Skip to content

Commit fb84836

Browse files
nkvuongnkvuong
authored
add aws_unity_catalog_assume_role_policy data source (#3622)
* add `aws_unity_catalog_assume_role_policy` data source * feedback
1 parent f5341c5 commit fb84836

File tree

6 files changed

+292
-154
lines changed

6 files changed

+292
-154
lines changed

‎aws/data_aws_unity_catalog_assume_role_policy.go‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
package aws
2+
3+
import (
4+
"context"
5+
"encoding/json"
6+
"fmt"
7+
8+
"github.com/databricks/terraform-provider-databricks/common"
9+
)
10+
11+
func DataAwsUnityCatalogAssumeRolePolicy() common.Resource {
12+
type AwsUcAssumeRolePolicy struct {
13+
RoleName string `json:"role_name"`
14+
UnityCatalogIamArn string `json:"unity_catalog_iam_arn,omitempty" tf:"computed"`
15+
ExternalId string `json:"external_id"`
16+
AwsAccountId string `json:"aws_account_id"`
17+
JSON string `json:"json" tf:"computed"`
18+
Id string `json:"id" tf:"computed"`
19+
}
20+
return common.NoClientData(func(ctx context.Context, data *AwsUcAssumeRolePolicy) error {
21+
if data.UnityCatalogIamArn == "" {
22+
data.UnityCatalogIamArn = "arn:aws:iam::414351767826:role/unity-catalog-prod-UCMasterRole-14S5ZJVKOTYTL"
23+
}
24+
policy := awsIamPolicy{
25+
Version: "2012-10-17",
26+
Statements: []*awsIamPolicyStatement{
27+
{
28+
Sid: "UnityCatalogAssumeRole",
29+
Effect: "Allow",
30+
Actions: "sts:AssumeRole",
31+
Condition: map[string]map[string]string{
32+
"StringEquals": {
33+
"sts:ExternalId": data.ExternalId,
34+
},
35+
},
36+
Principal: map[string]string{
37+
"AWS": data.UnityCatalogIamArn,
38+
},
39+
},
40+
{
41+
Sid: "ExplicitSelfRoleAssumption",
42+
Effect: "Allow",
43+
Actions: "sts:AssumeRole",
44+
Condition: map[string]map[string]string{
45+
"ArnLike": {
46+
"aws:PrincipalArn": fmt.Sprintf("arn:aws:iam::%s:role/%s", data.AwsAccountId, data.RoleName),
47+
},
48+
},
49+
Principal: map[string]string{
50+
"AWS": fmt.Sprintf("arn:aws:iam::%s:root", data.AwsAccountId),
51+
},
52+
},
53+
},
54+
}
55+
policyJSON, err := json.MarshalIndent(policy, "", " ")
56+
if err != nil {
57+
return err
58+
}
59+
data.Id = fmt.Sprintf("%s-%s-%s", data.AwsAccountId, data.RoleName, data.ExternalId)
60+
data.JSON = string(policyJSON)
61+
return nil
62+
})
63+
}

‎aws/data_aws_unity_catalog_assume_role_policy_test.go‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
package aws
2+
3+
import (
4+
"testing"
5+
6+
"github.com/databricks/terraform-provider-databricks/qa"
7+
"github.com/stretchr/testify/assert"
8+
)
9+
10+
func TestDataAwsUnityCatalogAssumeRolePolicy(t *testing.T) {
11+
d, err := qa.ResourceFixture{
12+
Read: true,
13+
Resource: DataAwsUnityCatalogAssumeRolePolicy(),
14+
NonWritable: true,
15+
ID: ".",
16+
HCL: `
17+
aws_account_id = "123456789098"
18+
unity_catalog_iam_arn = "arn:aws:iam::414351767826:role/unity-catalog-prod-UCMasterRole-14S5ZJVKOTYTL"
19+
role_name = "databricks-role"
20+
external_id = "12345"
21+
`,
22+
}.Apply(t)
23+
assert.NoError(t, err)
24+
j := d.Get("json").(string)
25+
p := `{
26+
"Version": "2012-10-17",
27+
"Statement": [
28+
{
29+
"Sid": "UnityCatalogAssumeRole",
30+
"Effect": "Allow",
31+
"Action": "sts:AssumeRole",
32+
"Principal": {
33+
"AWS": "arn:aws:iam::414351767826:role/unity-catalog-prod-UCMasterRole-14S5ZJVKOTYTL"
34+
},
35+
"Condition": {
36+
"StringEquals": {
37+
"sts:ExternalId": "12345"
38+
}
39+
}
40+
},
41+
{
42+
"Sid": "ExplicitSelfRoleAssumption",
43+
"Effect": "Allow",
44+
"Action": "sts:AssumeRole",
45+
"Principal": {
46+
"AWS": "arn:aws:iam::123456789098:root"
47+
},
48+
"Condition": {
49+
"ArnLike": {
50+
"aws:PrincipalArn": "arn:aws:iam::123456789098:role/databricks-role"
51+
}
52+
}
53+
}
54+
]
55+
}`
56+
compareJSON(t, j, p)
57+
}
58+
59+
func TestDataAwsUnityCatalogAssumeRolePolicyWithoutUcArn(t *testing.T) {
60+
d, err := qa.ResourceFixture{
61+
Read: true,
62+
Resource: DataAwsUnityCatalogAssumeRolePolicy(),
63+
NonWritable: true,
64+
ID: ".",
65+
HCL: `
66+
aws_account_id = "123456789098"
67+
role_name = "databricks-role"
68+
external_id = "12345"
69+
`,
70+
}.Apply(t)
71+
assert.NoError(t, err)
72+
j := d.Get("json").(string)
73+
p := `{
74+
"Version": "2012-10-17",
75+
"Statement": [
76+
{
77+
"Sid": "UnityCatalogAssumeRole",
78+
"Effect": "Allow",
79+
"Action": "sts:AssumeRole",
80+
"Principal": {
81+
"AWS": "arn:aws:iam::414351767826:role/unity-catalog-prod-UCMasterRole-14S5ZJVKOTYTL"
82+
},
83+
"Condition": {
84+
"StringEquals": {
85+
"sts:ExternalId": "12345"
86+
}
87+
}
88+
},
89+
{
90+
"Sid": "ExplicitSelfRoleAssumption",
91+
"Effect": "Allow",
92+
"Action": "sts:AssumeRole",
93+
"Principal": {
94+
"AWS": "arn:aws:iam::123456789098:root"
95+
},
96+
"Condition": {
97+
"ArnLike": {
98+
"aws:PrincipalArn": "arn:aws:iam::123456789098:role/databricks-role"
99+
}
100+
}
101+
}
102+
]
103+
}`
104+
compareJSON(t, j, p)
105+
}

‎docs/data-sources/aws_unity_catalog_assume_role_policy.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
subcategory: "Deployment"
3+
---
4+
# databricks_aws_unity_catalog_assume_role_policy Data Source
5+
6+
-> **Note** This resource has an evolving API, which may change in future versions of the provider. Please always consult [latest documentation](https://docs.databricks.com/data-governance/unity-catalog/get-started.html#configure-a-storage-bucket-and-iam-role-in-aws) in case of any questions.
7+
8+
This data source constructs necessary AWS Unity Catalog assume role policy for you.
9+
10+
## Example Usage
11+
12+
```hcl
13+
data "databricks_aws_unity_catalog_policy" "this" {
14+
aws_account_id = var.aws_account_id
15+
bucket_name = "databricks-bucket"
16+
role_name = "${var.prefix}-uc-access"
17+
kms_name = "databricks-kms"
18+
}
19+
20+
data "databricks_aws_unity_catalog_assume_role_policy" "this" {
21+
aws_account_id = var.aws_account_id
22+
role_name = "${var.prefix}-uc-access"
23+
external_id = "12345"
24+
}
25+
26+
resource "aws_iam_policy" "unity_metastore" {
27+
name = "${var.prefix}-unity-catalog-metastore-access-iam-policy"
28+
policy = data.databricks_aws_unity_catalog_policy.this.json
29+
}
30+
31+
resource "aws_iam_role" "metastore_data_access" {
32+
name = "${var.prefix}-uc-access"
33+
assume_role_policy = data.aws_iam_policy_document.passrole_for_uc.json
34+
managed_policy_arns = [aws_iam_policy.unity_metastore.arn]
35+
}
36+
```
37+
38+
## Argument Reference
39+
40+
* `aws_account_id` (Required) The Account ID of the current AWS account (not your Databricks account).
41+
* `external_id` (Required) The [storage credential](../resources/storage_credential.md) external id.
42+
* `role_name` (Required) The name of the AWS IAM role that you created in the previous step in the [official documentation](https://docs.databricks.com/data-governance/unity-catalog/get-started.html#configure-a-storage-bucket-and-iam-role-in-aws).
43+
* `unity_catalog_iam_arn` (Optional) The Databricks Unity Catalog IAM Role ARN. Defaults to `arn:aws:iam::414351767826:role/unity-catalog-prod-UCMasterRole-14S5ZJVKOTYTL`
44+
45+
## Attribute Reference
46+
47+
In addition to all arguments above, the following attributes are exported:
48+
49+
* `json` - AWS IAM Policy JSON document for assume role

‎docs/data-sources/aws_unity_catalog_policy.md‎

Lines changed: 7 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -3,50 +3,24 @@ subcategory: "Deployment"
33
---
44
# databricks_aws_unity_catalog_policy Data Source
55

6-
-> **Note** This resource has an evolving API, which may change in future versions of the provider. Please always consult [latest documentation](https://docs.databricks.com/administration-guide/account-api/iam-role.html#language-Your%C2%A0VPC,%C2%A0default) in case of any questions.
6+
-> **Note** This resource has an evolving API, which may change in future versions of the provider. Please always consult [latest documentation](https://docs.databricks.com/data-governance/unity-catalog/get-started.html#configure-a-storage-bucket-and-iam-role-in-aws) in case of any questions.
77

8-
This data source constructs necessary AWS Unity Catalog policy for you, which is based on [official documentation](https://docs.databricks.com/data-governance/unity-catalog/get-started.html#configure-a-storage-bucket-and-iam-role-in-aws).
8+
This data source constructs necessary AWS Unity Catalog policy for you.
99

1010
## Example Usage
1111

1212
```hcl
1313
data "databricks_aws_unity_catalog_policy" "this" {
1414
aws_account_id = var.aws_account_id
1515
bucket_name = "databricks-bucket"
16-
role_name = "databricks-role"
16+
role_name = "${var.prefix}-uc-access"
1717
kms_name = "databricks-kms"
1818
}
1919
20-
data "aws_iam_policy_document" "passrole_for_uc" {
21-
statement {
22-
effect = "Allow"
23-
actions = ["sts:AssumeRole"]
24-
principals {
25-
identifiers = [
26-
"arn:aws:iam::414351767826:role/unity-catalog-prod-UCMasterRole-14S5ZJVKOTYTL" # Databricks Account ID
27-
]
28-
type = "AWS"
29-
}
30-
condition {
31-
test = "StringEquals"
32-
variable = "sts:ExternalId"
33-
values = [var.databricks_account_id]
34-
}
35-
}
36-
statement {
37-
sid = "ExplicitSelfRoleAssumption"
38-
effect = "Allow"
39-
actions = ["sts:AssumeRole"]
40-
principals {
41-
type = "AWS"
42-
identifiers = ["arn:aws:iam::${var.aws_account_id}:root"]
43-
}
44-
condition {
45-
test = "ArnLike"
46-
variable = "aws:PrincipalArn"
47-
values = ["arn:aws:iam::${var.aws_account_id}:role/${var.prefix}-uc-access"]
48-
}
49-
}
20+
data "databricks_aws_unity_catalog_assume_role_policy" "this" {
21+
aws_account_id = var.aws_account_id
22+
role_name = "${var.prefix}-uc-access"
23+
external_id = "12345"
5024
}
5125
5226
resource "aws_iam_policy" "unity_metastore" {

0 commit comments

Comments
 (0)