Ensure owner/mgmt permission for current user (#3780)

denik · web-flow · commit 9a1cc33aac60 · 2025-10-20T14:11:47.000+02:00
## Changes Instead of removing current user from permissions and relying on terraform to add it back, we'll instead add IS_OWNER/CAN_MANAGE ourselves. Previous attempt to remove this mutator completely #3688 failed because backend complains about "ambiguous" permissions when both CAN_MANAGE and IS_OWNER are present. Thus we do additional transformation here: we upgrade CAN_MANAGE to IS_OWNER if we can. Don't apply this logic to secret scopes resource as it's not implemented via databricks_permissions resource in terraform and does not have IS_OWNER/CAN_MANAGE insertion logic. This means we no longer filter out current user permissions from secret scopes resources. ## Why - Enables direct implementation which will not do any transformations, just use whatever in the config. With this PR, the request payload will match terraform's. - Final permissions visible in 'bundle validate -o json'. ## Tests #3781
diff --git a/NEXT_CHANGELOG.md b/NEXT_CHANGELOG.md
@@ -9,5 +9,7 @@
 ### Dependency updates
 
 ### Bundles
+* For secret scopes, no longer remove current user's permissions ([#3780](https://github.com/databricks/cli/pull/3780))
+* Automatically add owner permissions during bundle initialization, this makes final permissions visible in 'bundle validate -o json' ([#3780](https://github.com/databricks/cli/pull/3780))
 
 ### API Changes
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/apps/current_can_manage/output.txt
@@ -12,6 +12,10 @@
   {
     "level": "CAN_MANAGE",
     "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "CAN_MANAGE",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/output.txt b/acceptance/bundle/resources/permissions/apps/other_can_manage/output.txt
@@ -12,6 +12,10 @@
   {
     "level": "CAN_MANAGE",
     "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "CAN_MANAGE",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/databricks.yml b/acceptance/bundle/resources/permissions/jobs/current_can_manage/databricks.yml
@@ -14,6 +14,9 @@ resources:
           group_name: data-team
         - level: CAN_MANAGE
           service_principal_name: f37d18cd-98a8-4db5-8112-12dd0a6bfe38
-        # job with explicit CAN_MANAGE matching username, will be filtered out by DABs; terraform will add IS_OWNER
+        # job with explicit CAN_MANAGE matching username, we will upgrade CAN_MANAGE to IS_OWNER
+        # If we don't, then terraform will add IS_OWNER and we will end up with both CAN_MANAGE and IS_OWNER
+        # which can lead to
+        #    Error: cannot create permissions: Permissions being set for UserName([USERNAME]) are ambiguous
         - level: CAN_MANAGE
           user_name: tester@databricks.com
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/jobs/current_can_manage/output.txt
@@ -12,6 +12,10 @@
   {
     "level": "CAN_MANAGE",
     "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.terraform.json
@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.destroy.terraform.json
@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/output.txt b/acceptance/bundle/resources/permissions/jobs/current_is_owner/output.txt
@@ -1,6 +1,11 @@
 
 >>> [CLI] bundle validate -o json
-[]
+[
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
+  }
+]
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/output.txt b/acceptance/bundle/resources/permissions/jobs/other_can_manage/output.txt
@@ -12,6 +12,10 @@
   {
     "level": "CAN_MANAGE",
     "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.terraform.json
@@ -6,6 +6,10 @@
       {
         "permission_level": "IS_OWNER",
         "user_name": "other_user@databricks.com"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
       }
     ]
   }
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/output.txt b/acceptance/bundle/resources/permissions/jobs/other_is_owner/output.txt
@@ -4,6 +4,10 @@
   {
     "level": "IS_OWNER",
     "user_name": "other_user@databricks.com"
+  },
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/output.txt b/acceptance/bundle/resources/permissions/jobs/viewers/output.txt
@@ -12,6 +12,10 @@
   {
     "level": "CAN_VIEW",
     "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/output.txt
@@ -12,6 +12,10 @@
   {
     "level": "CAN_MANAGE",
     "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.terraform.json
@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/pipelines/[UUID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/output.txt b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/output.txt
@@ -1,6 +1,11 @@
 
 >>> [CLI] bundle validate -o json
-[]
+[
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
+  }
+]
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/output.txt b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/output.txt
@@ -12,6 +12,10 @@
   {
     "level": "CAN_MANAGE",
     "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.terraform.json
@@ -6,6 +6,10 @@
       {
         "permission_level": "IS_OWNER",
         "user_name": "other_user@databricks.com"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
       }
     ]
   }
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/output.txt b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/output.txt
@@ -4,6 +4,10 @@
   {
     "level": "IS_OWNER",
     "user_name": "other_user@databricks.com"
+  },
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.terraform.json
@@ -15,10 +15,6 @@
         "group_name": "data-team",
         "permission_level": "CAN_MANAGE"
       },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      },
       {
         "permission_level": "IS_OWNER",
         "user_name": "[USERNAME]"
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/output.txt
@@ -12,6 +12,10 @@
   {
     "level": "CAN_MANAGE",
     "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/resources/secret_scopes/permissions/databricks.yml.tmpl b/acceptance/bundle/resources/secret_scopes/permissions/databricks.yml.tmpl
@@ -14,7 +14,7 @@ resources:
           level: MANAGE
 
 permissions:
-  - user_name: $CURRENT_USER_NAME # this will be omitted by `FilterCurrentUser`
+  - user_name: $CURRENT_USER_NAME
     level: CAN_MANAGE
   - group_name: users
     level: CAN_VIEW # this is mapped to READ
diff --git a/acceptance/bundle/resources/secret_scopes/permissions/output.txt b/acceptance/bundle/resources/secret_scopes/permissions/output.txt
@@ -8,6 +8,7 @@ Deployment complete!
 >>> jq -s -c .[] | select(.path=="/api/2.0/secrets/acls/put") | .body out.requests.txt
 {"permission":"MANAGE","principal":"admins","scope":"test-secrets-permissions"}
 {"permission":"MANAGE","principal":"resource_level_admins","scope":"test-secrets-permissions"}
+{"permission":"MANAGE","principal":"[USERNAME]","scope":"test-secrets-permissions"}
 {"permission":"READ","principal":"resource_level_users","scope":"test-secrets-permissions"}
 {"permission":"READ","principal":"users","scope":"test-secrets-permissions"}
 {"permission":"WRITE","principal":"resource_level_writers","scope":"test-secrets-permissions"}
diff --git a/acceptance/bundle/run_as/pipelines_legacy/output.txt b/acceptance/bundle/run_as/pipelines_legacy/output.txt
@@ -31,6 +31,10 @@ Warning: You are using the legacy mode of run_as. The support for this mode is e
   {
     "level": "IS_OWNER",
     "service_principal_name": "my_service_principal"
+  },
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
   }
 ]
 
diff --git a/acceptance/bundle/templates/default-python/classic/out.requests.prod.terraform.txt b/acceptance/bundle/templates/default-python/classic/out.requests.prod.terraform.txt
@@ -168,3 +168,27 @@
     ]
   }
 }
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/pipelines/[UUID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/integration_classic/output.txt b/acceptance/bundle/templates/default-python/integration_classic/output.txt
diff --git a/acceptance/bundle/validate/empty_resources/with_permissions/output.txt b/acceptance/bundle/validate/empty_resources/with_permissions/output.txt
diff --git a/bundle/config/mutator/resourcemutator/filter_current_user.go b/bundle/config/mutator/resourcemutator/filter_current_user.go
diff --git a/bundle/config/mutator/resourcemutator/filter_current_user_test.go b/bundle/config/mutator/resourcemutator/filter_current_user_test.go
diff --git a/bundle/config/mutator/resourcemutator/resource_mutator.go b/bundle/config/mutator/resourcemutator/resource_mutator.go
diff --git a/libs/dyn/visit_get.go b/libs/dyn/visit_get.go
diff --git a/libs/iamutil/service_principal.go b/libs/iamutil/service_principal.go

Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,10 @@`
`12`	`12`	`{`
`13`	`13`	`"level": "CAN_MANAGE",`
`14`	`14`	`"service_principal_name": "[UUID]"`
	`15`	`+ },`
	`16`	`+ {`
	`17`	`+ "level": "CAN_MANAGE",`
	`18`	`+ "user_name": "[USERNAME]"`
`15`	`19`	`}`
`16`	`20`	`]`
`17`	`21`
Original file line number	Diff line number	Diff line change
`@@ -6,6 +6,10 @@`
`6`	`6`	`{`
`7`	`7`	`"permission_level": "IS_OWNER",`
`8`	`8`	`"user_name": "[email protected]"`
	`9`	`+ },`
	`10`	`+ {`
	`11`	`+ "permission_level": "IS_OWNER",`
	`12`	`+ "user_name": "[USERNAME]"`
`9`	`13`	`}`
`10`	`14`	`]`
`11`	`15`	`}`