|
| 1 | +--- |
| 2 | +page_title: "Working with Unity Catalog by default" |
| 3 | +--- |
| 4 | + |
| 5 | +# Working with Unity Catalog by default |
| 6 | + |
| 7 | +Databricks began to [enable new workspaces for Unity Catalog automatically](https://learn.microsoft.com/en-us/azure/databricks/data-governance/unity-catalog/get-started#--automatic-enablement-of-unity-catalog) on November 9, 2023, with a rollout proceeding gradually across accounts. Workspaces that were enabled automatically have the following properties: |
| 8 | + |
| 9 | +- An automatically-provisioned Unity Catalog metastore (unless a Unity Catalog metastore already existed for the workspace region). |
| 10 | +- Default privileges for workspace admins, such as the ability to create a catalog or an external database connection. |
| 11 | +- No metastore admin (unless an existing Unity Catalog metastore was used and a metastore admin was already assigned). |
| 12 | +- No metastore-level storage for managed tables and managed volumes (unless an existing Unity Catalog metastore with metastore-level storage was used). |
| 13 | +- A workspace catalog, which, when originally provisioned, is named after your workspace. |
| 14 | + |
| 15 | +This removes the need to manually enable Unity Catalog following [this guide](unity-catalog.md). However, you may need to adjust your Terraform configuration to account for this accordingly |
| 16 | + |
| 17 | +## Removing default privileges for workspace admins |
| 18 | + |
| 19 | +An account admin may decide to remove the default privileges granted to workspace admins, such as the ability to create a catalog or connection. This can be achieved using [databricks_grants](../resources/grants.md), which will override any metastore-level grants not defined in Terraform |
| 20 | + |
| 21 | +```hcl |
| 22 | +data "databricks_current_metastore" "this" { |
| 23 | +} |
| 24 | +
|
| 25 | +resource "databricks_grants" "this" { |
| 26 | + metastore = data.databricks_metastore.this.id |
| 27 | + grant { |
| 28 | + principal = "Data Engineers" |
| 29 | + privileges = ["CREATE_CATALOG", "CREATE_EXTERNAL_LOCATION"] |
| 30 | + } |
| 31 | + grant { |
| 32 | + principal = "Data Sharer" |
| 33 | + privileges = ["CREATE_RECIPIENT", "CREATE_SHARE"] |
| 34 | + } |
| 35 | +} |
| 36 | +``` |
| 37 | + |
| 38 | +## Avoiding the automatically-provisioned Unity Catalog metastore |
| 39 | + |
| 40 | +An account admin may pre-create metastores with specific admins in all regions that workspaces will be deployed. This will ensure that new workspaces are automatically assigned to the correct metastore |
| 41 | + |
| 42 | +```hcl |
| 43 | +variable "regions" { |
| 44 | + default = ["ap-northeast-1", "eu-west-1"] |
| 45 | +} |
| 46 | +
|
| 47 | +resource "databricks_metastore" "this" { |
| 48 | + for_each = toset(var.regions) |
| 49 | + name = "metastore-${each.value}" |
| 50 | + region = each.value |
| 51 | +} |
| 52 | +``` |
| 53 | + |
| 54 | +## Mandating storage for new catalogs |
| 55 | + |
| 56 | +The automatically-provisioned Unity Catalog metastore does not have metastore-level storage, which means each new catalog has to have a storage location defined |
| 57 | + |
| 58 | +```hcl |
| 59 | +# this would fail with "storage location required" error |
| 60 | +resource "databricks_catalog" "sandbox" { |
| 61 | + name = "sandbox" |
| 62 | +} |
| 63 | +``` |
| 64 | + |
| 65 | +## Using the workspace catalog |
| 66 | + |
| 67 | +The automatically-provisioned workspace catalog is named after the workspace and initially is bound to that workspace only. |
| 68 | + |
| 69 | +To retrieve this catalog using [databricks_catalogs](../data-sources/catalogs.md) |
| 70 | + |
| 71 | +```hcl |
| 72 | +variable workspace_name {} |
| 73 | +
|
| 74 | +data "databricks_catalogs" "all" {} |
| 75 | +
|
| 76 | +locals { |
| 77 | + default_catalog = [for each in data.databricks_catalogs.all.ids : each if strcontains(each, var.workspace_name)] |
| 78 | +} |
| 79 | +``` |
| 80 | + |
| 81 | +This can then be used to create objects under this catalog, e.g. |
| 82 | + |
| 83 | +```hcl |
| 84 | +resource "databricks_schema" "sandbox" { |
| 85 | + catalog_name = local.default_catalog[0] |
| 86 | + name = "sandbox" |
| 87 | +} |
| 88 | +``` |
| 89 | + |
| 90 | +Or bind this catalog to more workspaces |
| 91 | + |
| 92 | +```hcl |
| 93 | +resource "databricks_catalog_workspace_binding" "default_catalog" { |
| 94 | + securable_name = local.default_catalog[0] |
| 95 | + workspace_id = databricks_mws_workspaces.other.workspace_id |
| 96 | +} |
| 97 | +``` |
0 commit comments