not able to find the terraform resource for databricks token policy

Question

not able to find the terraform resource for databricks token policy

JA 131

I am providing some token specific permissions to users in databricks. I am using code like this to configure token specific settings . I am new to terraform and thus not able to figure out what could be wrong with this code. I dont see any relevant links on google on this error as well. So any leads would be appreciated.

This is the terraform code snippet used to provision databricks. The xyz is replaced with actual values which I have removed here and it throws the error which is provided below the code snippet.



Exception: AzureTaskRetriableException: [TerraformCreate]: Failed to execute terraform. Reason: Terraform Execution Exception. Reason: Expected exit code 0, doesn't match with the execution exit code 1 for the command: [/opt/homebrew/bin/terraform, apply, -auto-approve, -no-color, -lock=false]. Error Message: --Error: cannot create permissions: tokens tokens does not exist----  with module.jterraform.databricks_permissions.token_usage,--  on .terraform/modules/jterraform/main.tf line 202, in resource "databricks_permissions" "token_usage":-- 202: resource "databricks_permissions" "token_usage" {------

Now, the strange thing is if this policy is applied on already create databricks account, this error doesnot come up and the policy is applied succesfully. So what could be missing in the case when the databricks is created for the first time.

KranthiPakala-MSFT 46,647 Reputation points Microsoft Employee Moderator

2023-12-27T21:09:54.7233333+00:00

@JA Welcome to Microsoft Q&A forum and thanks for reaching out here.

As per my understanding you are receiving the above error only when you try to create a new databricks account with policy included but when you tried to apply the policy for an existing databricks account, it applies without any errors.

While I reach out to internal team to see if there are any special clause for applying policies during the databricks account creation, could you please help confirm if you have tried creating a new databricks account without having the policies using the terraform? If so, could you please share your findings? Just wanted to understand/ensure your terraform code is correct for creating a new instance.
JA 131 Reputation points

2023-12-28T04:28:42.68+00:00

yes @KranthiPakala-MSFT , it is correct. If I dont keep the code for this token policy, my databricks account gets created succesfully. But if I keep the code, then I get the error which I shared.. However, once the account is created, and I add the policy code and run terraform apply again, the policy also gets added successfully. And thanks for responding. this was kind of a blocker which I was not able to figure out by browsing the net.

JA 131

Due to some bug in the support channel, the code snippets in terraform are not being visible. SO providing the entire code sample again. if you run this, you will see the error, but once the account is created (with removed token policy) and you bring the policy code again, it will work.



terraform {
  required_providers {
    databricks = {
      source = "databricks/databricks"
      version = "1.21.0"
    }
    azurerm = {
      version = ">=3.2.1"
    }
  }
}



provider "azurerm" {
  features {}
}

provider "databricks" {
  alias  = "db"
  azure_workspace_resource_id = azurerm_databricks_workspace.myworkspace.id
}


resource "azurerm_resource_group" "myresourcegroup" {
  name     = "samghj1-myresourcegroup"
  location = "centralus"
}

resource "azurerm_databricks_workspace" "myworkspace" {
  location                      = azurerm_resource_group.myresourcegroup.location
  name                          = "samghj1-workspace"
  resource_group_name           = azurerm_resource_group.myresourcegroup.name
  sku                           = "trial"
}



resource "databricks_workspace_conf" "this" {
  custom_config = {
    "maxTokenLifetimeDays" : "1",
    "enableTokensConfig" : true
  }
}

resource "databricks_permissions" "token_usage" {
  authorization = "tokens"

  access_control {
    group_name       = "users"
    permission_level = "CAN_USE"
  }
}

KranthiPakala-MSFT 46,647 Reputation points Microsoft Employee Moderator

2024-01-09T07:18:54.12+00:00

@JA This seems strange. For deeper investigation if the issue, kindly file a support ticket and do share the SR# with us here for tracking it further. In case if you don't have a support plan, kindly let me know here,

Thank you

Your answer

KranthiPakala-MSFT 46,647 Reputation points Microsoft Employee Moderator

2023-12-27T21:09:54.7233333+00:00

@JA Welcome to Microsoft Q&A forum and thanks for reaching out here.

As per my understanding you are receiving the above error only when you try to create a new databricks account with policy included but when you tried to apply the policy for an existing databricks account, it applies without any errors.

While I reach out to internal team to see if there are any special clause for applying policies during the databricks account creation, could you please help confirm if you have tried creating a new databricks account without having the policies using the terraform? If so, could you please share your findings? Just wanted to understand/ensure your terraform code is correct for creating a new instance.
JA 131 Reputation points

2023-12-28T04:28:42.68+00:00

yes @KranthiPakala-MSFT , it is correct. If I dont keep the code for this token policy, my databricks account gets created succesfully. But if I keep the code, then I get the error which I shared.. However, once the account is created, and I add the policy code and run terraform apply again, the policy also gets added successfully. And thanks for responding. this was kind of a blocker which I was not able to figure out by browsing the net.
JA 131 Reputation points

2023-12-28T14:08:45.6133333+00:00

Due to some bug in the support channel, the code snippets in terraform are not being visible. SO providing the entire code sample again. if you run this, you will see the error, but once the account is created (with removed token policy) and you bring the policy code again, it will work.

terraform { required_providers { databricks = { source = "databricks/databricks" version = "1.21.0" } azurerm = { version = ">=3.2.1" } } } provider "azurerm" { features {} } provider "databricks" { alias = "db" azure_workspace_resource_id = azurerm_databricks_workspace.myworkspace.id } resource "azurerm_resource_group" "myresourcegroup" { name = "samghj1-myresourcegroup" location = "centralus" } resource "azurerm_databricks_workspace" "myworkspace" { location = azurerm_resource_group.myresourcegroup.location name = "samghj1-workspace" resource_group_name = azurerm_resource_group.myresourcegroup.name sku = "trial" } resource "databricks_workspace_conf" "this" { custom_config = { "maxTokenLifetimeDays" : "1", "enableTokensConfig" : true } } resource "databricks_permissions" "token_usage" { authorization = "tokens" access_control { group_name = "users" permission_level = "CAN_USE" } }
KranthiPakala-MSFT 46,647 Reputation points Microsoft Employee Moderator

2024-01-09T07:18:54.12+00:00

@JA This seems strange. For deeper investigation if the issue, kindly file a support ticket and do share the SR# with us here for tracking it further. In case if you don't have a support plan, kindly let me know here,

Thank you

Share via

not able to find the terraform resource for databricks token policy

Your answer