Skip to content

Commit bf3e048

Browse files
alexottalexott
authored
Add managed_identity_id to databricks_storage_credential to support user-assigned managed identities (#2536)
* Add `managed_identity_id` to `databricks_storage_credential` to support user-assigned managed identities * Use Go SDK structures for Azure MI & SP structs
1 parent 34d393c commit bf3e048

File tree

6 files changed

+57
-61
lines changed

6 files changed

+57
-61
lines changed

‎catalog/resource_metastore_data_access.go‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,6 @@ type AwsIamRole struct {
1616
RoleARN string `json:"role_arn"`
1717
}
1818

19-
type AzureServicePrincipal struct {
20-
DirectoryID string `json:"directory_id"`
21-
ApplicationID string `json:"application_id"`
22-
ClientSecret string `json:"client_secret" tf:"sensitive"`
23-
}
24-
25-
type AzureManagedIdentity struct {
26-
AccessConnectorID string `json:"access_connector_id"`
27-
}
28-
2919
type GcpServiceAccountKey struct {
3020
Email string `json:"email"`
3121
PrivateKeyId string `json:"private_key_id"`
@@ -37,23 +27,40 @@ type DbGcpServiceAccount struct {
3727
}
3828

3929
type DataAccessConfiguration struct {
40-
ID string `json:"id,omitempty" tf:"computed"`
41-
Name string `json:"name"`
42-
ConfigurationType string `json:"configuration_type,omitempty" tf:"computed"`
43-
Aws *AwsIamRole `json:"aws_iam_role,omitempty" tf:"group:access"`
44-
Azure *AzureServicePrincipal `json:"azure_service_principal,omitempty" tf:"group:access"`
45-
AzMI *AzureManagedIdentity `json:"azure_managed_identity,omitempty" tf:"group:access"`
46-
GcpSAKey *GcpServiceAccountKey `json:"gcp_service_account_key,omitempty" tf:"group:access"`
47-
DBGcpSA *DbGcpServiceAccount `json:"databricks_gcp_service_account,omitempty" tf:"group:access"`
30+
ID string `json:"id,omitempty" tf:"computed"`
31+
Name string `json:"name"`
32+
ConfigurationType string `json:"configuration_type,omitempty" tf:"computed"`
33+
Aws *AwsIamRole `json:"aws_iam_role,omitempty" tf:"group:access"`
34+
Azure *catalog.AzureServicePrincipal `json:"azure_service_principal,omitempty" tf:"group:access"`
35+
AzMI *catalog.AzureManagedIdentity `json:"azure_managed_identity,omitempty" tf:"group:access"`
36+
GcpSAKey *GcpServiceAccountKey `json:"gcp_service_account_key,omitempty" tf:"group:access"`
37+
DBGcpSA *DbGcpServiceAccount `json:"databricks_gcp_service_account,omitempty" tf:"group:access"`
4838
}
4939

50-
var alofCred = []string{"aws_iam_role", "azure_service_principal", "azure_managed_identity", "gcp_service_account_key", "databricks_gcp_service_account"}
40+
var alofCred = []string{"aws_iam_role", "azure_service_principal", "azure_managed_identity",
41+
"gcp_service_account_key", "databricks_gcp_service_account"}
5142

5243
func SuppressGcpSAKeyDiff(k, old, new string, d *schema.ResourceData) bool {
5344
//ignore changes in private_key
5445
return !d.HasChanges("gcp_service_account_key.0.email", "gcp_service_account_key.0.private_key_id")
5546
}
5647

48+
// it's used by both ResourceMetastoreDataAccess & ResourceStorageCredential
49+
func adjustDataAccessSchema(m map[string]*schema.Schema) map[string]*schema.Schema {
50+
m["aws_iam_role"].AtLeastOneOf = alofCred
51+
m["azure_service_principal"].AtLeastOneOf = alofCred
52+
m["azure_managed_identity"].AtLeastOneOf = alofCred
53+
m["gcp_service_account_key"].AtLeastOneOf = alofCred
54+
m["databricks_gcp_service_account"].AtLeastOneOf = alofCred
55+
56+
// suppress changes for private_key
57+
m["gcp_service_account_key"].DiffSuppressFunc = SuppressGcpSAKeyDiff
58+
59+
common.MustSchemaPath(m, "azure_managed_identity", "credential_id").Computed = true
60+
61+
return m
62+
}
63+
5764
var dacSchema = common.StructToSchema(DataAccessConfiguration{},
5865
func(m map[string]*schema.Schema) map[string]*schema.Schema {
5966
m["metastore_id"] = &schema.Schema{
@@ -67,15 +74,8 @@ var dacSchema = common.StructToSchema(DataAccessConfiguration{},
6774
Type: schema.TypeBool,
6875
Optional: true,
6976
}
70-
m["aws_iam_role"].AtLeastOneOf = alofCred
71-
m["azure_service_principal"].AtLeastOneOf = alofCred
72-
m["azure_managed_identity"].AtLeastOneOf = alofCred
73-
m["gcp_service_account_key"].AtLeastOneOf = alofCred
74-
m["databricks_gcp_service_account"].AtLeastOneOf = alofCred
75-
76-
// suppress changes for private_key
77-
m["gcp_service_account_key"].DiffSuppressFunc = SuppressGcpSAKeyDiff
78-
return m
77+
78+
return adjustDataAccessSchema(m)
7979
})
8080

8181
func ResourceMetastoreDataAccess() *schema.Resource {

‎catalog/resource_metastore_data_access_test.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,9 @@ func TestCreateDacWithAzMI(t *testing.T) {
7474
Resource: "/api/2.1/unity-catalog/storage-credentials",
7575
ExpectedRequest: DataAccessConfiguration{
7676
Name: "bcd",
77-
AzMI: &AzureManagedIdentity{
78-
AccessConnectorID: "def",
77+
AzMI: &catalog.AzureManagedIdentity{
78+
AccessConnectorId: "def",
79+
ManagedIdentityId: "/..../subscription",
7980
},
8081
},
8182
Response: catalog.StorageCredentialInfo{
@@ -96,6 +97,7 @@ func TestCreateDacWithAzMI(t *testing.T) {
9697
Name: "bcd",
9798
AzureManagedIdentity: &catalog.AzureManagedIdentity{
9899
AccessConnectorId: "def",
100+
ManagedIdentityId: "/..../subscription",
99101
},
100102
},
101103
},
@@ -115,6 +117,7 @@ func TestCreateDacWithAzMI(t *testing.T) {
115117
is_default = true
116118
azure_managed_identity {
117119
access_connector_id = "def"
120+
managed_identity_id = "/..../subscription"
118121
}
119122
`,
120123
}.ApplyNoError(t)

‎catalog/resource_storage_credential.go‎

Lines changed: 11 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,16 @@ import (
1010
)
1111

1212
type StorageCredentialInfo struct {
13-
Name string `json:"name" tf:"force_new"`
14-
Owner string `json:"owner,omitempty" tf:"computed"`
15-
Comment string `json:"comment,omitempty"`
16-
Aws *AwsIamRole `json:"aws_iam_role,omitempty" tf:"group:access"`
17-
Azure *AzureServicePrincipal `json:"azure_service_principal,omitempty" tf:"group:access"`
18-
AzMI *AzureManagedIdentity `json:"azure_managed_identity,omitempty" tf:"group:access"`
19-
GcpSAKey *GcpServiceAccountKey `json:"gcp_service_account_key,omitempty" tf:"group:access"`
20-
DBGcpSA *DbGcpServiceAccount `json:"databricks_gcp_service_account,omitempty" tf:"computed"`
21-
MetastoreID string `json:"metastore_id,omitempty" tf:"computed"`
22-
ReadOnly bool `json:"read_only,omitempty"`
13+
Name string `json:"name" tf:"force_new"`
14+
Owner string `json:"owner,omitempty" tf:"computed"`
15+
Comment string `json:"comment,omitempty"`
16+
Aws *AwsIamRole `json:"aws_iam_role,omitempty" tf:"group:access"`
17+
Azure *catalog.AzureServicePrincipal `json:"azure_service_principal,omitempty" tf:"group:access"`
18+
AzMI *catalog.AzureManagedIdentity `json:"azure_managed_identity,omitempty" tf:"group:access"`
19+
GcpSAKey *GcpServiceAccountKey `json:"gcp_service_account_key,omitempty" tf:"group:access"`
20+
DBGcpSA *DbGcpServiceAccount `json:"databricks_gcp_service_account,omitempty" tf:"computed"`
21+
MetastoreID string `json:"metastore_id,omitempty" tf:"computed"`
22+
ReadOnly bool `json:"read_only,omitempty"`
2323
}
2424

2525
func removeGcpSaField(originalSchema map[string]*schema.Schema) map[string]*schema.Schema {
@@ -39,16 +39,7 @@ func ResourceStorageCredential() *schema.Resource {
3939
Type: schema.TypeBool,
4040
Optional: true,
4141
}
42-
m["aws_iam_role"].AtLeastOneOf = alofCred
43-
m["azure_service_principal"].AtLeastOneOf = alofCred
44-
m["azure_managed_identity"].AtLeastOneOf = alofCred
45-
m["gcp_service_account_key"].AtLeastOneOf = alofCred
46-
m["databricks_gcp_service_account"].AtLeastOneOf = alofCred
47-
48-
// suppress changes for private_key
49-
m["gcp_service_account_key"].DiffSuppressFunc = SuppressGcpSAKeyDiff
50-
51-
return m
42+
return adjustDataAccessSchema(m)
5243
})
5344
return common.Resource{
5445
Schema: s,

‎catalog/resource_storage_credential_test.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -221,8 +221,8 @@ func TestCreateStorageCredentialWithAzMI(t *testing.T) {
221221
Resource: "/api/2.1/unity-catalog/storage-credentials",
222222
ExpectedRequest: StorageCredentialInfo{
223223
Name: "a",
224-
AzMI: &AzureManagedIdentity{
225-
AccessConnectorID: "def",
224+
AzMI: &catalog.AzureManagedIdentity{
225+
AccessConnectorId: "def",
226226
},
227227
Comment: "c",
228228
},
@@ -235,8 +235,8 @@ func TestCreateStorageCredentialWithAzMI(t *testing.T) {
235235
Resource: "/api/2.1/unity-catalog/storage-credentials/a",
236236
ExpectedRequest: StorageCredentialInfo{
237237
Name: "a",
238-
AzMI: &AzureManagedIdentity{
239-
AccessConnectorID: "def",
238+
AzMI: &catalog.AzureManagedIdentity{
239+
AccessConnectorId: "def",
240240
},
241241
Comment: "c",
242242
},
@@ -277,9 +277,9 @@ func TestUpdateAzStorageCredentials(t *testing.T) {
277277
ExpectedRequest: StorageCredentialInfo{
278278
Name: "a",
279279
Comment: "c",
280-
Azure: &AzureServicePrincipal{
281-
DirectoryID: "CHANGED",
282-
ApplicationID: "CHANGED",
280+
Azure: &catalog.AzureServicePrincipal{
281+
DirectoryId: "CHANGED",
282+
ApplicationId: "CHANGED",
283283
ClientSecret: "CHANGED",
284284
},
285285
},
@@ -379,8 +379,8 @@ func TestUpdateAzStorageCredentialMI(t *testing.T) {
379379
ExpectedRequest: StorageCredentialInfo{
380380
Name: "a",
381381
Comment: "c",
382-
AzMI: &AzureManagedIdentity{
383-
AccessConnectorID: "CHANGED",
382+
AzMI: &catalog.AzureManagedIdentity{
383+
AccessConnectorId: "CHANGED",
384384
},
385385
},
386386
},

‎docs/resources/metastore_data_access.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,8 @@ The following arguments are required:
6464

6565
`azure_managed_identity` optional configuration block for using managed identity as credential details for Azure (Recommended):
6666

67-
* `access_connector_id` - The Resource ID of the Azure Databricks Access Connector resource, of the form `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.Databricks/accessConnectors/connector-name`
67+
* `access_connector_id` - The Resource ID of the Azure Databricks Access Connector resource, of the form `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.Databricks/accessConnectors/connector-name`.
68+
* `managed_identity_id` - (Optional) The Resource ID of the Azure User Assigned Managed Identity associated with Azure Databricks Access Connector, of the form `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.ManagedIdentity/userAssignedIdentities/user-managed-identity-name`.
6869

6970
`databricks_gcp_service_account` optional configuration block for creating a Databricks-managed GCP Service Account:
7071

‎docs/resources/storage_credential.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,8 @@ The following arguments are required:
8080

8181
`azure_managed_identity` optional configuration block for using managed identity as credential details for Azure (recommended over service principal):
8282

83-
- `access_connector_id` - The Resource ID of the Azure Databricks Access Connector resource, of the form `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.Databricks/accessConnectors/connector-name`
83+
- `access_connector_id` - The Resource ID of the Azure Databricks Access Connector resource, of the form `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.Databricks/accessConnectors/connector-name`.
84+
* `managed_identity_id` - (Optional) The Resource ID of the Azure User Assigned Managed Identity associated with Azure Databricks Access Connector, of the form `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.ManagedIdentity/userAssignedIdentities/user-managed-identity-name`.
8485

8586
`azure_service_principal` optional configuration block to use service principal as credential details for Azure:
8687

0 commit comments

Comments
 (0)