[ISSUE] Issue with databricks_metastore resource importation

[wajdi-b]

Configuration

import {
  to = databricks_metastore.this
  id = "some_metastore_id"
}
resource "databricks_metastore" "this" {
  name          = "prd-metastore"
  storage_root  = "s3://some_bucket/metastore"
  # storage_root  = "s3://some_bucket/metastore/some_metastore_id" Also tried this
  owner         = var.databricks_client_id
  force_destroy = true
}

Expected Behavior

Resource is imported and becomes managed by Terraform, appearing as such in the .tfstate

Actual Behavior

│ Error: cannot delete metastore: Metastore 'some_metastore_id' is not empty. The metastore has 1 catalog(s), 0 storage credential(s), 0 share(s) and 0 recipient(s)

Steps to Reproduce

1. Create a metastore outside of Terraform
2. terraform apply the above HCL configuration

Terraform and provider versions

Terraform v1.5.7
on darwin_arm64

• provider registry.terraform.io/databricks/databricks v1.26.0
• provider registry.terraform.io/hashicorp/aws v4.67.0
• provider registry.terraform.io/hashicorp/null v3.2.1
• provider registry.terraform.io/hashicorp/random v3.5.1
• provider registry.terraform.io/hashicorp/time v0.9.1

Debug Output

Important Factoids

[jacovg91]

I was able to import the metastore fine myself. It looks like you passed a different storage_root then you created it with and that forces the replacement, as this value cannot be changed. It can be as simple as a trailing slash (/) for example. Also, have you tried removing the catalog that resides in the metastore first? (or import that too)

I used the following:

terraform import databricks_metastore.unity_catalog_metastore <metastore_id>

Edit:

Also, did you try without the optional force_destroy field?

[wajdi-b]

I am still unable to import. I made sure to copy the exact same information as the below data source information and without force_destroy, yet the resource can't be imported

data source from .tfstate

data "databricks_metastore" "this" {
    id           = "_"
    metastore_id = "metastore_ID"

    metastore_info {
        cloud                                             = "aws"
        created_at                                        = 1693237072840
        created_by                                        = "owner_ID"
        delta_sharing_recipient_token_lifetime_in_seconds = 0
        delta_sharing_scope                               = "INTERNAL"
        global_metastore_id                               = "aws:ca-central-1:metastore_ID"
        metastore_id                                      = "metastore_ID"
        name                                              = "prd-ca-central-1-metastore"
        owner                                             = "owner_ID"
        privilege_model_version                           = "1.0"
        region                                            = "ca-central-1"
        storage_root                                      = "s3://my_bucket/metastore/metastore_ID"
        updated_at                                        = 1693237073395
        updated_by                                        = "owner_ID"
    }
}

import of the resource

import {
  to = databricks_metastore.this
  id = "metastore_ID"
}
resource "databricks_metastore" "this" {
  name          = "prd-metastore"
  region        = "ca-central-1"
  storage_root  = "s3://my_bucket/metastore/metastore_ID"
  owner         = var.databricks_client_id
}

The terraform plan still mentions that storage_root forces replacement of the resource, yet it is the same as the one in the data source.
The terraform apply fails with the following error:

Error: cannot delete metastore: Metastore 'metastore_ID' is not empty. The metastore has 1 catalog(s), 0 storage credential(s), 0 share(s) and 0 recipient(s)

Because it tries to delete and recreate the resource as in the plan, when it should not.

After the import is executed, here is what shows in .tfstate:

terraform state show "databricks_metastore.this"

# databricks_metastore.this:
resource "databricks_metastore" "this" {
id = "metastore_ID"
}

The import should have populated other fields that we can see on the data source.

I have redacted the following IDs everywhere above, but if they have the same name they are the same value.

metastore_ID
owner_ID
my_bucket

[jacovg91]

Just thinking out loud here: I'm using Azure blob storage, but my storage location ends with a slash. This is what it looks like:

resource "databricks_metastore" "unity_catalog_metastore" {
  provider = databricks.workspace_level_provider 
  name     = "metastore-we"
  storage_root = format("abfss://%s@%s.dfs.core.windows.net/",
    azurerm_storage_container.unity_catalog_storage_account_container.name,
  azurerm_storage_account.unity_catalog_storage_account.name)

  owner = var.databricks_metastore_admin_group
}

As it points to this field forcing replacement, I'm guessing it has something to do with really small differences like differences in casing or trailing slashes.

edit: just noticed the AWS format is different, and you can't have a trailing slash in the fqdn. Have you tried hardcoding the value of the bucket to make sure its 100% passing the right one? As it currently says redacted.

[wajdi-b]

Have you tried hardcoding the value of the bucket to make sure its 100% passing the right one? As it currently says redacted.

Yes I confirmed that the values of my bucket are the same and haven't changed.

[jacovg91]

Have you tried hardcoding the value of the bucket to make sure its 100% passing the right one? As it currently says redacted.

Yes I confirmed that the values of my bucket are the same and haven't changed.

Not sure what to do at this point, but perhaps you can try to import it using cli. When I run terraform state show "databricks_metastore.unity_catalog_metastore" on my end, it also shows the (correct) storage root and many other fields.

Yours only shows the id, which gives me the impression that the import didn't go right.

[TMRert]

I've had the same issue as @wajdi-b when I tried to import the Metastore using an Account-level provider instead of a workspace-level provider.

After switching the configuration to a workspace-level provider, the terraform state show command indeed shows all attributes, whereas before it only showed the ID. With this provider, the terraform plan doesn't require a replacement.

I'm not sure why the Account provider has this behavior though, especially after the merge of #2182 and the release of v1.24.0. This MR included the option to create / manage the Metastore through the Account provider, but importing the resource doesn't seem to be working correctly in this deployment model.