databricks_obo_token resource to manage PAT tokens on behalf of service principals in E2 workspaces

[nfx]

This resource creates On-Behalf-Of tokens for a Service Principal in Databricks workspaces on AWS. It is very useful, when you want to provision resources within a workspace through narrowly-scoped service principal, that has no access to other workspaces within the same Databricks Account.

Example Usage

Creating a token for a narrowly-scoped service principal

resource "databricks_service_principal" "this" {
  display_name = "Automation-only SP"
}

resource "databricks_permissions" "token_usage" {
  authorization = "tokens"
  access_control {
    service_principal_name = databricks_service_principal.this.application_id
    permission_level = "CAN_USE"
  }
}

resource "databricks_obo_token" "this" {
  depends_on = [databricks_permissions.token_usage]
  application_id = databricks_service_principal.this.application_id
  comment = "PAT on behalf of ${databricks_service_principal.this.display_name}"
  lifetime_seconds = 3600
}

output "obo" {
  value = databricks_obo_token.this.token_value
  sensitive = true
}

Creating a token for a service principal with admin privileges

resource "databricks_service_principal" "this" {
  display_name = "Terraform"
}

data "databricks_group" "admins" {
  display_name = "admins"
}

resource "databricks_group_member" "this" {
  group_id = data.databricks_group.admins.id
  member_id = databricks_service_principal.this.id
}

resource "databricks_obo_token" "this" {
  depends_on = [databricks_group_member.this]
  application_id = databricks_service_principal.this.application_id
  comment = "PAT on behalf of ${databricks_service_principal.this.display_name}"
  lifetime_seconds = 3600
}

Argument Reference

The following arguments are required:

• application_id - Application ID of databricks_service_principal to create PAT token for.
• lifetime_seconds - (Integer) The number of seconds before the token expires. Token resource is re-created when it expires.
• comment - (String) Comment that describes the purpose of the token.

Attribute Reference

In addition to all arguments above, the following attributes are exported:

• id - Canonical unique identifier for the token.
• token_value - Sensitive value of the newly-created token.

[codecov]

Codecov Report

Merging #736 (ade9fe3) into master (ef04352) will increase coverage by 0.01%.
The diff coverage is 84.09%.

@@            Coverage Diff             @@
##           master     #736      +/-   ##
==========================================
+ Coverage   83.55%   83.56%   +0.01%     
==========================================
  Files          87       88       +1     
  Lines        8073     8112      +39     
==========================================
+ Hits         6745     6779      +34     
- Misses        843      846       +3     
- Partials      485      487       +2     

Impacted Files	Coverage Δ
identity/groups.go	87.80% <37.50%> (-12.20%)	⬇️
identity/resource_obo_token.go	93.75% <93.75%> (ø)
identity/data_group.go	81.81% <100.00%> (+3.55%)	⬆️
provider/provider.go	95.31% <100.00%> (+0.01%)	⬆️

[alexott]

lgtm

[alexott]

create PAT -> create a PAT