[Exporter] Emit permission assignment and users/SPs/groups when processing databricks_mws_workspaces (#5012)

## Changes
<!-- Summary of your changes that are easy to understand -->

## Tests
<!--
How is this tested? Please see the checklist below and also describe any
other relevant tests
-->

- [x] `make test` run locally
- [ ] relevant change in `docs/` folder
- [ ] covered with integration tests in `internal/acceptance`
- [ ] using Go SDK
- [ ] using TF Plugin Framework
- [x] has entry in `NEXT_CHANGELOG.md` file

Author: alexott

NEXT_CHANGELOG.md

@@ -20,5 +20,6 @@
 
 * Improve handling of dependencies for vector search index ([#4989](https://github.com/databricks/terraform-provider-databricks/pull/4989)).
 * Handle new attributes for Slack and MS Teams in `databricks_notification_destination` ([#5008](https://github.com/databricks/terraform-provider-databricks/pull/5008)).
+* Emit permission assignment and users/SPs/groups when processing `databricks_mws_workspaces` ([#5012](https://github.com/databricks/terraform-provider-databricks/pull/5012)).
 
 ### Internal Changes

exporter/impl_scim.go

@@ -3,8 +3,10 @@ package exporter
 import (
 	"fmt"
 	"log"
+	"strconv"
 	"strings"
 
+	"github.com/databricks/terraform-provider-databricks/mws"
 	"github.com/databricks/terraform-provider-databricks/scim"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	"golang.org/x/exp/maps"
@@ -279,3 +281,53 @@ func importServicePrincipal(ic *importContext, r *resource) error {
 	}
 	return nil
 }
+
+func emitIdfedAndUsersSpsGroups(ic *importContext, workspaceId int64) error {
+	log.Printf("[DEBUG] Emitting permission assignments for workspace %d", workspaceId)
+	pas, err := ic.accountClient.WorkspaceAssignment.ListByWorkspaceId(ic.Context, workspaceId)
+	if err != nil {
+		log.Printf("[ERROR] listing workspace permission assignments for workspace %d: %s",
+			workspaceId, err.Error())
+		return err
+	}
+	for _, pa := range pas.PermissionAssignments {
+		perm := "unknown"
+		if len(pa.Permissions) > 0 {
+			perm = pa.Permissions[0].String()
+		}
+		nm := fmt.Sprintf("mws_pa_%d_%s_%s_%d", workspaceId, pa.Principal.DisplayName,
+			perm, pa.Principal.PrincipalId)
+		// We  generate Data directly to avoid calling APIs
+		data := mws.ResourceMwsPermissionAssignment().ToResource().TestResourceData()
+		paId := fmt.Sprintf("%d|%d", workspaceId, pa.Principal.PrincipalId)
+		data = ic.generateNewData(data, "databricks_mws_permission_assignment", paId, pa)
+		data.Set("workspace_id", workspaceId)
+		data.Set("principal_id", pa.Principal.PrincipalId)
+		ic.Emit(&resource{
+			Resource: "databricks_mws_permission_assignment",
+			ID:       paId,
+			Name:     nameNormalizationRegex.ReplaceAllString(nm, "_"),
+			Data:     data,
+		})
+		// Emit principals
+		strPrincipalId := strconv.FormatInt(pa.Principal.PrincipalId, 10)
+		if pa.Principal.ServicePrincipalName != "" {
+			ic.Emit(&resource{
+				Resource: "databricks_service_principal",
+				ID:       strPrincipalId,
+			})
+		} else if pa.Principal.UserName != "" {
+			ic.Emit(&resource{
+				Resource: "databricks_user",
+				ID:       strPrincipalId,
+			})
+		} else if pa.Principal.GroupName != "" {
+			ic.Emit(&resource{
+				Resource: "databricks_group",
+				ID:       strPrincipalId,
+			})
+		}
+	}
+
+	return nil
+}

exporter/importables.go

@@ -2434,58 +2434,26 @@ var resourcesMap map[string]importable = map[string]importable{
 					log.Printf("[DEBUG] Skipping workspace %d because it doesn't match to the filter", ws.WorkspaceId)
 					continue
 				}
-				pas, err := ic.accountClient.WorkspaceAssignment.ListByWorkspaceId(ic.Context, ws.WorkspaceId)
+				wsIdString := strconv.FormatInt(ws.WorkspaceId, 10)
+				ic.Emit(&resource{
+					Resource: "databricks_mws_workspaces",
+					ID:       ic.accountClient.Config.AccountID + "/" + wsIdString,
+					Name:     ws.WorkspaceName + "_" + wsIdString,
+				})
+				err = emitIdfedAndUsersSpsGroups(ic, ws.WorkspaceId)
 				if err != nil {
 					log.Printf("[ERROR] listing workspace permission assignments for workspace %d: %s",
 						ws.WorkspaceId, err.Error())
 					continue
 				}
-				log.Printf("[DEBUG] Emitting permission assignments for workspace %d", ws.WorkspaceId)
-				for _, pa := range pas.PermissionAssignments {
-					perm := "unknown"
-					if len(pa.Permissions) > 0 {
-						perm = pa.Permissions[0].String()
-					}
-					nm := fmt.Sprintf("mws_pa_%d_%s_%s_%d", ws.WorkspaceId, pa.Principal.DisplayName,
-						perm, pa.Principal.PrincipalId)
-					// We  generate Data directly to avoid calling APIs
-					data := mws.ResourceMwsPermissionAssignment().ToResource().TestResourceData()
-					paId := fmt.Sprintf("%d|%d", ws.WorkspaceId, pa.Principal.PrincipalId)
-					data = ic.generateNewData(data, "databricks_mws_permission_assignment", paId, pa)
-					data.Set("workspace_id", ws.WorkspaceId)
-					data.Set("principal_id", pa.Principal.PrincipalId)
-					ic.Emit(&resource{
-						Resource: "databricks_mws_permission_assignment",
-						ID:       paId,
-						Name:     nameNormalizationRegex.ReplaceAllString(nm, "_"),
-						Data:     data,
-					})
-					// Emit principals
-					strPrincipalId := strconv.FormatInt(pa.Principal.PrincipalId, 10)
-					if pa.Principal.ServicePrincipalName != "" {
-						ic.Emit(&resource{
-							Resource: "databricks_service_principal",
-							ID:       strPrincipalId,
-						})
-					} else if pa.Principal.UserName != "" {
-						ic.Emit(&resource{
-							Resource: "databricks_user",
-							ID:       strPrincipalId,
-						})
-					} else if pa.Principal.GroupName != "" {
-						ic.Emit(&resource{
-							Resource: "databricks_group",
-							ID:       strPrincipalId,
-						})
-					}
-				}
 			}
 			return nil
 		},
 		Depends: []reference{
 			{Resource: "databricks_service_principal", Path: "principal_id"},
 			{Resource: "databricks_user", Path: "principal_id"},
 			{Resource: "databricks_group", Path: "principal_id"},
+			{Resource: "databricks_mws_workspaces", Path: "workspace_id", Match: "workspace_id"},
 		},
 	},
 	"databricks_dashboard": {
@@ -3056,10 +3024,11 @@ var resourcesMap map[string]importable = map[string]importable{
 					log.Printf("[DEBUG] skipping mws_workspaces '%s' that is not running", workspace.WorkspaceName)
 					continue
 				}
+				wsIdString := strconv.FormatInt(workspace.WorkspaceId, 10)
 				ic.Emit(&resource{
 					Resource: "databricks_mws_workspaces",
-					ID:       ic.accountClient.Config.AccountID + "/" + strconv.FormatInt(workspace.WorkspaceId, 10),
-					Name:     workspace.WorkspaceName,
+					ID:       ic.accountClient.Config.AccountID + "/" + wsIdString,
+					Name:     workspace.WorkspaceName + "_" + wsIdString,
 				})
 			}
 			return nil
@@ -3104,6 +3073,13 @@ var resourcesMap map[string]importable = map[string]importable{
 					ID:       ic.accountClient.Config.AccountID + "/" + workspace.CredentialsID,
 				})
 			}
+			if ic.isServiceEnabled("idfed") {
+				err := emitIdfedAndUsersSpsGroups(ic, workspace.WorkspaceID)
+				if err != nil {
+					log.Printf("[ERROR] listing workspace permission assignments for workspace %d: %s",
+						workspace.WorkspaceID, err.Error())
+				}
+			}
 			return nil
 		},
 		Depends: []reference{