Clarified error messages around azure_workspace_resource_id (#1050)

Fixed #1049

Author: nfx

CHANGELOG.md

@@ -2,7 +2,8 @@
 
 ## 0.4.6
 
-* Added optional `force` argument to `databricks_user` resource to ignore `cannot create user: User with username X already exists` errors and implicitly import the specific user into Terraform state, enforcing entitlements defined in the instance of resource.
+* Clarified error messages around `azure_workspace_resource_id` provider configuration ([#1049](https://github.com/databrickslabs/terraform-provider-databricks/issues/1049)).
+* Added optional `force` argument to `databricks_user` resource to ignore `cannot create user: User with username X already exists` errors and implicitly import the specific user into Terraform state, enforcing entitlements defined in the instance of resource ([#1048](https://github.com/databrickslabs/terraform-provider-databricks/pull/1048)).
 
 Updated dependency versions:
 

common/azure_auth.go

@@ -185,7 +185,7 @@ func (aa *DatabricksClient) ensureWorkspaceURL(ctx context.Context,
 	}
 	resourceID := aa.AzureResourceID
 	if resourceID == "" {
-		return fmt.Errorf("somehow resource id is not set")
+		return fmt.Errorf("please set `azure_workspace_resource_id` provider argument")
 	}
 	log.Println("[DEBUG] Getting Workspace ID via management token.")
 	// All azure endpoints typically end with a trailing slash removing it because resourceID starts with slash

common/azure_auth_test.go

@@ -90,7 +90,7 @@ func TestEnsureWorkspaceURL_CornerCases(t *testing.T) {
 	aa.AzureEnvironment = &env
 
 	err = aa.ensureWorkspaceURL(context.Background(), nil)
-	assert.EqualError(t, err, "somehow resource id is not set")
+	assert.EqualError(t, err, "please set `azure_workspace_resource_id` provider argument")
 }
 
 func TestDatabricksClient_ensureWorkspaceURL(t *testing.T) {
@@ -517,7 +517,7 @@ func TestSimpleAADRequestVisitor_FailWorkspaceUrl(t *testing.T) {
 		func(resource string) (autorest.Authorizer, error) {
 			return autorest.NullAuthorizer{}, nil
 		})
-	assert.EqualError(t, err, "cannot get workspace: somehow resource id is not set")
+	assert.EqualError(t, err, "cannot get workspace: please set `azure_workspace_resource_id` provider argument")
 }
 
 func TestSimpleAADRequestVisitor_FailPlatformAuth(t *testing.T) {

docs/index.md

@@ -188,7 +188,8 @@ Since v0.3.8, it's possible to leverage [Azure Managed Service Identity](https:/
 
 ```hcl
 provider "databricks" {
-  host = data.azurerm_databricks_workspace.this.workspace_url
+  host                        = data.azurerm_databricks_workspace.this.workspace_url
+  azure_workspace_resource_id = azurerm_databricks_workspace.this.id
 
   # ARM_USE_MSI environment variable is recommended
   azure_use_msi = true
@@ -239,18 +240,19 @@ resource "azurerm_databricks_workspace" "this" {
 }
 
 provider "databricks" {
-  host                = azurerm_databricks_workspace.this.workspace_url
-  azure_client_id     = var.client_id
-  azure_client_secret = var.client_secret
-  azure_tenant_id     = var.tenant_id
+  host                        = azurerm_databricks_workspace.this.workspace_url
+  azure_workspace_resource_id = azurerm_databricks_workspace.this.id
+  azure_client_id             = var.client_id
+  azure_client_secret         = var.client_secret
+  azure_tenant_id             = var.tenant_id
 }
 
 resource "databricks_user" "my-user" {
   user_name = "[email protected]"
 }
 ```
 
-* `azure_workspace_resource_id` - (optional) `id` attribute of [azurerm_databricks_workspace](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/databricks_workspace) resource. Combination of subscription id, resource group name, and workspace name.
+* `azure_workspace_resource_id` - (optional) `id` attribute of [azurerm_databricks_workspace](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/databricks_workspace) resource. Combination of subscription id, resource group name, and workspace name. Required with `auzre_use_msi` or `azure_client_secret`.
 * `azure_client_secret` - (optional) This is the Azure Enterprise Application (Service principal) client secret. This service principal requires contributor access to your Azure Databricks deployment. Alternatively, you can provide this value as an environment variable `ARM_CLIENT_SECRET`.
 * `azure_client_id` - (optional) This is the Azure Enterprise Application (Service principal) client id. This service principal requires contributor access to your Azure Databricks deployment. Alternatively, you can provide this value as an environment variable `ARM_CLIENT_ID`.
 * `azure_tenant_id` - (optional) This is the Azure Active Directory Tenant id in which the Enterprise Application (Service Principal) 

docs/resources/sql_global_config.md

@@ -25,7 +25,7 @@ For Azure you should use the `data_access_config` to provide the service princip
 
 ```hcl
 resource "databricks_sql_global_config" "this" {
-  security_policy      = "DATA_ACCESS_CONTROL"
+  security_policy = "DATA_ACCESS_CONTROL"
   data_access_config = {
     "spark.hadoop.fs.azure.account.auth.type" : "OAuth",
     "spark.hadoop.fs.azure.account.oauth.provider.type" : "org.apache.hadoop.fs.azurebfs.oauth2.ClientCredsTokenProvider",