  65. pulumi_databricks/notebook.py +49 -0
  66. pulumi_databricks/outputs.py +2017 -240
  67. pulumi_databricks/permission_assignment.py +49 -0
  68. pulumi_databricks/permissions.py +6 -6
  69. pulumi_databricks/pipeline.py +7 -7
  70. pulumi_databricks/policy_info.py +122 -2
  71. pulumi_databricks/provider.py +36 -1
  72. pulumi_databricks/pulumi-plugin.json +1 -1
  73. pulumi_databricks/recipient.py +74 -0
  74. pulumi_databricks/registered_model.py +7 -7
  75. pulumi_databricks/rfa_access_request_destinations.py +86 -19
  76. pulumi_databricks/schema.py +7 -7
  77. pulumi_databricks/service_principal_federation_policy.py +28 -0
  78. pulumi_databricks/sql_table.py +7 -7
  79. pulumi_databricks/tag_policy.py +2 -2
  80. pulumi_databricks/volume.py +7 -7
  81. pulumi_databricks/workspace_entity_tag_assignment.py +375 -0
  82. pulumi_databricks/workspace_setting_v2.py +181 -12
  83. {pulumi_databricks-1.78.0a1762407761.dist-info → pulumi_databricks-1.79.0.dist-info}/METADATA +1 -1
  84. {pulumi_databricks-1.78.0a1762407761.dist-info → pulumi_databricks-1.79.0.dist-info}/RECORD +86 -79
  85. {pulumi_databricks-1.78.0a1762407761.dist-info → pulumi_databricks-1.79.0.dist-info}/WHEEL +0 -0
  86. {pulumi_databricks-1.78.0a1762407761.dist-info → pulumi_databricks-1.79.0.dist-info}/top_level.txt +0 -0
@@ -45,7 +45,7 @@ class MetastoreArgs:
45
45
  :param pulumi.Input[_builtins.str] name: Name of metastore.
46
46
  :param pulumi.Input[_builtins.str] owner: Username/groupname/sp application_id of the metastore owner.
47
47
  :param pulumi.Input[_builtins.str] region: The region of the metastore
48
- :param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
48
+ :param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
49
49
  """
50
50
  if cloud is not None:
51
51
  pulumi.set(__self__, "cloud", cloud)
@@ -224,7 +224,7 @@ class MetastoreArgs:
224
224
  @pulumi.getter(name="storageRoot")
225
225
  def storage_root(self) -> Optional[pulumi.Input[_builtins.str]]:
226
226
  """
227
- Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
227
+ Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
228
228
  """
229
229
  return pulumi.get(self, "storage_root")
230
230
 
@@ -289,7 +289,7 @@ class _MetastoreState:
289
289
  :param pulumi.Input[_builtins.str] name: Name of metastore.
290
290
  :param pulumi.Input[_builtins.str] owner: Username/groupname/sp application_id of the metastore owner.
291
291
  :param pulumi.Input[_builtins.str] region: The region of the metastore
292
- :param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
292
+ :param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
293
293
  """
294
294
  if cloud is not None:
295
295
  pulumi.set(__self__, "cloud", cloud)
@@ -468,7 +468,7 @@ class _MetastoreState:
468
468
  @pulumi.getter(name="storageRoot")
469
469
  def storage_root(self) -> Optional[pulumi.Input[_builtins.str]]:
470
470
  """
471
- Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
471
+ Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
472
472
  """
473
473
  return pulumi.get(self, "storage_root")
474
474
 
@@ -558,6 +558,43 @@ class Metastore(pulumi.CustomResource):
558
558
 
559
559
  For Azure
560
560
 
561
+ ```python
562
+ import pulumi
563
+ import pulumi_databricks as databricks
564
+ import pulumi_std as std
565
+
566
+ this = databricks.Metastore("this",
567
+ name="primary",
568
+ storage_root=std.format(input="abfss://%s@%s.dfs.core.windows.net/",
569
+ args=[
570
+ unity_catalog["name"],
571
+ unity_catalog_azurerm_storage_account["name"],
572
+ ]).result,
573
+ owner="uc admins",
574
+ region="eastus",
575
+ force_destroy=True)
576
+ this_metastore_assignment = databricks.MetastoreAssignment("this",
577
+ metastore_id=this.id,
578
+ workspace_id=workspace_id)
579
+ ```
580
+
581
+ For GCP
582
+
583
+ ```python
584
+ import pulumi
585
+ import pulumi_databricks as databricks
586
+
587
+ this = databricks.Metastore("this",
588
+ name="primary",
589
+ storage_root=f"gs://{unity_metastore['name']}",
590
+ owner="uc admins",
591
+ region=us_east1,
592
+ force_destroy=True)
593
+ this_metastore_assignment = databricks.MetastoreAssignment("this",
594
+ metastore_id=this.id,
595
+ workspace_id=workspace_id)
596
+ ```
597
+
561
598
  ## Import
562
599
 
563
600
  This resource can be imported by ID:
@@ -589,7 +626,7 @@ class Metastore(pulumi.CustomResource):
589
626
  :param pulumi.Input[_builtins.str] name: Name of metastore.
590
627
  :param pulumi.Input[_builtins.str] owner: Username/groupname/sp application_id of the metastore owner.
591
628
  :param pulumi.Input[_builtins.str] region: The region of the metastore
592
- :param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
629
+ :param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
593
630
  """
594
631
  ...
595
632
  @overload
@@ -627,6 +664,43 @@ class Metastore(pulumi.CustomResource):
627
664
 
628
665
  For Azure
629
666
 
667
+ ```python
668
+ import pulumi
669
+ import pulumi_databricks as databricks
670
+ import pulumi_std as std
671
+
672
+ this = databricks.Metastore("this",
673
+ name="primary",
674
+ storage_root=std.format(input="abfss://%s@%s.dfs.core.windows.net/",
675
+ args=[
676
+ unity_catalog["name"],
677
+ unity_catalog_azurerm_storage_account["name"],
678
+ ]).result,
679
+ owner="uc admins",
680
+ region="eastus",
681
+ force_destroy=True)
682
+ this_metastore_assignment = databricks.MetastoreAssignment("this",
683
+ metastore_id=this.id,
684
+ workspace_id=workspace_id)
685
+ ```
686
+
687
+ For GCP
688
+
689
+ ```python
690
+ import pulumi
691
+ import pulumi_databricks as databricks
692
+
693
+ this = databricks.Metastore("this",
694
+ name="primary",
695
+ storage_root=f"gs://{unity_metastore['name']}",
696
+ owner="uc admins",
697
+ region=us_east1,
698
+ force_destroy=True)
699
+ this_metastore_assignment = databricks.MetastoreAssignment("this",
700
+ metastore_id=this.id,
701
+ workspace_id=workspace_id)
702
+ ```
703
+
630
704
  ## Import
631
705
 
632
706
  This resource can be imported by ID:
@@ -748,7 +822,7 @@ class Metastore(pulumi.CustomResource):
748
822
  :param pulumi.Input[_builtins.str] name: Name of metastore.
749
823
  :param pulumi.Input[_builtins.str] owner: Username/groupname/sp application_id of the metastore owner.
750
824
  :param pulumi.Input[_builtins.str] region: The region of the metastore
751
- :param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
825
+ :param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
752
826
  """
753
827
  opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
754
828
 
@@ -863,7 +937,7 @@ class Metastore(pulumi.CustomResource):
863
937
  @pulumi.getter(name="storageRoot")
864
938
  def storage_root(self) -> pulumi.Output[Optional[_builtins.str]]:
865
939
  """
866
- Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
940
+ Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
867
941
  """
868
942
  return pulumi.get(self, "storage_root")
869
943
 
@@ -479,6 +479,30 @@ class MetastoreDataAccess(pulumi.CustomResource):
479
479
 
480
480
  For Azure using managed identity as credential (recommended)
481
481
 
482
+ ```python
483
+ import pulumi
484
+ import pulumi_databricks as databricks
485
+ import pulumi_std as std
486
+
487
+ this = databricks.Metastore("this",
488
+ name="primary",
489
+ storage_root=std.format(input="abfss://%s@%s.dfs.core.windows.net/",
490
+ args=[
491
+ unity_catalog["name"],
492
+ unity_catalog_azurerm_storage_account["name"],
493
+ ]).result,
494
+ owner="uc admins",
495
+ region="eastus",
496
+ force_destroy=True)
497
+ this_metastore_data_access = databricks.MetastoreDataAccess("this",
498
+ metastore_id=this.id,
499
+ name="mi_dac",
500
+ azure_managed_identity={
501
+ "access_connector_id": access_connector_id,
502
+ },
503
+ is_default=True)
504
+ ```
505
+
482
506
  ## Import
483
507
 
484
508
  This resource can be imported by combination of metastore id and the data access name.
@@ -541,6 +565,30 @@ class MetastoreDataAccess(pulumi.CustomResource):
541
565
 
542
566
  For Azure using managed identity as credential (recommended)
543
567
 
568
+ ```python
569
+ import pulumi
570
+ import pulumi_databricks as databricks
571
+ import pulumi_std as std
572
+
573
+ this = databricks.Metastore("this",
574
+ name="primary",
575
+ storage_root=std.format(input="abfss://%s@%s.dfs.core.windows.net/",
576
+ args=[
577
+ unity_catalog["name"],
578
+ unity_catalog_azurerm_storage_account["name"],
579
+ ]).result,
580
+ owner="uc admins",
581
+ region="eastus",
582
+ force_destroy=True)
583
+ this_metastore_data_access = databricks.MetastoreDataAccess("this",
584
+ metastore_id=this.id,
585
+ name="mi_dac",
586
+ azure_managed_identity={
587
+ "access_connector_id": access_connector_id,
588
+ },
589
+ is_default=True)
590
+ ```
591
+
544
592
  ## Import
545
593
 
546
594
  This resource can be imported by combination of metastore id and the data access name.
@@ -252,9 +252,9 @@ class MlflowWebhook(pulumi.CustomResource):
252
252
  language="PYTHON",
253
253
  content_base64=std.base64encode(input=\"\"\"import json
254
254
 
255
- event_message = dbutils.widgets.get("event_message")
255
+ event_message = dbutils.widgets.get(\\"event_message\\")
256
256
  event_message_dict = json.loads(event_message)
257
- print(f"event data={event_message_dict}")
257
+ print(f\\"event data={event_message_dict}\\")
258
258
  \"\"\").result)
259
259
  this_job = databricks.Job("this",
260
260
  name=f"Pulumi MLflowWebhook Demo ({me.alphanumeric})",
@@ -354,9 +354,9 @@ class MlflowWebhook(pulumi.CustomResource):
354
354
  language="PYTHON",
355
355
  content_base64=std.base64encode(input=\"\"\"import json
356
356
 
357
- event_message = dbutils.widgets.get("event_message")
357
+ event_message = dbutils.widgets.get(\\"event_message\\")
358
358
  event_message_dict = json.loads(event_message)
359
- print(f"event data={event_message_dict}")
359
+ print(f\\"event data={event_message_dict}\\")
360
360
  \"\"\").result)
361
361
  this_job = databricks.Job("this",
362
362
  name=f"Pulumi MLflowWebhook Demo ({me.alphanumeric})",
@@ -249,18 +249,18 @@ class MwsCredentials(pulumi.CustomResource):
249
249
  # Names of created resources will be prefixed with this value
250
250
  prefix = config.require_object("prefix")
251
251
  this = databricks.get_aws_assume_role_policy(external_id=databricks_account_id)
252
- cross_account_role = aws.iam.Role("cross_account_role",
253
- name=f"{prefix}-crossaccount",
252
+ cross_account_role = aws.index.IamRole("cross_account_role",
253
+ name=f{prefix}-crossaccount,
254
254
  assume_role_policy=this.json,
255
255
  tags=tags)
256
256
  this_get_aws_cross_account_policy = databricks.get_aws_cross_account_policy()
257
- this_role_policy = aws.iam.RolePolicy("this",
258
- name=f"{prefix}-policy",
257
+ this_iam_role_policy = aws.index.IamRolePolicy("this",
258
+ name=f{prefix}-policy,
259
259
  role=cross_account_role.id,
260
260
  policy=this_get_aws_cross_account_policy.json)
261
261
  this_mws_credentials = databricks.MwsCredentials("this",
262
262
  credentials_name=f"{prefix}-creds",
263
- role_arn=cross_account_role.arn)
263
+ role_arn=cross_account_role["arn"])
264
264
  ```
265
265
 
266
266
  ## Related Resources
@@ -324,18 +324,18 @@ class MwsCredentials(pulumi.CustomResource):
324
324
  # Names of created resources will be prefixed with this value
325
325
  prefix = config.require_object("prefix")
326
326
  this = databricks.get_aws_assume_role_policy(external_id=databricks_account_id)
327
- cross_account_role = aws.iam.Role("cross_account_role",
328
- name=f"{prefix}-crossaccount",
327
+ cross_account_role = aws.index.IamRole("cross_account_role",
328
+ name=f{prefix}-crossaccount,
329
329
  assume_role_policy=this.json,
330
330
  tags=tags)
331
331
  this_get_aws_cross_account_policy = databricks.get_aws_cross_account_policy()
332
- this_role_policy = aws.iam.RolePolicy("this",
333
- name=f"{prefix}-policy",
332
+ this_iam_role_policy = aws.index.IamRolePolicy("this",
333
+ name=f{prefix}-policy,
334
334
  role=cross_account_role.id,
335
335
  policy=this_get_aws_cross_account_policy.json)
336
336
  this_mws_credentials = databricks.MwsCredentials("this",
337
337
  credentials_name=f"{prefix}-creds",
338
- role_arn=cross_account_role.arn)
338
+ role_arn=cross_account_role["arn"])
339
339
  ```
340
340
 
341
341
  ## Related Resources
@@ -254,56 +254,6 @@ class MwsCustomerManagedKeys(pulumi.CustomResource):
254
254
 
255
255
  You must configure this during workspace creation
256
256
 
257
- ### For AWS
258
-
259
- ```python
260
- import pulumi
261
- import pulumi_aws as aws
262
- import pulumi_databricks as databricks
263
-
264
- config = pulumi.Config()
265
- # Account Id that could be found in the top right corner of https://accounts.cloud.databricks.com/
266
- databricks_account_id = config.require_object("databricksAccountId")
267
- current = aws.get_caller_identity()
268
- databricks_managed_services_cmk = aws.iam.get_policy_document(version="2012-10-17",
269
- statements=[
270
- {
271
- "sid": "Enable IAM User Permissions",
272
- "effect": "Allow",
273
- "principals": [{
274
- "type": "AWS",
275
- "identifiers": [current.account_id],
276
- }],
277
- "actions": ["kms:*"],
278
- "resources": ["*"],
279
- },
280
- {
281
- "sid": "Allow Databricks to use KMS key for control plane managed services",
282
- "effect": "Allow",
283
- "principals": [{
284
- "type": "AWS",
285
- "identifiers": ["arn:aws:iam::414351767826:root"],
286
- }],
287
- "actions": [
288
- "kms:Encrypt",
289
- "kms:Decrypt",
290
- ],
291
- "resources": ["*"],
292
- },
293
- ])
294
- managed_services_customer_managed_key = aws.kms.Key("managed_services_customer_managed_key", policy=databricks_managed_services_cmk.json)
295
- managed_services_customer_managed_key_alias = aws.kms.Alias("managed_services_customer_managed_key_alias",
296
- name="alias/managed-services-customer-managed-key-alias",
297
- target_key_id=managed_services_customer_managed_key.key_id)
298
- managed_services = databricks.MwsCustomerManagedKeys("managed_services",
299
- account_id=databricks_account_id,
300
- aws_key_info={
301
- "key_arn": managed_services_customer_managed_key.arn,
302
- "key_alias": managed_services_customer_managed_key_alias.name,
303
- },
304
- use_cases=["MANAGED_SERVICES"])
305
- ```
306
-
307
257
  ### For GCP
308
258
 
309
259
  ```python
@@ -325,100 +275,6 @@ class MwsCustomerManagedKeys(pulumi.CustomResource):
325
275
 
326
276
  ### Customer-managed key for workspace storage
327
277
 
328
- ### For AWS
329
-
330
- ```python
331
- import pulumi
332
- import pulumi_aws as aws
333
- import pulumi_databricks as databricks
334
-
335
- config = pulumi.Config()
336
- # Account Id that could be found in the top right corner of https://accounts.cloud.databricks.com/
337
- databricks_account_id = config.require_object("databricksAccountId")
338
- # AWS ARN for the Databricks cross account role
339
- databricks_cross_account_role = config.require_object("databricksCrossAccountRole")
340
- current = aws.get_caller_identity()
341
- databricks_storage_cmk = aws.iam.get_policy_document(version="2012-10-17",
342
- statements=[
343
- {
344
- "sid": "Enable IAM User Permissions",
345
- "effect": "Allow",
346
- "principals": [{
347
- "type": "AWS",
348
- "identifiers": [current.account_id],
349
- }],
350
- "actions": ["kms:*"],
351
- "resources": ["*"],
352
- },
353
- {
354
- "sid": "Allow Databricks to use KMS key for DBFS",
355
- "effect": "Allow",
356
- "principals": [{
357
- "type": "AWS",
358
- "identifiers": ["arn:aws:iam::414351767826:root"],
359
- }],
360
- "actions": [
361
- "kms:Encrypt",
362
- "kms:Decrypt",
363
- "kms:ReEncrypt*",
364
- "kms:GenerateDataKey*",
365
- "kms:DescribeKey",
366
- ],
367
- "resources": ["*"],
368
- },
369
- {
370
- "sid": "Allow Databricks to use KMS key for DBFS (Grants)",
371
- "effect": "Allow",
372
- "principals": [{
373
- "type": "AWS",
374
- "identifiers": ["arn:aws:iam::414351767826:root"],
375
- }],
376
- "actions": [
377
- "kms:CreateGrant",
378
- "kms:ListGrants",
379
- "kms:RevokeGrant",
380
- ],
381
- "resources": ["*"],
382
- "conditions": [{
383
- "test": "Bool",
384
- "variable": "kms:GrantIsForAWSResource",
385
- "values": ["true"],
386
- }],
387
- },
388
- {
389
- "sid": "Allow Databricks to use KMS key for EBS",
390
- "effect": "Allow",
391
- "principals": [{
392
- "type": "AWS",
393
- "identifiers": [databricks_cross_account_role],
394
- }],
395
- "actions": [
396
- "kms:Decrypt",
397
- "kms:GenerateDataKey*",
398
- "kms:CreateGrant",
399
- "kms:DescribeKey",
400
- ],
401
- "resources": ["*"],
402
- "conditions": [{
403
- "test": "ForAnyValue:StringLike",
404
- "variable": "kms:ViaService",
405
- "values": ["ec2.*.amazonaws.com"],
406
- }],
407
- },
408
- ])
409
- storage_customer_managed_key = aws.kms.Key("storage_customer_managed_key", policy=databricks_storage_cmk.json)
410
- storage_customer_managed_key_alias = aws.kms.Alias("storage_customer_managed_key_alias",
411
- name="alias/storage-customer-managed-key-alias",
412
- target_key_id=storage_customer_managed_key.key_id)
413
- storage = databricks.MwsCustomerManagedKeys("storage",
414
- account_id=databricks_account_id,
415
- aws_key_info={
416
- "key_arn": storage_customer_managed_key.arn,
417
- "key_alias": storage_customer_managed_key_alias.name,
418
- },
419
- use_cases=["STORAGE"])
420
- ```
421
-
422
278
  ### For GCP
423
279
 
424
280
  ```python
@@ -501,56 +357,6 @@ class MwsCustomerManagedKeys(pulumi.CustomResource):
501
357
 
502
358
  You must configure this during workspace creation
503
359
 
504
- ### For AWS
505
-
506
- ```python
507
- import pulumi
508
- import pulumi_aws as aws
509
- import pulumi_databricks as databricks
510
-
511
- config = pulumi.Config()
512
- # Account Id that could be found in the top right corner of https://accounts.cloud.databricks.com/
513
- databricks_account_id = config.require_object("databricksAccountId")
514
- current = aws.get_caller_identity()
515
- databricks_managed_services_cmk = aws.iam.get_policy_document(version="2012-10-17",
516
- statements=[
517
- {
518
- "sid": "Enable IAM User Permissions",
519
- "effect": "Allow",
520
- "principals": [{
521
- "type": "AWS",
522
- "identifiers": [current.account_id],
523
- }],
524
- "actions": ["kms:*"],
525
- "resources": ["*"],
526
- },
527
- {
528
- "sid": "Allow Databricks to use KMS key for control plane managed services",
529
- "effect": "Allow",
530
- "principals": [{
531
- "type": "AWS",
532
- "identifiers": ["arn:aws:iam::414351767826:root"],
533
- }],
534
- "actions": [
535
- "kms:Encrypt",
536
- "kms:Decrypt",
537
- ],
538
- "resources": ["*"],
539
- },
540
- ])
541
- managed_services_customer_managed_key = aws.kms.Key("managed_services_customer_managed_key", policy=databricks_managed_services_cmk.json)
542
- managed_services_customer_managed_key_alias = aws.kms.Alias("managed_services_customer_managed_key_alias",
543
- name="alias/managed-services-customer-managed-key-alias",
544
- target_key_id=managed_services_customer_managed_key.key_id)
545
- managed_services = databricks.MwsCustomerManagedKeys("managed_services",
546
- account_id=databricks_account_id,
547
- aws_key_info={
548
- "key_arn": managed_services_customer_managed_key.arn,
549
- "key_alias": managed_services_customer_managed_key_alias.name,
550
- },
551
- use_cases=["MANAGED_SERVICES"])
552
- ```
553
-
554
360
  ### For GCP
555
361
 
556
362
  ```python
@@ -572,100 +378,6 @@ class MwsCustomerManagedKeys(pulumi.CustomResource):
572
378
 
573
379
  ### Customer-managed key for workspace storage
574
380
 
575
- ### For AWS
576
-
577
- ```python
578
- import pulumi
579
- import pulumi_aws as aws
580
- import pulumi_databricks as databricks
581
-
582
- config = pulumi.Config()
583
- # Account Id that could be found in the top right corner of https://accounts.cloud.databricks.com/
584
- databricks_account_id = config.require_object("databricksAccountId")
585
- # AWS ARN for the Databricks cross account role
586
- databricks_cross_account_role = config.require_object("databricksCrossAccountRole")
587
- current = aws.get_caller_identity()
588
- databricks_storage_cmk = aws.iam.get_policy_document(version="2012-10-17",
589
- statements=[
590
- {
591
- "sid": "Enable IAM User Permissions",
592
- "effect": "Allow",
593
- "principals": [{
594
- "type": "AWS",
595
- "identifiers": [current.account_id],
596
- }],
597
- "actions": ["kms:*"],
598
- "resources": ["*"],
599
- },
600
- {
601
- "sid": "Allow Databricks to use KMS key for DBFS",
602
- "effect": "Allow",
603
- "principals": [{
604
- "type": "AWS",
605
- "identifiers": ["arn:aws:iam::414351767826:root"],
606
- }],
607
- "actions": [
608
- "kms:Encrypt",
609
- "kms:Decrypt",
610
- "kms:ReEncrypt*",
611
- "kms:GenerateDataKey*",
612
- "kms:DescribeKey",
613
- ],
614
- "resources": ["*"],
615
- },
616
- {
617
- "sid": "Allow Databricks to use KMS key for DBFS (Grants)",
618
- "effect": "Allow",
619
- "principals": [{
620
- "type": "AWS",
621
- "identifiers": ["arn:aws:iam::414351767826:root"],
622
- }],
623
- "actions": [
624
- "kms:CreateGrant",
625
- "kms:ListGrants",
626
- "kms:RevokeGrant",
627
- ],
628
- "resources": ["*"],
629
- "conditions": [{
630
- "test": "Bool",
631
- "variable": "kms:GrantIsForAWSResource",
632
- "values": ["true"],
633
- }],
634
- },
635
- {
636
- "sid": "Allow Databricks to use KMS key for EBS",
637
- "effect": "Allow",
638
- "principals": [{
639
- "type": "AWS",
640
- "identifiers": [databricks_cross_account_role],
641
- }],
642
- "actions": [
643
- "kms:Decrypt",
644
- "kms:GenerateDataKey*",
645
- "kms:CreateGrant",
646
- "kms:DescribeKey",
647
- ],
648
- "resources": ["*"],
649
- "conditions": [{
650
- "test": "ForAnyValue:StringLike",
651
- "variable": "kms:ViaService",
652
- "values": ["ec2.*.amazonaws.com"],
653
- }],
654
- },
655
- ])
656
- storage_customer_managed_key = aws.kms.Key("storage_customer_managed_key", policy=databricks_storage_cmk.json)
657
- storage_customer_managed_key_alias = aws.kms.Alias("storage_customer_managed_key_alias",
658
- name="alias/storage-customer-managed-key-alias",
659
- target_key_id=storage_customer_managed_key.key_id)
660
- storage = databricks.MwsCustomerManagedKeys("storage",
661
- account_id=databricks_account_id,
662
- aws_key_info={
663
- "key_arn": storage_customer_managed_key.arn,
664
- "key_alias": storage_customer_managed_key_alias.name,
665
- },
666
- use_cases=["STORAGE"])
667
- ```
668
-
669
381
  ### For GCP
670
382
 
671
383
  ```python