|
| 1 | +# databricks_mws_log_delivery Resource |
| 2 | + |
| 3 | +-> **Note** This resource has an evolving API, which may change in future versions of the provider. |
| 4 | + |
| 5 | +This resource configures the delivery of the two supported log types from Databricks workspaces: [billable usage logs](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html) and [audit logs](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html). You cannot delete a log delivery configuration, but you can disable it when you no longer need it. This fact is important because there is a limit to the number of enabled log delivery configurations that you can create for an account. You can create a maximum of two enabled using the account level *(without workspace filter)* and two that use the workspace filter. There is an additional uniqueness constraint that two enabled configurations cannot share all their fields (not including the `config_name`). Re-enabling may fail when there's a violation of limit or uniqueness constraints. |
| 6 | + |
| 7 | +## Example Usage |
| 8 | + |
| 9 | +End-to-end example of usage and audit log delivery: |
| 10 | + |
| 11 | +```hcl |
| 12 | +resource "aws_s3_bucket" "logdelivery" { |
| 13 | + bucket = "${var.prefix}-logdelivery" |
| 14 | + acl = "private" |
| 15 | + versioning { |
| 16 | + enabled = false |
| 17 | + } |
| 18 | + force_destroy = true |
| 19 | + tags = merge(var.tags, { |
| 20 | + Name = "${var.prefix}-logdelivery" |
| 21 | + }) |
| 22 | +} |
| 23 | +
|
| 24 | +resource "aws_s3_bucket_public_access_block" "logdelivery" { |
| 25 | + bucket = aws_s3_bucket.logdelivery.id |
| 26 | + ignore_public_acls = true |
| 27 | +} |
| 28 | +
|
| 29 | +data "databricks_aws_assume_role_policy" "logdelivery" { |
| 30 | + external_id = var.account_id |
| 31 | + for_log_delivery = true |
| 32 | +} |
| 33 | +
|
| 34 | +resource "aws_iam_role" "logdelivery" { |
| 35 | + name = "${var.prefix}-logdelivery" |
| 36 | + description = "(${var.prefix}) UsageDelivery role" |
| 37 | + assume_role_policy = data.databricks_aws_assume_role_policy.logdelivery.json |
| 38 | + tags = var.tags |
| 39 | +} |
| 40 | +
|
| 41 | +data "databricks_aws_bucket_policy" "logdelivery" { |
| 42 | + full_access_role = aws_iam_role.logdelivery.arn |
| 43 | + bucket = aws_s3_bucket.logdelivery.bucket |
| 44 | +} |
| 45 | +
|
| 46 | +resource "aws_s3_bucket_policy" "logdelivery" { |
| 47 | + bucket = aws_s3_bucket.logdelivery.id |
| 48 | + policy = data.databricks_aws_bucket_policy.logdelivery.json |
| 49 | +} |
| 50 | +
|
| 51 | +resource "databricks_mws_credentials" "log_writer" { |
| 52 | + account_id = var.account_id |
| 53 | + credentials_name = "Usage Delivery" |
| 54 | + role_arn = aws_iam_role.logdelivery.arn |
| 55 | +} |
| 56 | +
|
| 57 | +resource "databricks_mws_storage_configurations" "log_bucket" { |
| 58 | + account_id = var.account_id |
| 59 | + storage_configuration_name = "Usage Logs" |
| 60 | + bucket_name = aws_s3_bucket.logdelivery.bucket |
| 61 | +} |
| 62 | +
|
| 63 | +resource "databricks_mws_log_delivery" "usage_logs" { |
| 64 | + account_id = var.account_id |
| 65 | + credentials_id = databricks_mws_credentials.log_writer.credentials_id |
| 66 | + storage_configuration_id = databricks_mws_storage_configurations.log_bucket.storage_configuration_id |
| 67 | + delivery_path_prefix = "billable-usage" |
| 68 | + config_name = "Usage Logs" |
| 69 | + log_type = "BILLABLE_USAGE" |
| 70 | + output_format = "CSV" |
| 71 | +} |
| 72 | +
|
| 73 | +resource "databricks_mws_log_delivery" "audit_logs" { |
| 74 | + account_id = var.account_id |
| 75 | + credentials_id = databricks_mws_credentials.log_writer.credentials_id |
| 76 | + storage_configuration_id = databricks_mws_storage_configurations.log_bucket.storage_configuration_id |
| 77 | + delivery_path_prefix = "audit-logs" |
| 78 | + config_name = "Audit Logs" |
| 79 | + log_type = "AUDIT_LOGS" |
| 80 | + output_format = "JSON" |
| 81 | +} |
| 82 | +``` |
| 83 | + |
| 84 | +## Billable Usage |
| 85 | + |
| 86 | +CSV files with [static schema](https://docs.databricks.com/administration-guide/account-settings/usage.html) are delivered to `<delivery_path_prefix>/billable-usage/csv/`. Files are named `workspaceId=<workspace-id>-usageMonth=<month>.csv`, which are delivered daily by overwriting the month's CSV file for each workspace. |
| 87 | + |
| 88 | +```hcl |
| 89 | +resource "databricks_mws_log_delivery" "usage_logs" { |
| 90 | + account_id = var.account_id |
| 91 | + credentials_id = databricks_mws_credentials.log_writer.credentials_id |
| 92 | + storage_configuration_id = databricks_mws_storage_configurations.log_bucket.storage_configuration_id |
| 93 | + delivery_path_prefix = "billable-usage" |
| 94 | + config_name = "Usage Logs" |
| 95 | + log_type = "BILLABLE_USAGE" |
| 96 | + output_format = "CSV" |
| 97 | +} |
| 98 | +``` |
| 99 | + |
| 100 | +## Audit Logs |
| 101 | + |
| 102 | +JSON files with [static schema](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html#audit-log-schema) are delivered to `<delivery_path_prefix>/workspaceId=<workspaceId>/date=<yyyy-mm-dd>/auditlogs_<internal-id>.json`. Logs are available within 15 minutes of activation for audit logs. New JSON files are delivered every few minutes, potentially overwriting existing files for each workspace. Sometimes data may arrive later than 15 minutes. Databricks can overwrite the delivered log files in your bucket at any time. If a file is overwritten, the existing content remains, but there may be additional lines for more auditable events. Overwriting ensures exactly-once semantics without requiring read or delete access to your account. |
| 103 | + |
| 104 | +```hcl |
| 105 | +resource "databricks_mws_log_delivery" "audit_logs" { |
| 106 | + account_id = var.account_id |
| 107 | + credentials_id = databricks_mws_credentials.log_writer.credentials_id |
| 108 | + storage_configuration_id = databricks_mws_storage_configurations.log_bucket.storage_configuration_id |
| 109 | + delivery_path_prefix = "audit-logs" |
| 110 | + config_name = "Audit Logs" |
| 111 | + log_type = "AUDIT_LOGS" |
| 112 | + output_format = "JSON" |
| 113 | +} |
| 114 | +``` |
| 115 | + |
| 116 | +## Argument reference |
| 117 | + |
| 118 | +* `account_id` - The Databricks account ID that hosts the log delivery configuration. |
| 119 | +* `config_name` - The optional human-readable name of the log delivery configuration. Defaults to empty. |
| 120 | +* `log_type` - The type of log delivery. `BILLABLE_USAGE` and `AUDIT_LOGS` are supported. |
| 121 | +* `output_format` - The file type of log delivery. Currently `CSV` (for `BILLABLE_USAGE`) and `JSON` (for `AUDIT_LOGS`) are supported. |
| 122 | +* `credentials_id` - The ID for a Databricks [credential configuration](mws_credentials.md) that represents the AWS IAM role [with policy](../data-sources/aws_assume_role_policy.md) and [trust relationship](../data-sources/aws_assume_role_policy.md) as described in the main billable usage documentation page. |
| 123 | +* `storage_configuration_id` - The ID for a Databricks [storage configuration](mws_storage_configurations.md) that represents the S3 bucket with [bucket policy](../data-sources/aws_bucket_policy.md) as described in the main billable usage documentation page. |
| 124 | +* `workspace_ids_filter` - (Optional) By default, this log configuration applies to all workspaces associated with your account ID. If your account is on the E2 version of the platform or on a select custom plan that allows multiple workspaces per account, you may have multiple workspaces associated with your account ID. You can optionally set the field as mentioned earlier to an array of workspace IDs. If you plan to use different log delivery configurations for several workspaces, set this explicitly rather than leaving it blank. If you leave this blank and your account ID gets additional workspaces in the future, this configuration will also apply to the new workspaces. |
| 125 | +* `delivery_path_prefix` - (Optional) Defaults to empty, which means that logs delivered to the root of the bucket. The value must be a valid S3 object key. It must not start or end with a slash character. |
| 126 | +* `delivery_start_time` - (Optional) The optional start month and year for delivery, specified in YYYY-MM format. Defaults to current year and month. Usage is not available before 2019-03. |
| 127 | + |
| 128 | +## Attribute reference |
| 129 | + |
| 130 | +Resource exports the following attributes: |
| 131 | + |
| 132 | +* `config_id` - Databricks log delivery configuration ID. |
| 133 | + |
| 134 | +## Import |
| 135 | + |
| 136 | +This resource can be imported by specifying a combination of an account id and log config id separated by `|`: |
| 137 | + |
| 138 | +```bash |
| 139 | +$ terraform import databricks_mws_log_delivery.usage "<account-id>|<log-config-id>" |
| 140 | +``` |
0 commit comments