pulumi-databricks 1.78.0a1762407761__py3-none-any.whl → 1.79.0__py3-none-any.whl

pulumi_databricks/permission_assignment.py

@@ -13,6 +13,8 @@ if sys.version_info >= (3, 11):
 else:
     from typing_extensions import NotRequired, TypedDict, TypeAlias
 from . import _utilities
+from . import outputs
+from ._inputs import *
 
 __all__ = ['PermissionAssignmentArgs', 'PermissionAssignment']
 
@@ -22,6 +24,7 @@ class PermissionAssignmentArgs:
                  permissions: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]],
                  group_name: Optional[pulumi.Input[_builtins.str]] = None,
                  principal_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 provider_config: Optional[pulumi.Input['PermissionAssignmentProviderConfigArgs']] = None,
                  service_principal_name: Optional[pulumi.Input[_builtins.str]] = None,
                  user_name: Optional[pulumi.Input[_builtins.str]] = None):
         """
@@ -31,6 +34,7 @@ class PermissionAssignmentArgs:
                * `"ADMIN"` - Adds principal to the workspace `admins` group. This gives workspace admin privileges to manage users and groups, workspace configurations, and more.
         :param pulumi.Input[_builtins.str] group_name: the group name to assign to a workspace.
         :param pulumi.Input[_builtins.str] principal_id: Databricks ID of the user, service principal, or group. The principal ID can be retrieved using the account-level SCIM API, or using databricks_user, ServicePrincipal or Group data sources with account API (and has to be an account admin). A more sensible approach is to retrieve the list of `principal_id` as outputs from another Pulumi stack.
+        :param pulumi.Input['PermissionAssignmentProviderConfigArgs'] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
         :param pulumi.Input[_builtins.str] service_principal_name: the application ID of service principal to assign to a workspace.
         :param pulumi.Input[_builtins.str] user_name: the user name (email) to assign to a workspace.
         """
@@ -39,6 +43,8 @@ class PermissionAssignmentArgs:
             pulumi.set(__self__, "group_name", group_name)
         if principal_id is not None:
             pulumi.set(__self__, "principal_id", principal_id)
+        if provider_config is not None:
+            pulumi.set(__self__, "provider_config", provider_config)
         if service_principal_name is not None:
             pulumi.set(__self__, "service_principal_name", service_principal_name)
         if user_name is not None:
@@ -82,6 +88,18 @@ class PermissionAssignmentArgs:
     def principal_id(self, value: Optional[pulumi.Input[_builtins.str]]):
         pulumi.set(self, "principal_id", value)
 
+    @_builtins.property
+    @pulumi.getter(name="providerConfig")
+    def provider_config(self) -> Optional[pulumi.Input['PermissionAssignmentProviderConfigArgs']]:
+        """
+        Configure the provider for management through account provider. This block consists of the following fields:
+        """
+        return pulumi.get(self, "provider_config")
+
+    @provider_config.setter
+    def provider_config(self, value: Optional[pulumi.Input['PermissionAssignmentProviderConfigArgs']]):
+        pulumi.set(self, "provider_config", value)
+
     @_builtins.property
     @pulumi.getter(name="servicePrincipalName")
     def service_principal_name(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -114,6 +132,7 @@ class _PermissionAssignmentState:
                  group_name: Optional[pulumi.Input[_builtins.str]] = None,
                  permissions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                  principal_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 provider_config: Optional[pulumi.Input['PermissionAssignmentProviderConfigArgs']] = None,
                  service_principal_name: Optional[pulumi.Input[_builtins.str]] = None,
                  user_name: Optional[pulumi.Input[_builtins.str]] = None):
         """
@@ -124,6 +143,7 @@ class _PermissionAssignmentState:
                * `"USER"` - Adds principal to the workspace `users` group. This gives basic workspace access.
                * `"ADMIN"` - Adds principal to the workspace `admins` group. This gives workspace admin privileges to manage users and groups, workspace configurations, and more.
         :param pulumi.Input[_builtins.str] principal_id: Databricks ID of the user, service principal, or group. The principal ID can be retrieved using the account-level SCIM API, or using databricks_user, ServicePrincipal or Group data sources with account API (and has to be an account admin). A more sensible approach is to retrieve the list of `principal_id` as outputs from another Pulumi stack.
+        :param pulumi.Input['PermissionAssignmentProviderConfigArgs'] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
         :param pulumi.Input[_builtins.str] service_principal_name: the application ID of service principal to assign to a workspace.
         :param pulumi.Input[_builtins.str] user_name: the user name (email) to assign to a workspace.
         """
@@ -135,6 +155,8 @@ class _PermissionAssignmentState:
             pulumi.set(__self__, "permissions", permissions)
         if principal_id is not None:
             pulumi.set(__self__, "principal_id", principal_id)
+        if provider_config is not None:
+            pulumi.set(__self__, "provider_config", provider_config)
         if service_principal_name is not None:
             pulumi.set(__self__, "service_principal_name", service_principal_name)
         if user_name is not None:
@@ -190,6 +212,18 @@ class _PermissionAssignmentState:
     def principal_id(self, value: Optional[pulumi.Input[_builtins.str]]):
         pulumi.set(self, "principal_id", value)
 
+    @_builtins.property
+    @pulumi.getter(name="providerConfig")
+    def provider_config(self) -> Optional[pulumi.Input['PermissionAssignmentProviderConfigArgs']]:
+        """
+        Configure the provider for management through account provider. This block consists of the following fields:
+        """
+        return pulumi.get(self, "provider_config")
+
+    @provider_config.setter
+    def provider_config(self, value: Optional[pulumi.Input['PermissionAssignmentProviderConfigArgs']]):
+        pulumi.set(self, "provider_config", value)
+
     @_builtins.property
     @pulumi.getter(name="servicePrincipalName")
     def service_principal_name(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -224,6 +258,7 @@ class PermissionAssignment(pulumi.CustomResource):
                  group_name: Optional[pulumi.Input[_builtins.str]] = None,
                  permissions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                  principal_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 provider_config: Optional[pulumi.Input[Union['PermissionAssignmentProviderConfigArgs', 'PermissionAssignmentProviderConfigArgsDict']]] = None,
                  service_principal_name: Optional[pulumi.Input[_builtins.str]] = None,
                  user_name: Optional[pulumi.Input[_builtins.str]] = None,
                  __props__=None):
@@ -351,6 +386,7 @@ class PermissionAssignment(pulumi.CustomResource):
                * `"USER"` - Adds principal to the workspace `users` group. This gives basic workspace access.
                * `"ADMIN"` - Adds principal to the workspace `admins` group. This gives workspace admin privileges to manage users and groups, workspace configurations, and more.
         :param pulumi.Input[_builtins.str] principal_id: Databricks ID of the user, service principal, or group. The principal ID can be retrieved using the account-level SCIM API, or using databricks_user, ServicePrincipal or Group data sources with account API (and has to be an account admin). A more sensible approach is to retrieve the list of `principal_id` as outputs from another Pulumi stack.
+        :param pulumi.Input[Union['PermissionAssignmentProviderConfigArgs', 'PermissionAssignmentProviderConfigArgsDict']] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
         :param pulumi.Input[_builtins.str] service_principal_name: the application ID of service principal to assign to a workspace.
         :param pulumi.Input[_builtins.str] user_name: the user name (email) to assign to a workspace.
         """
@@ -495,6 +531,7 @@ class PermissionAssignment(pulumi.CustomResource):
                  group_name: Optional[pulumi.Input[_builtins.str]] = None,
                  permissions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                  principal_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 provider_config: Optional[pulumi.Input[Union['PermissionAssignmentProviderConfigArgs', 'PermissionAssignmentProviderConfigArgsDict']]] = None,
                  service_principal_name: Optional[pulumi.Input[_builtins.str]] = None,
                  user_name: Optional[pulumi.Input[_builtins.str]] = None,
                  __props__=None):
@@ -511,6 +548,7 @@ class PermissionAssignment(pulumi.CustomResource):
                 raise TypeError("Missing required property 'permissions'")
             __props__.__dict__["permissions"] = permissions
             __props__.__dict__["principal_id"] = principal_id
+            __props__.__dict__["provider_config"] = provider_config
             __props__.__dict__["service_principal_name"] = service_principal_name
             __props__.__dict__["user_name"] = user_name
             __props__.__dict__["display_name"] = None
@@ -528,6 +566,7 @@ class PermissionAssignment(pulumi.CustomResource):
             group_name: Optional[pulumi.Input[_builtins.str]] = None,
             permissions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
             principal_id: Optional[pulumi.Input[_builtins.str]] = None,
+            provider_config: Optional[pulumi.Input[Union['PermissionAssignmentProviderConfigArgs', 'PermissionAssignmentProviderConfigArgsDict']]] = None,
             service_principal_name: Optional[pulumi.Input[_builtins.str]] = None,
             user_name: Optional[pulumi.Input[_builtins.str]] = None) -> 'PermissionAssignment':
         """
@@ -543,6 +582,7 @@ class PermissionAssignment(pulumi.CustomResource):
                * `"USER"` - Adds principal to the workspace `users` group. This gives basic workspace access.
                * `"ADMIN"` - Adds principal to the workspace `admins` group. This gives workspace admin privileges to manage users and groups, workspace configurations, and more.
         :param pulumi.Input[_builtins.str] principal_id: Databricks ID of the user, service principal, or group. The principal ID can be retrieved using the account-level SCIM API, or using databricks_user, ServicePrincipal or Group data sources with account API (and has to be an account admin). A more sensible approach is to retrieve the list of `principal_id` as outputs from another Pulumi stack.
+        :param pulumi.Input[Union['PermissionAssignmentProviderConfigArgs', 'PermissionAssignmentProviderConfigArgsDict']] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
         :param pulumi.Input[_builtins.str] service_principal_name: the application ID of service principal to assign to a workspace.
         :param pulumi.Input[_builtins.str] user_name: the user name (email) to assign to a workspace.
         """
@@ -554,6 +594,7 @@ class PermissionAssignment(pulumi.CustomResource):
         __props__.__dict__["group_name"] = group_name
         __props__.__dict__["permissions"] = permissions
         __props__.__dict__["principal_id"] = principal_id
+        __props__.__dict__["provider_config"] = provider_config
         __props__.__dict__["service_principal_name"] = service_principal_name
         __props__.__dict__["user_name"] = user_name
         return PermissionAssignment(resource_name, opts=opts, __props__=__props__)
@@ -592,6 +633,14 @@ class PermissionAssignment(pulumi.CustomResource):
         """
         return pulumi.get(self, "principal_id")
 
+    @_builtins.property
+    @pulumi.getter(name="providerConfig")
+    def provider_config(self) -> pulumi.Output[Optional['outputs.PermissionAssignmentProviderConfig']]:
+        """
+        Configure the provider for management through account provider. This block consists of the following fields:
+        """
+        return pulumi.get(self, "provider_config")
+
     @_builtins.property
     @pulumi.getter(name="servicePrincipalName")
     def service_principal_name(self) -> pulumi.Output[_builtins.str]:

pulumi_databricks/permissions.py

@@ -941,12 +941,12 @@ class Permissions(pulumi.CustomResource):
         eng = databricks.Group("eng", display_name="Engineering")
         ldp_demo = databricks.Notebook("ldp_demo",
             content_base64=std.base64encode(input=\"\"\"import dlt
-        json_path = "/databricks-datasets/wikipedia-datasets/data-001/clickstream/raw-uncompressed-json/2015_2_clickstream.json"
+        json_path = \\"/databricks-datasets/wikipedia-datasets/data-001/clickstream/raw-uncompressed-json/2015_2_clickstream.json\\"
         @dlt.table(
-           comment="The raw wikipedia clickstream dataset, ingested from /databricks-datasets."
+           comment=\\"The raw wikipedia clickstream dataset, ingested from /databricks-datasets.\\"
         )
         def clickstream_raw():
-            return (spark.read.format("json").load(json_path))
+            return (spark.read.format(\\"json\\").load(json_path))
         \"\"\").result,
             language="PYTHON",
             path=f"{me.home}/ldp_demo")
@@ -1778,12 +1778,12 @@ class Permissions(pulumi.CustomResource):
         eng = databricks.Group("eng", display_name="Engineering")
         ldp_demo = databricks.Notebook("ldp_demo",
             content_base64=std.base64encode(input=\"\"\"import dlt
-        json_path = "/databricks-datasets/wikipedia-datasets/data-001/clickstream/raw-uncompressed-json/2015_2_clickstream.json"
+        json_path = \\"/databricks-datasets/wikipedia-datasets/data-001/clickstream/raw-uncompressed-json/2015_2_clickstream.json\\"
         @dlt.table(
-           comment="The raw wikipedia clickstream dataset, ingested from /databricks-datasets."
+           comment=\\"The raw wikipedia clickstream dataset, ingested from /databricks-datasets.\\"
         )
         def clickstream_raw():
-            return (spark.read.format("json").load(json_path))
+            return (spark.read.format(\\"json\\").load(json_path))
         \"\"\").result,
             language="PYTHON",
             path=f"{me.home}/ldp_demo")

pulumi_databricks/pipeline.py

@@ -64,7 +64,7 @@ class PipelineArgs:
         The set of arguments for constructing a Pipeline resource.
         :param pulumi.Input[_builtins.bool] allow_duplicate_names: Optional boolean flag. If false, deployment will fail if name conflicts with that of another pipeline. default is `false`.
         :param pulumi.Input[_builtins.str] budget_policy_id: optional string specifying ID of the budget policy for this Lakeflow Declarative Pipeline.
-        :param pulumi.Input[_builtins.str] catalog: The name of catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline.* (Conflicts with `storage`).
+        :param pulumi.Input[_builtins.str] catalog: The name of default catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline if you switch from `storage` to `catalog` or vice versa.  If pipeline was already created with `catalog` set, the value could be changed.* (Conflicts with `storage`).
         :param pulumi.Input[_builtins.str] channel: optional name of the release channel for Spark version used by Lakeflow Declarative Pipeline.  Supported values are: `CURRENT` (default) and `PREVIEW`.
         :param pulumi.Input[Sequence[pulumi.Input['PipelineClusterArgs']]] clusters: blocks - Clusters to run the pipeline. If none is specified, pipelines will automatically select a default cluster configuration for the pipeline. *Please note that Lakeflow Declarative Pipeline clusters are supporting only subset of attributes as described in [documentation](https://docs.databricks.com/api/workspace/pipelines/create#clusters).*  Also, note that `autoscale` block is extended with the `mode` parameter that controls the autoscaling algorithm (possible values are `ENHANCED` for new, enhanced autoscaling algorithm, or `LEGACY` for old algorithm).
         :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] configuration: An optional list of values to apply to the entire pipeline. Elements must be formatted as key:value pairs.
@@ -193,7 +193,7 @@ class PipelineArgs:
     @pulumi.getter
     def catalog(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        The name of catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline.* (Conflicts with `storage`).
+        The name of default catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline if you switch from `storage` to `catalog` or vice versa.  If pipeline was already created with `catalog` set, the value could be changed.* (Conflicts with `storage`).
         """
         return pulumi.get(self, "catalog")
 
@@ -632,7 +632,7 @@ class _PipelineState:
         Input properties used for looking up and filtering Pipeline resources.
         :param pulumi.Input[_builtins.bool] allow_duplicate_names: Optional boolean flag. If false, deployment will fail if name conflicts with that of another pipeline. default is `false`.
         :param pulumi.Input[_builtins.str] budget_policy_id: optional string specifying ID of the budget policy for this Lakeflow Declarative Pipeline.
-        :param pulumi.Input[_builtins.str] catalog: The name of catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline.* (Conflicts with `storage`).
+        :param pulumi.Input[_builtins.str] catalog: The name of default catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline if you switch from `storage` to `catalog` or vice versa.  If pipeline was already created with `catalog` set, the value could be changed.* (Conflicts with `storage`).
         :param pulumi.Input[_builtins.str] channel: optional name of the release channel for Spark version used by Lakeflow Declarative Pipeline.  Supported values are: `CURRENT` (default) and `PREVIEW`.
         :param pulumi.Input[Sequence[pulumi.Input['PipelineClusterArgs']]] clusters: blocks - Clusters to run the pipeline. If none is specified, pipelines will automatically select a default cluster configuration for the pipeline. *Please note that Lakeflow Declarative Pipeline clusters are supporting only subset of attributes as described in [documentation](https://docs.databricks.com/api/workspace/pipelines/create#clusters).*  Also, note that `autoscale` block is extended with the `mode` parameter that controls the autoscaling algorithm (possible values are `ENHANCED` for new, enhanced autoscaling algorithm, or `LEGACY` for old algorithm).
         :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] configuration: An optional list of values to apply to the entire pipeline. Elements must be formatted as key:value pairs.
@@ -761,7 +761,7 @@ class _PipelineState:
     @pulumi.getter
     def catalog(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        The name of catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline.* (Conflicts with `storage`).
+        The name of default catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline if you switch from `storage` to `catalog` or vice versa.  If pipeline was already created with `catalog` set, the value could be changed.* (Conflicts with `storage`).
         """
         return pulumi.get(self, "catalog")
 
@@ -1305,7 +1305,7 @@ class Pipeline(pulumi.CustomResource):
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[_builtins.bool] allow_duplicate_names: Optional boolean flag. If false, deployment will fail if name conflicts with that of another pipeline. default is `false`.
         :param pulumi.Input[_builtins.str] budget_policy_id: optional string specifying ID of the budget policy for this Lakeflow Declarative Pipeline.
-        :param pulumi.Input[_builtins.str] catalog: The name of catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline.* (Conflicts with `storage`).
+        :param pulumi.Input[_builtins.str] catalog: The name of default catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline if you switch from `storage` to `catalog` or vice versa.  If pipeline was already created with `catalog` set, the value could be changed.* (Conflicts with `storage`).
         :param pulumi.Input[_builtins.str] channel: optional name of the release channel for Spark version used by Lakeflow Declarative Pipeline.  Supported values are: `CURRENT` (default) and `PREVIEW`.
         :param pulumi.Input[Sequence[pulumi.Input[Union['PipelineClusterArgs', 'PipelineClusterArgsDict']]]] clusters: blocks - Clusters to run the pipeline. If none is specified, pipelines will automatically select a default cluster configuration for the pipeline. *Please note that Lakeflow Declarative Pipeline clusters are supporting only subset of attributes as described in [documentation](https://docs.databricks.com/api/workspace/pipelines/create#clusters).*  Also, note that `autoscale` block is extended with the `mode` parameter that controls the autoscaling algorithm (possible values are `ENHANCED` for new, enhanced autoscaling algorithm, or `LEGACY` for old algorithm).
         :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] configuration: An optional list of values to apply to the entire pipeline. Elements must be formatted as key:value pairs.
@@ -1594,7 +1594,7 @@ class Pipeline(pulumi.CustomResource):
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[_builtins.bool] allow_duplicate_names: Optional boolean flag. If false, deployment will fail if name conflicts with that of another pipeline. default is `false`.
         :param pulumi.Input[_builtins.str] budget_policy_id: optional string specifying ID of the budget policy for this Lakeflow Declarative Pipeline.
-        :param pulumi.Input[_builtins.str] catalog: The name of catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline.* (Conflicts with `storage`).
+        :param pulumi.Input[_builtins.str] catalog: The name of default catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline if you switch from `storage` to `catalog` or vice versa.  If pipeline was already created with `catalog` set, the value could be changed.* (Conflicts with `storage`).
         :param pulumi.Input[_builtins.str] channel: optional name of the release channel for Spark version used by Lakeflow Declarative Pipeline.  Supported values are: `CURRENT` (default) and `PREVIEW`.
         :param pulumi.Input[Sequence[pulumi.Input[Union['PipelineClusterArgs', 'PipelineClusterArgsDict']]]] clusters: blocks - Clusters to run the pipeline. If none is specified, pipelines will automatically select a default cluster configuration for the pipeline. *Please note that Lakeflow Declarative Pipeline clusters are supporting only subset of attributes as described in [documentation](https://docs.databricks.com/api/workspace/pipelines/create#clusters).*  Also, note that `autoscale` block is extended with the `mode` parameter that controls the autoscaling algorithm (possible values are `ENHANCED` for new, enhanced autoscaling algorithm, or `LEGACY` for old algorithm).
         :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] configuration: An optional list of values to apply to the entire pipeline. Elements must be formatted as key:value pairs.
@@ -1681,7 +1681,7 @@ class Pipeline(pulumi.CustomResource):
     @pulumi.getter
     def catalog(self) -> pulumi.Output[Optional[_builtins.str]]:
         """
-        The name of catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline.* (Conflicts with `storage`).
+        The name of default catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline if you switch from `storage` to `catalog` or vice versa.  If pipeline was already created with `catalog` set, the value could be changed.* (Conflicts with `storage`).
         """
         return pulumi.get(self, "catalog")
 

pulumi_databricks/policy_info.py

@@ -551,7 +551,67 @@ class PolicyInfo(pulumi.CustomResource):
                  when_condition: Optional[pulumi.Input[_builtins.str]] = None,
                  __props__=None):
         """
-        [![Public Beta](https://img.shields.io/badge/Release_Stage-Public_Beta-orange)](https://docs.databricks.com/aws/en/release-notes/release-types)
+        [![Public Preview](https://img.shields.io/badge/Release_Stage-Public_Preview-yellowgreen)](https://docs.databricks.com/aws/en/release-notes/release-types)
+
+        Attribute-Based Access Control (ABAC) policies in Unity Catalog provide high leverage governance for enforcing compliance policies. With ABAC policies, access is controlled in a hierarchical and scalable manner, based on data attributes rather than specific resources, enabling more flexible and comprehensive access control.
+
+        ABAC policies in Unity Catalog support conditions on governance tags and the user identity. Callers must have the `MANAGE` privilege on a securable to view, create, update, or delete ABAC policies.
+
+        ## Example Usage
+
+        ### Row Filter Policy
+
+        ```python
+        import pulumi
+        import pulumi_databricks as databricks
+
+        pii_row_filter = databricks.PolicyInfo("pii_row_filter",
+            on_securable_type="catalog",
+            on_securable_fullname="main",
+            name="pii_data_policy",
+            policy_type="POLICY_TYPE_ROW_FILTER",
+            for_securable_type="table",
+            to_principals=["account users"],
+            when_condition="hasTag('pii')",
+            match_columns=[{
+                "condition": "hasTag('pii')",
+                "alias": "pii_col",
+            }],
+            row_filter={
+                "function_name": "main.filters.mask_pii_rows",
+                "usings": [{
+                    "alias": "pii_col",
+                }],
+            })
+        ```
+
+        ### Column Mask Policy
+
+        ```python
+        import pulumi
+        import pulumi_databricks as databricks
+
+        sensitive_column_mask = databricks.PolicyInfo("sensitive_column_mask",
+            on_securable_type="schema",
+            on_securable_fullname="main.finance",
+            name="sensitive_data_mask",
+            policy_type="POLICY_TYPE_COLUMN_MASK",
+            for_securable_type="table",
+            to_principals=["account users"],
+            except_principals=["finance_admins"],
+            when_condition="hasTag('pii')",
+            match_columns=[{
+                "condition": "hasTag('pii')",
+                "alias": "sensitive_col",
+            }],
+            column_mask={
+                "function_name": "main.masks.redact_sensitive",
+                "on_column": "sensitive_col",
+                "usings": [{
+                    "constant": "4",
+                }],
+            })
+        ```
 
         ## Import
 
@@ -608,7 +668,67 @@ class PolicyInfo(pulumi.CustomResource):
                  args: PolicyInfoArgs,
                  opts: Optional[pulumi.ResourceOptions] = None):
         """
-        [![Public Beta](https://img.shields.io/badge/Release_Stage-Public_Beta-orange)](https://docs.databricks.com/aws/en/release-notes/release-types)
+        [![Public Preview](https://img.shields.io/badge/Release_Stage-Public_Preview-yellowgreen)](https://docs.databricks.com/aws/en/release-notes/release-types)
+
+        Attribute-Based Access Control (ABAC) policies in Unity Catalog provide high leverage governance for enforcing compliance policies. With ABAC policies, access is controlled in a hierarchical and scalable manner, based on data attributes rather than specific resources, enabling more flexible and comprehensive access control.
+
+        ABAC policies in Unity Catalog support conditions on governance tags and the user identity. Callers must have the `MANAGE` privilege on a securable to view, create, update, or delete ABAC policies.
+
+        ## Example Usage
+
+        ### Row Filter Policy
+
+        ```python
+        import pulumi
+        import pulumi_databricks as databricks
+
+        pii_row_filter = databricks.PolicyInfo("pii_row_filter",
+            on_securable_type="catalog",
+            on_securable_fullname="main",
+            name="pii_data_policy",
+            policy_type="POLICY_TYPE_ROW_FILTER",
+            for_securable_type="table",
+            to_principals=["account users"],
+            when_condition="hasTag('pii')",
+            match_columns=[{
+                "condition": "hasTag('pii')",
+                "alias": "pii_col",
+            }],
+            row_filter={
+                "function_name": "main.filters.mask_pii_rows",
+                "usings": [{
+                    "alias": "pii_col",
+                }],
+            })
+        ```
+
+        ### Column Mask Policy
+
+        ```python
+        import pulumi
+        import pulumi_databricks as databricks
+
+        sensitive_column_mask = databricks.PolicyInfo("sensitive_column_mask",
+            on_securable_type="schema",
+            on_securable_fullname="main.finance",
+            name="sensitive_data_mask",
+            policy_type="POLICY_TYPE_COLUMN_MASK",
+            for_securable_type="table",
+            to_principals=["account users"],
+            except_principals=["finance_admins"],
+            when_condition="hasTag('pii')",
+            match_columns=[{
+                "condition": "hasTag('pii')",
+                "alias": "sensitive_col",
+            }],
+            column_mask={
+                "function_name": "main.masks.redact_sensitive",
+                "on_column": "sensitive_col",
+                "usings": [{
+                    "constant": "4",
+                }],
+            })
+        ```
 
         ## Import
 

pulumi_databricks/provider.py

@@ -39,6 +39,7 @@ class ProviderArgs:
                  databricks_id_token_filepath: Optional[pulumi.Input[_builtins.str]] = None,
                  debug_headers: Optional[pulumi.Input[_builtins.bool]] = None,
                  debug_truncate_bytes: Optional[pulumi.Input[_builtins.int]] = None,
+                 experimental_is_unified_host: Optional[pulumi.Input[_builtins.bool]] = None,
                  google_credentials: Optional[pulumi.Input[_builtins.str]] = None,
                  google_service_account: Optional[pulumi.Input[_builtins.str]] = None,
                  host: Optional[pulumi.Input[_builtins.str]] = None,
@@ -54,7 +55,8 @@ class ProviderArgs:
                  skip_verify: Optional[pulumi.Input[_builtins.bool]] = None,
                  token: Optional[pulumi.Input[_builtins.str]] = None,
                  username: Optional[pulumi.Input[_builtins.str]] = None,
-                 warehouse_id: Optional[pulumi.Input[_builtins.str]] = None):
+                 warehouse_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 workspace_id: Optional[pulumi.Input[_builtins.str]] = None):
         """
         The set of arguments for constructing a Provider resource.
         """
@@ -98,6 +100,8 @@ class ProviderArgs:
             pulumi.set(__self__, "debug_headers", debug_headers)
         if debug_truncate_bytes is not None:
             pulumi.set(__self__, "debug_truncate_bytes", debug_truncate_bytes)
+        if experimental_is_unified_host is not None:
+            pulumi.set(__self__, "experimental_is_unified_host", experimental_is_unified_host)
         if google_credentials is not None:
             pulumi.set(__self__, "google_credentials", google_credentials)
         if google_service_account is not None:
@@ -130,6 +134,8 @@ class ProviderArgs:
             pulumi.set(__self__, "username", username)
         if warehouse_id is not None:
             pulumi.set(__self__, "warehouse_id", warehouse_id)
+        if workspace_id is not None:
+            pulumi.set(__self__, "workspace_id", workspace_id)
 
     @_builtins.property
     @pulumi.getter(name="accountId")
@@ -311,6 +317,15 @@ class ProviderArgs:
     def debug_truncate_bytes(self, value: Optional[pulumi.Input[_builtins.int]]):
         pulumi.set(self, "debug_truncate_bytes", value)
 
+    @_builtins.property
+    @pulumi.getter(name="experimentalIsUnifiedHost")
+    def experimental_is_unified_host(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        return pulumi.get(self, "experimental_is_unified_host")
+
+    @experimental_is_unified_host.setter
+    def experimental_is_unified_host(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "experimental_is_unified_host", value)
+
     @_builtins.property
     @pulumi.getter(name="googleCredentials")
     def google_credentials(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -455,6 +470,15 @@ class ProviderArgs:
     def warehouse_id(self, value: Optional[pulumi.Input[_builtins.str]]):
         pulumi.set(self, "warehouse_id", value)
 
+    @_builtins.property
+    @pulumi.getter(name="workspaceId")
+    def workspace_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        return pulumi.get(self, "workspace_id")
+
+    @workspace_id.setter
+    def workspace_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "workspace_id", value)
+
 
 @pulumi.type_token("pulumi:providers:databricks")
 class Provider(pulumi.ProviderResource):
@@ -482,6 +506,7 @@ class Provider(pulumi.ProviderResource):
                  databricks_id_token_filepath: Optional[pulumi.Input[_builtins.str]] = None,
                  debug_headers: Optional[pulumi.Input[_builtins.bool]] = None,
                  debug_truncate_bytes: Optional[pulumi.Input[_builtins.int]] = None,
+                 experimental_is_unified_host: Optional[pulumi.Input[_builtins.bool]] = None,
                  google_credentials: Optional[pulumi.Input[_builtins.str]] = None,
                  google_service_account: Optional[pulumi.Input[_builtins.str]] = None,
                  host: Optional[pulumi.Input[_builtins.str]] = None,
@@ -498,6 +523,7 @@ class Provider(pulumi.ProviderResource):
                  token: Optional[pulumi.Input[_builtins.str]] = None,
                  username: Optional[pulumi.Input[_builtins.str]] = None,
                  warehouse_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 workspace_id: Optional[pulumi.Input[_builtins.str]] = None,
                  __props__=None):
         """
         The provider type for the databricks package. By default, resources use package-wide configuration
@@ -555,6 +581,7 @@ class Provider(pulumi.ProviderResource):
                  databricks_id_token_filepath: Optional[pulumi.Input[_builtins.str]] = None,
                  debug_headers: Optional[pulumi.Input[_builtins.bool]] = None,
                  debug_truncate_bytes: Optional[pulumi.Input[_builtins.int]] = None,
+                 experimental_is_unified_host: Optional[pulumi.Input[_builtins.bool]] = None,
                  google_credentials: Optional[pulumi.Input[_builtins.str]] = None,
                  google_service_account: Optional[pulumi.Input[_builtins.str]] = None,
                  host: Optional[pulumi.Input[_builtins.str]] = None,
@@ -571,6 +598,7 @@ class Provider(pulumi.ProviderResource):
                  token: Optional[pulumi.Input[_builtins.str]] = None,
                  username: Optional[pulumi.Input[_builtins.str]] = None,
                  warehouse_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 workspace_id: Optional[pulumi.Input[_builtins.str]] = None,
                  __props__=None):
         opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
         if not isinstance(opts, pulumi.ResourceOptions):
@@ -600,6 +628,7 @@ class Provider(pulumi.ProviderResource):
             __props__.__dict__["databricks_id_token_filepath"] = databricks_id_token_filepath
             __props__.__dict__["debug_headers"] = pulumi.Output.from_input(debug_headers).apply(pulumi.runtime.to_json) if debug_headers is not None else None
             __props__.__dict__["debug_truncate_bytes"] = pulumi.Output.from_input(debug_truncate_bytes).apply(pulumi.runtime.to_json) if debug_truncate_bytes is not None else None
+            __props__.__dict__["experimental_is_unified_host"] = pulumi.Output.from_input(experimental_is_unified_host).apply(pulumi.runtime.to_json) if experimental_is_unified_host is not None else None
             __props__.__dict__["google_credentials"] = None if google_credentials is None else pulumi.Output.secret(google_credentials)
             __props__.__dict__["google_service_account"] = google_service_account
             __props__.__dict__["host"] = host
@@ -616,6 +645,7 @@ class Provider(pulumi.ProviderResource):
             __props__.__dict__["token"] = None if token is None else pulumi.Output.secret(token)
             __props__.__dict__["username"] = username
             __props__.__dict__["warehouse_id"] = warehouse_id
+            __props__.__dict__["workspace_id"] = workspace_id
         secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["azureClientSecret", "clientSecret", "googleCredentials", "metadataServiceUrl", "password", "token"])
         opts = pulumi.ResourceOptions.merge(opts, secret_opts)
         super(Provider, __self__).__init__(
@@ -764,6 +794,11 @@ class Provider(pulumi.ProviderResource):
     def warehouse_id(self) -> pulumi.Output[Optional[_builtins.str]]:
         return pulumi.get(self, "warehouse_id")
 
+    @_builtins.property
+    @pulumi.getter(name="workspaceId")
+    def workspace_id(self) -> pulumi.Output[Optional[_builtins.str]]:
+        return pulumi.get(self, "workspace_id")
+
     @pulumi.output_type
     class TerraformConfigResult:
         def __init__(__self__, result=None):

pulumi_databricks/pulumi-plugin.json

@@ -1,5 +1,5 @@
 {
   "resource": true,
   "name": "databricks",
-  "version": "1.78.0-alpha.1762407761"
+  "version": "1.79.0"
 }

pulumi_databricks/recipient.py

@@ -545,6 +545,43 @@ class Recipient(pulumi.CustomResource):
             })
         ```
 
+        ### Databricks to Databricks Sharing
+
+        Setting `authentication_type` type to `DATABRICKS` allows you to automatically create a provider for a recipient who
+        is using Databricks. To do this they would need to provide the global metastore id that you will be sharing with. The
+        global metastore id follows the format: `<cloud>:<region>:<guid>`
+
+        ```python
+        import pulumi
+        import pulumi_databricks as databricks
+        import pulumi_std as std
+
+        current = databricks.get_current_user()
+        recipient_metastore = databricks.Metastore("recipient_metastore",
+            name="recipient",
+            storage_root=std.format(input="abfss://%s@%s.dfs.core.windows.net/",
+                args=[
+                    unity_catalog["name"],
+                    unity_catalog_azurerm_storage_account["name"],
+                ]).result,
+            delta_sharing_scope="INTERNAL",
+            delta_sharing_recipient_token_lifetime_in_seconds=60000000,
+            force_destroy=True)
+        db2db = databricks.Recipient("db2db",
+            name=f"{current.alphanumeric}-recipient",
+            comment="Made by Pulumi",
+            authentication_type="DATABRICKS",
+            data_recipient_global_metastore_id=recipient_metastore.global_metastore_id)
+        ```
+
+        ## Related Resources
+
+        The following resources are often used in the same context:
+
+        * Share to create Delta Sharing shares.
+        * Grants to manage Delta Sharing permissions.
+        * get_shares to read existing Delta Sharing shares.
+
         ## Import
 
         The recipient resource can be imported using the name of the recipient:
@@ -621,6 +658,43 @@ class Recipient(pulumi.CustomResource):
             })
         ```
 
+        ### Databricks to Databricks Sharing
+
+        Setting `authentication_type` type to `DATABRICKS` allows you to automatically create a provider for a recipient who
+        is using Databricks. To do this they would need to provide the global metastore id that you will be sharing with. The
+        global metastore id follows the format: `<cloud>:<region>:<guid>`
+
+        ```python
+        import pulumi
+        import pulumi_databricks as databricks
+        import pulumi_std as std
+
+        current = databricks.get_current_user()
+        recipient_metastore = databricks.Metastore("recipient_metastore",
+            name="recipient",
+            storage_root=std.format(input="abfss://%s@%s.dfs.core.windows.net/",
+                args=[
+                    unity_catalog["name"],
+                    unity_catalog_azurerm_storage_account["name"],
+                ]).result,
+            delta_sharing_scope="INTERNAL",
+            delta_sharing_recipient_token_lifetime_in_seconds=60000000,
+            force_destroy=True)
+        db2db = databricks.Recipient("db2db",
+            name=f"{current.alphanumeric}-recipient",
+            comment="Made by Pulumi",
+            authentication_type="DATABRICKS",
+            data_recipient_global_metastore_id=recipient_metastore.global_metastore_id)
+        ```
+
+        ## Related Resources
+
+        The following resources are often used in the same context:
+
+        * Share to create Delta Sharing shares.
+        * Grants to manage Delta Sharing permissions.
+        * get_shares to read existing Delta Sharing shares.
+
         ## Import
 
         The recipient resource can be imported using the name of the recipient: