Terraform配置Databricks SQL仓库权限报错：IS_OWNER不被支持

尝试通过Terraform为Databricks SQL仓库配置权限时，使用IS_OWNER权限级别触发报错，提示该权限不支持sql_endpoint_id对象，但官方文档显示该权限被支持。将IS_OWNER替换为CAN_MANAGE后，Terraform可正常生成执行计划，对此存在疑惑。

配置代码 #

auto.tfvars #

databricks_sql_warehouse = {
  sql_warehouse_dedicated = {
    name                      = "sql_warehouse-dedicated-dev"
    cluster_size              = "2X-Small"
    min_num_clusters          = 1
    max_num_clusters          = 2
    auto_stop_mins            = 30
    enable_serverless_compute = false
    warehouse_type            = "PRO" 
    # enable_photon

    access_control = {
      "DEMO-ADMINISTRATORS" = "IS_OWNER"
      "Demo-Contributors"   = "CAN_USE"
    }
  }


  sql_warehouse_serverless = {
    name                      = "sql_warehouse-serverless-dev"
    cluster_size              = "2X-Small"
    min_num_clusters          = 1
    max_num_clusters          = 1
    auto_stop_mins            = 1
    enable_serverless_compute = true
    warehouse_type            = "PRO"
    # enable_photon
    access_control = {
      "DEMO-ADMINISTRATORS" = "IS_OWNER"
      "Demo-Contributors"   = "CAN_USE"
    }
  }
}

变量定义 #

variable "databricks_sql_warehouse" {
  default = {}
}

main.tf #

module "e61-tff" {
  source = "../e61-tif"

  # tags            = var.tags
  global_settings = var.global_settings

  databricks = {
    databricks_sql_warehouse = var.databricks_sql_warehouse
  }
}

模块调用文件 #

module "databricks_sql_warehouse" {
  source   = "./modules/sql_warehouse"
  for_each = local.databricks.databricks_sql_warehouse

  global_settings = var.global_settings

  settings = each.value
}

资源定义文件 #

resource "databricks_sql_endpoint" "this" {
  name                     = try(var.settings.name, "base_cluster_${var.global_settings.environment}")
  cluster_size             = try(var.settings.cluster_size, "2X-Small")
  min_num_clusters         = try(var.settings.min_num_clusters, 1)
  max_num_clusters         = try(var.settings.max_num_clusters, 1)
  auto_stop_mins           = var.settings.auto_stop_mins
  enable_serverless_compute = var.settings.enable_serverless_compute
  warehouse_type           = var.settings.warehouse_type
}

resource "databricks_permissions" "endpoint_usage" {
  for_each = var.settings.access_control
  
  sql_endpoint_id = databricks_sql_endpoint.this.id

  access_control {
    group_name       = each.key
    permission_level = each.value
  }
}

原因分析 #

1. 权限名称映射差异：Databricks的权限体系中，IS_OWNER是通用权限标识，但针对SQL仓库（SQL Endpoint）资源，Terraform Databricks Provider实际仅支持CAN_MANAGE作为管理类权限，属于Provider实现层面的权限映射逻辑，部分文档可能未及时同步。
2. Provider版本兼容：不同版本的Terraform Databricks Provider对权限名称的支持存在差异，旧版本可能未完全对齐通用权限标识，需使用资源特定的权限值。

解决方案 #

1. 替换权限级别：针对Databricks SQL仓库的权限配置，将IS_OWNER替换为CAN_MANAGE，即可完成管理权限的分配。
2. 升级Provider版本：建议使用最新稳定版的Terraform Databricks Provider，新版本通常会优化权限映射逻辑，减少文档与实际实现的差异。
3. 验证权限效果：部署完成后，在Databricks控制台检查SQL仓库的权限列表，确认CAN_MANAGE权限具备预期的管理能力（如修改仓库配置、分配其他权限等）。

内容的提问来源于stack exchange，提问作者play_something_good