使用Terraform创建Databricks密钥范围失败：Azure KeyVault不可用

1. 对齐AKV访问策略的Terraform状态 #

提示策略已存在需导入状态，说明Terraform本地状态与Azure云端资源不一致，导致后续权限配置不生效：

• 先通过Azure Portal或Azure CLI获取已存在的AKV访问策略ID，执行导入命令：

  terraform import azurerm_key_vault_access_policy.databricks_sp /subscriptions/<订阅ID>/resourceGroups/<资源组名>/providers/Microsoft.KeyVault/vaults/<AKV名称>/accessPolicies/<策略ID>
  

• 在Terraform代码中定义对应的访问策略资源，确保SP拥有密钥的get、list、set权限（这是Databricks密钥范围同步AKV所需的核心权限）：

  resource "azurerm_key_vault_access_policy" "databricks_sp" {
    key_vault_id = azurerm_key_vault.example.id
    tenant_id    = data.azurerm_client_config.current.tenant_id
    object_id    = azurerm_service_principal.databricks_sp.object_id
  
    secret_permissions = [
      "Get",
      "List",
      "Set"
    ]
  }
  

2. 验证SP的Databricks权限完整性 #

虽然SP属于Databricks管理员组，但需确认其服务主体身份在Databricks中已正确授权：

• 用Databricks CLI执行权限检查：

  databricks workspace list-permissions / --principal <SP的应用ID>
  

• 确保输出中包含ALLOW_ALL权限，或至少拥有创建密钥范围的权限（若权限不足，需在Databricks UI中补全）。

3. 强制Terraform资源依赖顺序 #

避免因资源创建时序问题导致权限未生效：

• 在databricks_secret_scope资源中添加depends_on，明确依赖AKV访问策略和SP的Databricks组成员身份：

  resource "databricks_secret_scope" "akv_scope" {
    name                     = "akv-secret-scope"
    backend_type             = "AZURE_KEYVAULT"
    azure_keyvault_metadata {
      key_vault_id = azurerm_key_vault.example.id
      dns_name     = azurerm_key_vault.example.vault_uri
    }
  
    depends_on = [
      azurerm_key_vault_access_policy.databricks_sp,
      databricks_group_member.admin_sp
    ]
  }
  

4. 修复API Workaround的状态同步问题 #

若继续使用Databricks API 2.0，用null_resource配合触发器实现状态跟踪：

• 定义带触发器的null_resource，触发条件绑定AKV和SP的资源ID变化：

  resource "null_resource" "create_secret_scope" {
    triggers = {
      key_vault_id = azurerm_key_vault.example.id
      sp_object_id = azurerm_service_principal.databricks_sp.object_id
    }
  
    provisioner "local-exec" {
      command = <<EOT
        curl -X POST https://${azurerm_databricks_workspace.example.workspace_url}/api/2.0/secrets/scopes/create \
          -H "Authorization: Bearer $(databricks configure --token --host ${azurerm_databricks_workspace.example.workspace_url})" \
          -d '{
            "scope": "akv-secret-scope",
            "backend_type": "AZURE_KEYVAULT",
            "azure_keyvault_metadata": {
              "key_vault_id": "${azurerm_key_vault.example.id}",
              "dns_name": "${azurerm_key_vault.example.vault_uri}"
            }
          }'
      EOT
    }
  
    depends_on = [
      azurerm_key_vault_access_policy.databricks_sp,
      databricks_group_member.admin_sp
    ]
  }
  

• 若状态出现偏差，可执行terraform state rm null_resource.create_secret_scope后重新terraform apply，强制同步状态。

内容的提问来源于stack exchange，提问作者BeGreen