使用Terraform为Azure托管Databricks服务主体配置账号级权限报错

问题描述 #

执行Terraform为Azure上的Databricks服务主体配置账号级权限时，触发以下错误：

Error: cannot create mws permission assignment: Endpoint not found for /2.0/accounts/4f93b050-9cee-4668-8136-7937fe98f18e/workspaces/6491331033656740/permissionassignments/principals/187629890527464

用户原Terraform配置代码：

provider "databricks" {
  azure_workspace_resource_id = azurerm_databricks_workspace.xxxxx_workspace.id
  host = azurerm_databricks_workspace.xxxxx_workspace.workspace_url
  auth_type = "azure-cli"
}

resource "azurerm_databricks_workspace" "xxxxx_workspace" {
  name                    = "ADM-Databricks-xxxx"
  resource_group_name     = var.resource_group_name
  location                = var.region
  sku                     = "premium"
  custom_parameters {
    storage_account_name = "admdatalakedevxxxxx${random_string.naming.result}"
    
  }
}

resource "databricks_service_principal" "principal" {
  display_name         = "databricks-adm"
  allow_cluster_create = true
  workspace_access = true
  databricks_sql_access = true
}

resource "databricks_group_member" "i-am-admin" {
  group_id  = data.databricks_group.admins.id
  member_id = databricks_service_principal.principal.id
}

resource "databricks_mws_permission_assignment" "add_admin_group" {
  workspace_id = azurerm_databricks_workspace.xxxxx_workspace.workspace_id
  principal_id = databricks_service_principal.principal.id
  permissions  = ["ADMIN"]
}

错误原因 #

databricks_mws_permission_assignment是账号级操作资源，要求Provider指向Databricks账号的全局端点（而非单个工作区的端点）。当前配置的Provider仅指向单个工作区，导致调用了错误的API端点，从而触发“Endpoint not found”错误。

解决方案 #

1. 区分账号级与工作区级Provider #

新增一个专门用于账号级操作的Databricks Provider，指向账号级端点https://accounts.azuredatabricks.net，同时保留原工作区级Provider用于工作区相关操作。

2. 使用账号级服务主体 #

账号级权限分配必须使用账号级服务主体，不能用工作区级的。如果需要，需用账号级Provider创建对应的服务主体。

3. 修正权限分配资源 #

在databricks_mws_permission_assignment中指定账号级Provider，并补充account_id参数（你的Databricks账号ID）。

修正后的完整代码示例 #

# 工作区级Provider，负责工作区资源、工作区级服务主体及权限
provider "databricks" {
  azure_workspace_resource_id = azurerm_databricks_workspace.xxxxx_workspace.id
  host = azurerm_databricks_workspace.xxxxx_workspace.workspace_url
  auth_type = "azure-cli"
  alias = "workspace"
}

# 账号级Provider，负责账号级服务主体、账号级权限分配
provider "databricks" {
  host = "https://accounts.azuredatabricks.net"
  auth_type = "azure-cli"
  alias = "account"
}

resource "azurerm_databricks_workspace" "xxxxx_workspace" {
  name                    = "ADM-Databricks-xxxx"
  resource_group_name     = var.resource_group_name
  location                = var.region
  sku                     = "premium"
  custom_parameters {
    storage_account_name = "admdatalakedevxxxxx${random_string.naming.result}"
  }
}

# 创建账号级服务主体（用于账号级权限分配）
resource "databricks_service_principal" "account_principal" {
  provider = databricks.account
  display_name         = "databricks-adm-account"
  allow_cluster_create = true
  workspace_access = true
  databricks_sql_access = true
}

# 创建工作区级服务主体（用于工作区内部权限）
resource "databricks_service_principal" "workspace_principal" {
  provider = databricks.workspace
  display_name         = "databricks-adm-workspace"
  allow_cluster_create = true
  workspace_access = true
  databricks_sql_access = true
}

# 工作区级：将服务主体加入工作区管理员组
resource "databricks_group_member" "i-am-admin" {
  provider = databricks.workspace
  group_id  = data.databricks_group.admins.id
  member_id = databricks_service_principal.workspace_principal.id
}

# 账号级：为服务主体分配账号级ADMIN权限
resource "databricks_mws_permission_assignment" "add_admin_group" {
  provider = databricks.account
  account_id = "4f93b050-9cee-4668-8136-7937fe98f18e" # 替换为你的Databricks账号ID
  workspace_id = azurerm_databricks_workspace.xxxxx_workspace.workspace_id
  principal_id = databricks_service_principal.account_principal.id
  permissions  = ["ADMIN"]
}

关键注意事项 #

• 获取Databricks账号ID：可以通过Azure Portal进入Databricks账号页面查看，或执行Azure CLI命令 az databricks account show --query id。
• 权限要求：执行Terraform的用户必须拥有Databricks账号级管理员权限，否则会触发权限不足错误。
• 冗余检查：如果你只需要工作区级管理员权限，无需使用databricks_mws_permission_assignment，原配置中的databricks_group_member已经能实现将服务主体加入工作区管理员组的需求。

内容的提问来源于stack exchange，提问作者Alan Miranda