Pass SYSTEM_ACCESSTOKEN from env to the Terraform provider (#4135)

## Changes
Pass SYSTEM_ACCESSTOKEN from env to the Terraform provider

## Why
Fixes #4047

## Tests
Added unit test

<!-- If your PR needs to be included in the release notes for next
release,
add a separate entry in NEXT_CHANGELOG.md as part of your PR. -->

Author: andrewnester

NEXT_CHANGELOG.md

@@ -7,6 +7,7 @@
 ### CLI
 
 ### Bundles
+* Pass SYSTEM_ACCESSTOKEN from env to the Terraform provider ([#4135](https://github.com/databricks/cli/pull/4135))
 
 ### Dependency updates
 

bundle/deploy/terraform/init.go

@@ -166,6 +166,13 @@ func inheritEnvVars(ctx context.Context, environ map[string]string) error {
 		environ[oidcTokenEnv] = oidcToken
 	}
 
+	// If there's SYSTEM_ACCESSTOKEN set, we need to pass the value of the environment variable to Terraform.
+	// This is necessary to ensure that Terraform can use the same access token as the CLI.
+	systemAccessToken, ok := env.Lookup(ctx, "SYSTEM_ACCESSTOKEN")
+	if ok {
+		environ["SYSTEM_ACCESSTOKEN"] = systemAccessToken
+	}
+
 	// Map $DATABRICKS_TF_CLI_CONFIG_FILE to $TF_CLI_CONFIG_FILE
 	// VSCode extension provides a file with the "provider_installation.filesystem_mirror" configuration.
 	// We only use it if the provider version matches the currently used version,

bundle/deploy/terraform/init_test.go

@@ -281,6 +281,16 @@ func TestInheritOIDCTokenEnv(t *testing.T) {
 	assert.Equal(t, "", env["DATABRICKS_OIDC_TOKEN_ENV"])
 }
 
+func TestInheritSystemAccessToken(t *testing.T) {
+	t.Setenv("SYSTEM_ACCESSTOKEN", "foobar")
+
+	ctx := context.Background()
+	env := map[string]string{}
+	err := inheritEnvVars(ctx, env)
+	require.NoError(t, err)
+	assert.Equal(t, "foobar", env["SYSTEM_ACCESSTOKEN"])
+}
+
 func TestSetUserProfileFromInheritEnvVars(t *testing.T) {
 	t.Setenv("USERPROFILE", "c:\\foo\\c")