pulumi-databricks 1.78.0a1762407761__py3-none-any.whl → 1.79.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_databricks/__init__.py +23 -0
- pulumi_databricks/_inputs.py +1630 -181
- pulumi_databricks/access_control_rule_set.py +81 -0
- pulumi_databricks/account_federation_policy.py +24 -0
- pulumi_databricks/account_network_policy.py +50 -0
- pulumi_databricks/account_setting_v2.py +181 -12
- pulumi_databricks/alert_v2.py +74 -2
- pulumi_databricks/app.py +71 -7
- pulumi_databricks/apps_settings_custom_template.py +102 -0
- pulumi_databricks/catalog.py +8 -8
- pulumi_databricks/cluster_policy.py +120 -0
- pulumi_databricks/config/__init__.pyi +4 -0
- pulumi_databricks/config/vars.py +8 -0
- pulumi_databricks/credential.py +7 -7
- pulumi_databricks/dashboard.py +94 -0
- pulumi_databricks/data_quality_monitor.py +2 -2
- pulumi_databricks/data_quality_refresh.py +78 -2
- pulumi_databricks/database_synced_database_table.py +212 -0
- pulumi_databricks/external_location.py +131 -7
- pulumi_databricks/feature_engineering_feature.py +52 -19
- pulumi_databricks/feature_engineering_kafka_config.py +463 -0
- pulumi_databricks/feature_engineering_materialized_feature.py +47 -0
- pulumi_databricks/file.py +2 -2
- pulumi_databricks/get_account_setting_v2.py +16 -16
- pulumi_databricks/get_alert_v2.py +2 -2
- pulumi_databricks/get_alerts_v2.py +2 -2
- pulumi_databricks/get_aws_assume_role_policy.py +14 -14
- pulumi_databricks/get_aws_bucket_policy.py +10 -10
- pulumi_databricks/get_aws_unity_catalog_assume_role_policy.py +10 -10
- pulumi_databricks/get_aws_unity_catalog_policy.py +10 -10
- pulumi_databricks/get_cluster.py +54 -0
- pulumi_databricks/get_current_config.py +4 -4
- pulumi_databricks/get_dashboards.py +32 -0
- pulumi_databricks/get_data_quality_monitor.py +2 -2
- pulumi_databricks/get_data_quality_monitors.py +2 -2
- pulumi_databricks/get_data_quality_refresh.py +2 -2
- pulumi_databricks/get_data_quality_refreshes.py +2 -2
- pulumi_databricks/get_feature_engineering_feature.py +12 -1
- pulumi_databricks/get_feature_engineering_kafka_config.py +182 -0
- pulumi_databricks/get_feature_engineering_kafka_configs.py +103 -0
- pulumi_databricks/get_feature_engineering_materialized_feature.py +16 -2
- pulumi_databricks/get_metastore.py +6 -6
- pulumi_databricks/get_notebook.py +20 -1
- pulumi_databricks/get_policy_info.py +36 -2
- pulumi_databricks/get_policy_infos.py +34 -2
- pulumi_databricks/get_service_principals.py +93 -7
- pulumi_databricks/get_spark_version.py +2 -2
- pulumi_databricks/get_tag_policies.py +2 -2
- pulumi_databricks/get_tag_policy.py +2 -2
- pulumi_databricks/get_users.py +194 -0
- pulumi_databricks/get_workspace_entity_tag_assignment.py +180 -0
- pulumi_databricks/get_workspace_entity_tag_assignments.py +171 -0
- pulumi_databricks/get_workspace_setting_v2.py +16 -16
- pulumi_databricks/instance_profile.py +0 -182
- pulumi_databricks/lakehouse_monitor.py +2 -2
- pulumi_databricks/metastore.py +81 -7
- pulumi_databricks/metastore_data_access.py +48 -0
- pulumi_databricks/mlflow_webhook.py +4 -4
- pulumi_databricks/mws_credentials.py +10 -10
- pulumi_databricks/mws_customer_managed_keys.py +0 -288
- pulumi_databricks/mws_log_delivery.py +146 -0
- pulumi_databricks/mws_storage_configurations.py +16 -16
- pulumi_databricks/mws_vpc_endpoint.py +56 -56
- pulumi_databricks/mws_workspaces.py +115 -55
- pulumi_databricks/notebook.py +49 -0
- pulumi_databricks/outputs.py +2017 -240
- pulumi_databricks/permission_assignment.py +49 -0
- pulumi_databricks/permissions.py +6 -6
- pulumi_databricks/pipeline.py +7 -7
- pulumi_databricks/policy_info.py +122 -2
- pulumi_databricks/provider.py +36 -1
- pulumi_databricks/pulumi-plugin.json +1 -1
- pulumi_databricks/recipient.py +74 -0
- pulumi_databricks/registered_model.py +7 -7
- pulumi_databricks/rfa_access_request_destinations.py +86 -19
- pulumi_databricks/schema.py +7 -7
- pulumi_databricks/service_principal_federation_policy.py +28 -0
- pulumi_databricks/sql_table.py +7 -7
- pulumi_databricks/tag_policy.py +2 -2
- pulumi_databricks/volume.py +7 -7
- pulumi_databricks/workspace_entity_tag_assignment.py +375 -0
- pulumi_databricks/workspace_setting_v2.py +181 -12
- {pulumi_databricks-1.78.0a1762407761.dist-info → pulumi_databricks-1.79.0.dist-info}/METADATA +1 -1
- {pulumi_databricks-1.78.0a1762407761.dist-info → pulumi_databricks-1.79.0.dist-info}/RECORD +86 -79
- {pulumi_databricks-1.78.0a1762407761.dist-info → pulumi_databricks-1.79.0.dist-info}/WHEEL +0 -0
- {pulumi_databricks-1.78.0a1762407761.dist-info → pulumi_databricks-1.79.0.dist-info}/top_level.txt +0 -0
pulumi_databricks/metastore.py
CHANGED
|
@@ -45,7 +45,7 @@ class MetastoreArgs:
|
|
|
45
45
|
:param pulumi.Input[_builtins.str] name: Name of metastore.
|
|
46
46
|
:param pulumi.Input[_builtins.str] owner: Username/groupname/sp application_id of the metastore owner.
|
|
47
47
|
:param pulumi.Input[_builtins.str] region: The region of the metastore
|
|
48
|
-
:param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
48
|
+
:param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
49
49
|
"""
|
|
50
50
|
if cloud is not None:
|
|
51
51
|
pulumi.set(__self__, "cloud", cloud)
|
|
@@ -224,7 +224,7 @@ class MetastoreArgs:
|
|
|
224
224
|
@pulumi.getter(name="storageRoot")
|
|
225
225
|
def storage_root(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
226
226
|
"""
|
|
227
|
-
Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
227
|
+
Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
228
228
|
"""
|
|
229
229
|
return pulumi.get(self, "storage_root")
|
|
230
230
|
|
|
@@ -289,7 +289,7 @@ class _MetastoreState:
|
|
|
289
289
|
:param pulumi.Input[_builtins.str] name: Name of metastore.
|
|
290
290
|
:param pulumi.Input[_builtins.str] owner: Username/groupname/sp application_id of the metastore owner.
|
|
291
291
|
:param pulumi.Input[_builtins.str] region: The region of the metastore
|
|
292
|
-
:param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
292
|
+
:param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
293
293
|
"""
|
|
294
294
|
if cloud is not None:
|
|
295
295
|
pulumi.set(__self__, "cloud", cloud)
|
|
@@ -468,7 +468,7 @@ class _MetastoreState:
|
|
|
468
468
|
@pulumi.getter(name="storageRoot")
|
|
469
469
|
def storage_root(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
470
470
|
"""
|
|
471
|
-
Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
471
|
+
Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
472
472
|
"""
|
|
473
473
|
return pulumi.get(self, "storage_root")
|
|
474
474
|
|
|
@@ -558,6 +558,43 @@ class Metastore(pulumi.CustomResource):
|
|
|
558
558
|
|
|
559
559
|
For Azure
|
|
560
560
|
|
|
561
|
+
```python
|
|
562
|
+
import pulumi
|
|
563
|
+
import pulumi_databricks as databricks
|
|
564
|
+
import pulumi_std as std
|
|
565
|
+
|
|
566
|
+
this = databricks.Metastore("this",
|
|
567
|
+
name="primary",
|
|
568
|
+
storage_root=std.format(input="abfss://%s@%s.dfs.core.windows.net/",
|
|
569
|
+
args=[
|
|
570
|
+
unity_catalog["name"],
|
|
571
|
+
unity_catalog_azurerm_storage_account["name"],
|
|
572
|
+
]).result,
|
|
573
|
+
owner="uc admins",
|
|
574
|
+
region="eastus",
|
|
575
|
+
force_destroy=True)
|
|
576
|
+
this_metastore_assignment = databricks.MetastoreAssignment("this",
|
|
577
|
+
metastore_id=this.id,
|
|
578
|
+
workspace_id=workspace_id)
|
|
579
|
+
```
|
|
580
|
+
|
|
581
|
+
For GCP
|
|
582
|
+
|
|
583
|
+
```python
|
|
584
|
+
import pulumi
|
|
585
|
+
import pulumi_databricks as databricks
|
|
586
|
+
|
|
587
|
+
this = databricks.Metastore("this",
|
|
588
|
+
name="primary",
|
|
589
|
+
storage_root=f"gs://{unity_metastore['name']}",
|
|
590
|
+
owner="uc admins",
|
|
591
|
+
region=us_east1,
|
|
592
|
+
force_destroy=True)
|
|
593
|
+
this_metastore_assignment = databricks.MetastoreAssignment("this",
|
|
594
|
+
metastore_id=this.id,
|
|
595
|
+
workspace_id=workspace_id)
|
|
596
|
+
```
|
|
597
|
+
|
|
561
598
|
## Import
|
|
562
599
|
|
|
563
600
|
This resource can be imported by ID:
|
|
@@ -589,7 +626,7 @@ class Metastore(pulumi.CustomResource):
|
|
|
589
626
|
:param pulumi.Input[_builtins.str] name: Name of metastore.
|
|
590
627
|
:param pulumi.Input[_builtins.str] owner: Username/groupname/sp application_id of the metastore owner.
|
|
591
628
|
:param pulumi.Input[_builtins.str] region: The region of the metastore
|
|
592
|
-
:param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
629
|
+
:param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
593
630
|
"""
|
|
594
631
|
...
|
|
595
632
|
@overload
|
|
@@ -627,6 +664,43 @@ class Metastore(pulumi.CustomResource):
|
|
|
627
664
|
|
|
628
665
|
For Azure
|
|
629
666
|
|
|
667
|
+
```python
|
|
668
|
+
import pulumi
|
|
669
|
+
import pulumi_databricks as databricks
|
|
670
|
+
import pulumi_std as std
|
|
671
|
+
|
|
672
|
+
this = databricks.Metastore("this",
|
|
673
|
+
name="primary",
|
|
674
|
+
storage_root=std.format(input="abfss://%s@%s.dfs.core.windows.net/",
|
|
675
|
+
args=[
|
|
676
|
+
unity_catalog["name"],
|
|
677
|
+
unity_catalog_azurerm_storage_account["name"],
|
|
678
|
+
]).result,
|
|
679
|
+
owner="uc admins",
|
|
680
|
+
region="eastus",
|
|
681
|
+
force_destroy=True)
|
|
682
|
+
this_metastore_assignment = databricks.MetastoreAssignment("this",
|
|
683
|
+
metastore_id=this.id,
|
|
684
|
+
workspace_id=workspace_id)
|
|
685
|
+
```
|
|
686
|
+
|
|
687
|
+
For GCP
|
|
688
|
+
|
|
689
|
+
```python
|
|
690
|
+
import pulumi
|
|
691
|
+
import pulumi_databricks as databricks
|
|
692
|
+
|
|
693
|
+
this = databricks.Metastore("this",
|
|
694
|
+
name="primary",
|
|
695
|
+
storage_root=f"gs://{unity_metastore['name']}",
|
|
696
|
+
owner="uc admins",
|
|
697
|
+
region=us_east1,
|
|
698
|
+
force_destroy=True)
|
|
699
|
+
this_metastore_assignment = databricks.MetastoreAssignment("this",
|
|
700
|
+
metastore_id=this.id,
|
|
701
|
+
workspace_id=workspace_id)
|
|
702
|
+
```
|
|
703
|
+
|
|
630
704
|
## Import
|
|
631
705
|
|
|
632
706
|
This resource can be imported by ID:
|
|
@@ -748,7 +822,7 @@ class Metastore(pulumi.CustomResource):
|
|
|
748
822
|
:param pulumi.Input[_builtins.str] name: Name of metastore.
|
|
749
823
|
:param pulumi.Input[_builtins.str] owner: Username/groupname/sp application_id of the metastore owner.
|
|
750
824
|
:param pulumi.Input[_builtins.str] region: The region of the metastore
|
|
751
|
-
:param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
825
|
+
:param pulumi.Input[_builtins.str] storage_root: Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
752
826
|
"""
|
|
753
827
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
754
828
|
|
|
@@ -863,7 +937,7 @@ class Metastore(pulumi.CustomResource):
|
|
|
863
937
|
@pulumi.getter(name="storageRoot")
|
|
864
938
|
def storage_root(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
865
939
|
"""
|
|
866
|
-
Path on cloud storage account, where managed `Table` are stored. Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
940
|
+
Path on cloud storage account, where managed `Table` are stored. If the URL contains special characters, such as space, `&`, etc., they should be percent-encoded (space > `%20`, etc.). Change forces creation of a new resource. If no `storage_root` is defined for the metastore, each catalog must have a `storage_root` defined.
|
|
867
941
|
"""
|
|
868
942
|
return pulumi.get(self, "storage_root")
|
|
869
943
|
|
|
@@ -479,6 +479,30 @@ class MetastoreDataAccess(pulumi.CustomResource):
|
|
|
479
479
|
|
|
480
480
|
For Azure using managed identity as credential (recommended)
|
|
481
481
|
|
|
482
|
+
```python
|
|
483
|
+
import pulumi
|
|
484
|
+
import pulumi_databricks as databricks
|
|
485
|
+
import pulumi_std as std
|
|
486
|
+
|
|
487
|
+
this = databricks.Metastore("this",
|
|
488
|
+
name="primary",
|
|
489
|
+
storage_root=std.format(input="abfss://%s@%s.dfs.core.windows.net/",
|
|
490
|
+
args=[
|
|
491
|
+
unity_catalog["name"],
|
|
492
|
+
unity_catalog_azurerm_storage_account["name"],
|
|
493
|
+
]).result,
|
|
494
|
+
owner="uc admins",
|
|
495
|
+
region="eastus",
|
|
496
|
+
force_destroy=True)
|
|
497
|
+
this_metastore_data_access = databricks.MetastoreDataAccess("this",
|
|
498
|
+
metastore_id=this.id,
|
|
499
|
+
name="mi_dac",
|
|
500
|
+
azure_managed_identity={
|
|
501
|
+
"access_connector_id": access_connector_id,
|
|
502
|
+
},
|
|
503
|
+
is_default=True)
|
|
504
|
+
```
|
|
505
|
+
|
|
482
506
|
## Import
|
|
483
507
|
|
|
484
508
|
This resource can be imported by combination of metastore id and the data access name.
|
|
@@ -541,6 +565,30 @@ class MetastoreDataAccess(pulumi.CustomResource):
|
|
|
541
565
|
|
|
542
566
|
For Azure using managed identity as credential (recommended)
|
|
543
567
|
|
|
568
|
+
```python
|
|
569
|
+
import pulumi
|
|
570
|
+
import pulumi_databricks as databricks
|
|
571
|
+
import pulumi_std as std
|
|
572
|
+
|
|
573
|
+
this = databricks.Metastore("this",
|
|
574
|
+
name="primary",
|
|
575
|
+
storage_root=std.format(input="abfss://%s@%s.dfs.core.windows.net/",
|
|
576
|
+
args=[
|
|
577
|
+
unity_catalog["name"],
|
|
578
|
+
unity_catalog_azurerm_storage_account["name"],
|
|
579
|
+
]).result,
|
|
580
|
+
owner="uc admins",
|
|
581
|
+
region="eastus",
|
|
582
|
+
force_destroy=True)
|
|
583
|
+
this_metastore_data_access = databricks.MetastoreDataAccess("this",
|
|
584
|
+
metastore_id=this.id,
|
|
585
|
+
name="mi_dac",
|
|
586
|
+
azure_managed_identity={
|
|
587
|
+
"access_connector_id": access_connector_id,
|
|
588
|
+
},
|
|
589
|
+
is_default=True)
|
|
590
|
+
```
|
|
591
|
+
|
|
544
592
|
## Import
|
|
545
593
|
|
|
546
594
|
This resource can be imported by combination of metastore id and the data access name.
|
|
@@ -252,9 +252,9 @@ class MlflowWebhook(pulumi.CustomResource):
|
|
|
252
252
|
language="PYTHON",
|
|
253
253
|
content_base64=std.base64encode(input=\"\"\"import json
|
|
254
254
|
|
|
255
|
-
event_message = dbutils.widgets.get("event_message")
|
|
255
|
+
event_message = dbutils.widgets.get(\\"event_message\\")
|
|
256
256
|
event_message_dict = json.loads(event_message)
|
|
257
|
-
print(f"event data={event_message_dict}")
|
|
257
|
+
print(f\\"event data={event_message_dict}\\")
|
|
258
258
|
\"\"\").result)
|
|
259
259
|
this_job = databricks.Job("this",
|
|
260
260
|
name=f"Pulumi MLflowWebhook Demo ({me.alphanumeric})",
|
|
@@ -354,9 +354,9 @@ class MlflowWebhook(pulumi.CustomResource):
|
|
|
354
354
|
language="PYTHON",
|
|
355
355
|
content_base64=std.base64encode(input=\"\"\"import json
|
|
356
356
|
|
|
357
|
-
event_message = dbutils.widgets.get("event_message")
|
|
357
|
+
event_message = dbutils.widgets.get(\\"event_message\\")
|
|
358
358
|
event_message_dict = json.loads(event_message)
|
|
359
|
-
print(f"event data={event_message_dict}")
|
|
359
|
+
print(f\\"event data={event_message_dict}\\")
|
|
360
360
|
\"\"\").result)
|
|
361
361
|
this_job = databricks.Job("this",
|
|
362
362
|
name=f"Pulumi MLflowWebhook Demo ({me.alphanumeric})",
|
|
@@ -249,18 +249,18 @@ class MwsCredentials(pulumi.CustomResource):
|
|
|
249
249
|
# Names of created resources will be prefixed with this value
|
|
250
250
|
prefix = config.require_object("prefix")
|
|
251
251
|
this = databricks.get_aws_assume_role_policy(external_id=databricks_account_id)
|
|
252
|
-
cross_account_role = aws.
|
|
253
|
-
name=f
|
|
252
|
+
cross_account_role = aws.index.IamRole("cross_account_role",
|
|
253
|
+
name=f{prefix}-crossaccount,
|
|
254
254
|
assume_role_policy=this.json,
|
|
255
255
|
tags=tags)
|
|
256
256
|
this_get_aws_cross_account_policy = databricks.get_aws_cross_account_policy()
|
|
257
|
-
|
|
258
|
-
name=f
|
|
257
|
+
this_iam_role_policy = aws.index.IamRolePolicy("this",
|
|
258
|
+
name=f{prefix}-policy,
|
|
259
259
|
role=cross_account_role.id,
|
|
260
260
|
policy=this_get_aws_cross_account_policy.json)
|
|
261
261
|
this_mws_credentials = databricks.MwsCredentials("this",
|
|
262
262
|
credentials_name=f"{prefix}-creds",
|
|
263
|
-
role_arn=cross_account_role
|
|
263
|
+
role_arn=cross_account_role["arn"])
|
|
264
264
|
```
|
|
265
265
|
|
|
266
266
|
## Related Resources
|
|
@@ -324,18 +324,18 @@ class MwsCredentials(pulumi.CustomResource):
|
|
|
324
324
|
# Names of created resources will be prefixed with this value
|
|
325
325
|
prefix = config.require_object("prefix")
|
|
326
326
|
this = databricks.get_aws_assume_role_policy(external_id=databricks_account_id)
|
|
327
|
-
cross_account_role = aws.
|
|
328
|
-
name=f
|
|
327
|
+
cross_account_role = aws.index.IamRole("cross_account_role",
|
|
328
|
+
name=f{prefix}-crossaccount,
|
|
329
329
|
assume_role_policy=this.json,
|
|
330
330
|
tags=tags)
|
|
331
331
|
this_get_aws_cross_account_policy = databricks.get_aws_cross_account_policy()
|
|
332
|
-
|
|
333
|
-
name=f
|
|
332
|
+
this_iam_role_policy = aws.index.IamRolePolicy("this",
|
|
333
|
+
name=f{prefix}-policy,
|
|
334
334
|
role=cross_account_role.id,
|
|
335
335
|
policy=this_get_aws_cross_account_policy.json)
|
|
336
336
|
this_mws_credentials = databricks.MwsCredentials("this",
|
|
337
337
|
credentials_name=f"{prefix}-creds",
|
|
338
|
-
role_arn=cross_account_role
|
|
338
|
+
role_arn=cross_account_role["arn"])
|
|
339
339
|
```
|
|
340
340
|
|
|
341
341
|
## Related Resources
|
|
@@ -254,56 +254,6 @@ class MwsCustomerManagedKeys(pulumi.CustomResource):
|
|
|
254
254
|
|
|
255
255
|
You must configure this during workspace creation
|
|
256
256
|
|
|
257
|
-
### For AWS
|
|
258
|
-
|
|
259
|
-
```python
|
|
260
|
-
import pulumi
|
|
261
|
-
import pulumi_aws as aws
|
|
262
|
-
import pulumi_databricks as databricks
|
|
263
|
-
|
|
264
|
-
config = pulumi.Config()
|
|
265
|
-
# Account Id that could be found in the top right corner of https://accounts.cloud.databricks.com/
|
|
266
|
-
databricks_account_id = config.require_object("databricksAccountId")
|
|
267
|
-
current = aws.get_caller_identity()
|
|
268
|
-
databricks_managed_services_cmk = aws.iam.get_policy_document(version="2012-10-17",
|
|
269
|
-
statements=[
|
|
270
|
-
{
|
|
271
|
-
"sid": "Enable IAM User Permissions",
|
|
272
|
-
"effect": "Allow",
|
|
273
|
-
"principals": [{
|
|
274
|
-
"type": "AWS",
|
|
275
|
-
"identifiers": [current.account_id],
|
|
276
|
-
}],
|
|
277
|
-
"actions": ["kms:*"],
|
|
278
|
-
"resources": ["*"],
|
|
279
|
-
},
|
|
280
|
-
{
|
|
281
|
-
"sid": "Allow Databricks to use KMS key for control plane managed services",
|
|
282
|
-
"effect": "Allow",
|
|
283
|
-
"principals": [{
|
|
284
|
-
"type": "AWS",
|
|
285
|
-
"identifiers": ["arn:aws:iam::414351767826:root"],
|
|
286
|
-
}],
|
|
287
|
-
"actions": [
|
|
288
|
-
"kms:Encrypt",
|
|
289
|
-
"kms:Decrypt",
|
|
290
|
-
],
|
|
291
|
-
"resources": ["*"],
|
|
292
|
-
},
|
|
293
|
-
])
|
|
294
|
-
managed_services_customer_managed_key = aws.kms.Key("managed_services_customer_managed_key", policy=databricks_managed_services_cmk.json)
|
|
295
|
-
managed_services_customer_managed_key_alias = aws.kms.Alias("managed_services_customer_managed_key_alias",
|
|
296
|
-
name="alias/managed-services-customer-managed-key-alias",
|
|
297
|
-
target_key_id=managed_services_customer_managed_key.key_id)
|
|
298
|
-
managed_services = databricks.MwsCustomerManagedKeys("managed_services",
|
|
299
|
-
account_id=databricks_account_id,
|
|
300
|
-
aws_key_info={
|
|
301
|
-
"key_arn": managed_services_customer_managed_key.arn,
|
|
302
|
-
"key_alias": managed_services_customer_managed_key_alias.name,
|
|
303
|
-
},
|
|
304
|
-
use_cases=["MANAGED_SERVICES"])
|
|
305
|
-
```
|
|
306
|
-
|
|
307
257
|
### For GCP
|
|
308
258
|
|
|
309
259
|
```python
|
|
@@ -325,100 +275,6 @@ class MwsCustomerManagedKeys(pulumi.CustomResource):
|
|
|
325
275
|
|
|
326
276
|
### Customer-managed key for workspace storage
|
|
327
277
|
|
|
328
|
-
### For AWS
|
|
329
|
-
|
|
330
|
-
```python
|
|
331
|
-
import pulumi
|
|
332
|
-
import pulumi_aws as aws
|
|
333
|
-
import pulumi_databricks as databricks
|
|
334
|
-
|
|
335
|
-
config = pulumi.Config()
|
|
336
|
-
# Account Id that could be found in the top right corner of https://accounts.cloud.databricks.com/
|
|
337
|
-
databricks_account_id = config.require_object("databricksAccountId")
|
|
338
|
-
# AWS ARN for the Databricks cross account role
|
|
339
|
-
databricks_cross_account_role = config.require_object("databricksCrossAccountRole")
|
|
340
|
-
current = aws.get_caller_identity()
|
|
341
|
-
databricks_storage_cmk = aws.iam.get_policy_document(version="2012-10-17",
|
|
342
|
-
statements=[
|
|
343
|
-
{
|
|
344
|
-
"sid": "Enable IAM User Permissions",
|
|
345
|
-
"effect": "Allow",
|
|
346
|
-
"principals": [{
|
|
347
|
-
"type": "AWS",
|
|
348
|
-
"identifiers": [current.account_id],
|
|
349
|
-
}],
|
|
350
|
-
"actions": ["kms:*"],
|
|
351
|
-
"resources": ["*"],
|
|
352
|
-
},
|
|
353
|
-
{
|
|
354
|
-
"sid": "Allow Databricks to use KMS key for DBFS",
|
|
355
|
-
"effect": "Allow",
|
|
356
|
-
"principals": [{
|
|
357
|
-
"type": "AWS",
|
|
358
|
-
"identifiers": ["arn:aws:iam::414351767826:root"],
|
|
359
|
-
}],
|
|
360
|
-
"actions": [
|
|
361
|
-
"kms:Encrypt",
|
|
362
|
-
"kms:Decrypt",
|
|
363
|
-
"kms:ReEncrypt*",
|
|
364
|
-
"kms:GenerateDataKey*",
|
|
365
|
-
"kms:DescribeKey",
|
|
366
|
-
],
|
|
367
|
-
"resources": ["*"],
|
|
368
|
-
},
|
|
369
|
-
{
|
|
370
|
-
"sid": "Allow Databricks to use KMS key for DBFS (Grants)",
|
|
371
|
-
"effect": "Allow",
|
|
372
|
-
"principals": [{
|
|
373
|
-
"type": "AWS",
|
|
374
|
-
"identifiers": ["arn:aws:iam::414351767826:root"],
|
|
375
|
-
}],
|
|
376
|
-
"actions": [
|
|
377
|
-
"kms:CreateGrant",
|
|
378
|
-
"kms:ListGrants",
|
|
379
|
-
"kms:RevokeGrant",
|
|
380
|
-
],
|
|
381
|
-
"resources": ["*"],
|
|
382
|
-
"conditions": [{
|
|
383
|
-
"test": "Bool",
|
|
384
|
-
"variable": "kms:GrantIsForAWSResource",
|
|
385
|
-
"values": ["true"],
|
|
386
|
-
}],
|
|
387
|
-
},
|
|
388
|
-
{
|
|
389
|
-
"sid": "Allow Databricks to use KMS key for EBS",
|
|
390
|
-
"effect": "Allow",
|
|
391
|
-
"principals": [{
|
|
392
|
-
"type": "AWS",
|
|
393
|
-
"identifiers": [databricks_cross_account_role],
|
|
394
|
-
}],
|
|
395
|
-
"actions": [
|
|
396
|
-
"kms:Decrypt",
|
|
397
|
-
"kms:GenerateDataKey*",
|
|
398
|
-
"kms:CreateGrant",
|
|
399
|
-
"kms:DescribeKey",
|
|
400
|
-
],
|
|
401
|
-
"resources": ["*"],
|
|
402
|
-
"conditions": [{
|
|
403
|
-
"test": "ForAnyValue:StringLike",
|
|
404
|
-
"variable": "kms:ViaService",
|
|
405
|
-
"values": ["ec2.*.amazonaws.com"],
|
|
406
|
-
}],
|
|
407
|
-
},
|
|
408
|
-
])
|
|
409
|
-
storage_customer_managed_key = aws.kms.Key("storage_customer_managed_key", policy=databricks_storage_cmk.json)
|
|
410
|
-
storage_customer_managed_key_alias = aws.kms.Alias("storage_customer_managed_key_alias",
|
|
411
|
-
name="alias/storage-customer-managed-key-alias",
|
|
412
|
-
target_key_id=storage_customer_managed_key.key_id)
|
|
413
|
-
storage = databricks.MwsCustomerManagedKeys("storage",
|
|
414
|
-
account_id=databricks_account_id,
|
|
415
|
-
aws_key_info={
|
|
416
|
-
"key_arn": storage_customer_managed_key.arn,
|
|
417
|
-
"key_alias": storage_customer_managed_key_alias.name,
|
|
418
|
-
},
|
|
419
|
-
use_cases=["STORAGE"])
|
|
420
|
-
```
|
|
421
|
-
|
|
422
278
|
### For GCP
|
|
423
279
|
|
|
424
280
|
```python
|
|
@@ -501,56 +357,6 @@ class MwsCustomerManagedKeys(pulumi.CustomResource):
|
|
|
501
357
|
|
|
502
358
|
You must configure this during workspace creation
|
|
503
359
|
|
|
504
|
-
### For AWS
|
|
505
|
-
|
|
506
|
-
```python
|
|
507
|
-
import pulumi
|
|
508
|
-
import pulumi_aws as aws
|
|
509
|
-
import pulumi_databricks as databricks
|
|
510
|
-
|
|
511
|
-
config = pulumi.Config()
|
|
512
|
-
# Account Id that could be found in the top right corner of https://accounts.cloud.databricks.com/
|
|
513
|
-
databricks_account_id = config.require_object("databricksAccountId")
|
|
514
|
-
current = aws.get_caller_identity()
|
|
515
|
-
databricks_managed_services_cmk = aws.iam.get_policy_document(version="2012-10-17",
|
|
516
|
-
statements=[
|
|
517
|
-
{
|
|
518
|
-
"sid": "Enable IAM User Permissions",
|
|
519
|
-
"effect": "Allow",
|
|
520
|
-
"principals": [{
|
|
521
|
-
"type": "AWS",
|
|
522
|
-
"identifiers": [current.account_id],
|
|
523
|
-
}],
|
|
524
|
-
"actions": ["kms:*"],
|
|
525
|
-
"resources": ["*"],
|
|
526
|
-
},
|
|
527
|
-
{
|
|
528
|
-
"sid": "Allow Databricks to use KMS key for control plane managed services",
|
|
529
|
-
"effect": "Allow",
|
|
530
|
-
"principals": [{
|
|
531
|
-
"type": "AWS",
|
|
532
|
-
"identifiers": ["arn:aws:iam::414351767826:root"],
|
|
533
|
-
}],
|
|
534
|
-
"actions": [
|
|
535
|
-
"kms:Encrypt",
|
|
536
|
-
"kms:Decrypt",
|
|
537
|
-
],
|
|
538
|
-
"resources": ["*"],
|
|
539
|
-
},
|
|
540
|
-
])
|
|
541
|
-
managed_services_customer_managed_key = aws.kms.Key("managed_services_customer_managed_key", policy=databricks_managed_services_cmk.json)
|
|
542
|
-
managed_services_customer_managed_key_alias = aws.kms.Alias("managed_services_customer_managed_key_alias",
|
|
543
|
-
name="alias/managed-services-customer-managed-key-alias",
|
|
544
|
-
target_key_id=managed_services_customer_managed_key.key_id)
|
|
545
|
-
managed_services = databricks.MwsCustomerManagedKeys("managed_services",
|
|
546
|
-
account_id=databricks_account_id,
|
|
547
|
-
aws_key_info={
|
|
548
|
-
"key_arn": managed_services_customer_managed_key.arn,
|
|
549
|
-
"key_alias": managed_services_customer_managed_key_alias.name,
|
|
550
|
-
},
|
|
551
|
-
use_cases=["MANAGED_SERVICES"])
|
|
552
|
-
```
|
|
553
|
-
|
|
554
360
|
### For GCP
|
|
555
361
|
|
|
556
362
|
```python
|
|
@@ -572,100 +378,6 @@ class MwsCustomerManagedKeys(pulumi.CustomResource):
|
|
|
572
378
|
|
|
573
379
|
### Customer-managed key for workspace storage
|
|
574
380
|
|
|
575
|
-
### For AWS
|
|
576
|
-
|
|
577
|
-
```python
|
|
578
|
-
import pulumi
|
|
579
|
-
import pulumi_aws as aws
|
|
580
|
-
import pulumi_databricks as databricks
|
|
581
|
-
|
|
582
|
-
config = pulumi.Config()
|
|
583
|
-
# Account Id that could be found in the top right corner of https://accounts.cloud.databricks.com/
|
|
584
|
-
databricks_account_id = config.require_object("databricksAccountId")
|
|
585
|
-
# AWS ARN for the Databricks cross account role
|
|
586
|
-
databricks_cross_account_role = config.require_object("databricksCrossAccountRole")
|
|
587
|
-
current = aws.get_caller_identity()
|
|
588
|
-
databricks_storage_cmk = aws.iam.get_policy_document(version="2012-10-17",
|
|
589
|
-
statements=[
|
|
590
|
-
{
|
|
591
|
-
"sid": "Enable IAM User Permissions",
|
|
592
|
-
"effect": "Allow",
|
|
593
|
-
"principals": [{
|
|
594
|
-
"type": "AWS",
|
|
595
|
-
"identifiers": [current.account_id],
|
|
596
|
-
}],
|
|
597
|
-
"actions": ["kms:*"],
|
|
598
|
-
"resources": ["*"],
|
|
599
|
-
},
|
|
600
|
-
{
|
|
601
|
-
"sid": "Allow Databricks to use KMS key for DBFS",
|
|
602
|
-
"effect": "Allow",
|
|
603
|
-
"principals": [{
|
|
604
|
-
"type": "AWS",
|
|
605
|
-
"identifiers": ["arn:aws:iam::414351767826:root"],
|
|
606
|
-
}],
|
|
607
|
-
"actions": [
|
|
608
|
-
"kms:Encrypt",
|
|
609
|
-
"kms:Decrypt",
|
|
610
|
-
"kms:ReEncrypt*",
|
|
611
|
-
"kms:GenerateDataKey*",
|
|
612
|
-
"kms:DescribeKey",
|
|
613
|
-
],
|
|
614
|
-
"resources": ["*"],
|
|
615
|
-
},
|
|
616
|
-
{
|
|
617
|
-
"sid": "Allow Databricks to use KMS key for DBFS (Grants)",
|
|
618
|
-
"effect": "Allow",
|
|
619
|
-
"principals": [{
|
|
620
|
-
"type": "AWS",
|
|
621
|
-
"identifiers": ["arn:aws:iam::414351767826:root"],
|
|
622
|
-
}],
|
|
623
|
-
"actions": [
|
|
624
|
-
"kms:CreateGrant",
|
|
625
|
-
"kms:ListGrants",
|
|
626
|
-
"kms:RevokeGrant",
|
|
627
|
-
],
|
|
628
|
-
"resources": ["*"],
|
|
629
|
-
"conditions": [{
|
|
630
|
-
"test": "Bool",
|
|
631
|
-
"variable": "kms:GrantIsForAWSResource",
|
|
632
|
-
"values": ["true"],
|
|
633
|
-
}],
|
|
634
|
-
},
|
|
635
|
-
{
|
|
636
|
-
"sid": "Allow Databricks to use KMS key for EBS",
|
|
637
|
-
"effect": "Allow",
|
|
638
|
-
"principals": [{
|
|
639
|
-
"type": "AWS",
|
|
640
|
-
"identifiers": [databricks_cross_account_role],
|
|
641
|
-
}],
|
|
642
|
-
"actions": [
|
|
643
|
-
"kms:Decrypt",
|
|
644
|
-
"kms:GenerateDataKey*",
|
|
645
|
-
"kms:CreateGrant",
|
|
646
|
-
"kms:DescribeKey",
|
|
647
|
-
],
|
|
648
|
-
"resources": ["*"],
|
|
649
|
-
"conditions": [{
|
|
650
|
-
"test": "ForAnyValue:StringLike",
|
|
651
|
-
"variable": "kms:ViaService",
|
|
652
|
-
"values": ["ec2.*.amazonaws.com"],
|
|
653
|
-
}],
|
|
654
|
-
},
|
|
655
|
-
])
|
|
656
|
-
storage_customer_managed_key = aws.kms.Key("storage_customer_managed_key", policy=databricks_storage_cmk.json)
|
|
657
|
-
storage_customer_managed_key_alias = aws.kms.Alias("storage_customer_managed_key_alias",
|
|
658
|
-
name="alias/storage-customer-managed-key-alias",
|
|
659
|
-
target_key_id=storage_customer_managed_key.key_id)
|
|
660
|
-
storage = databricks.MwsCustomerManagedKeys("storage",
|
|
661
|
-
account_id=databricks_account_id,
|
|
662
|
-
aws_key_info={
|
|
663
|
-
"key_arn": storage_customer_managed_key.arn,
|
|
664
|
-
"key_alias": storage_customer_managed_key_alias.name,
|
|
665
|
-
},
|
|
666
|
-
use_cases=["STORAGE"])
|
|
667
|
-
```
|
|
668
|
-
|
|
669
381
|
### For GCP
|
|
670
382
|
|
|
671
383
|
```python
|