Terraform创建Databricks Storage Credential失败求助

错误信息 #

Error: cannot create storage credential: Registering a credential requires managed identity (MI) to have a Reader role scoped to MI itself for . Please contact your account admin.

现状说明 #

• 运行Terraform的服务主体拥有目标订阅的Owner权限
• 已在Azure门户确认Databricks Access Connector的系统分配身份已被分配自身的Reader角色
• 相关Terraform代码如下：

存储凭据代码 #

resource "databricks_storage_credential" "my_credential" {
  
  provider = databricks.workspace
  name = "<name>"
  metastore_id = var.databricks_metastore_id

  azure_managed_identity {
    access_connector_id = azurerm_databricks_access_connector.my_connector.id
  }

  depends_on = [
    azurerm_role_assignment.my_connector_blob,
    azurerm_role_assignment.my_connector_reader_self,
  ]
}

Access Connector代码 #

resource "azurerm_databricks_access_connector" "my_connector" {
  name                = "<name>"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location

  identity {
    type = "SystemAssigned"
  }

  tags = local.tags
}

RBAC角色分配代码 #

resource "azurerm_role_assignment" "my_connector_blob" {
  scope                = module.my_storage.storage_account_id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_databricks_access_connector.my_connector.identity[0].principal_id

  depends_on = [
    module.my_storage,
    azurerm_databricks_access_connector.my_connector,
  ]
}

resource "azurerm_role_assignment" "my_connector_reader_self" {
  scope                = azurerm_databricks_access_connector.my_connector.id
  role_definition_name = "Reader"
  principal_id         = azurerm_databricks_access_connector.my_connector.identity[0].principal_id
  depends_on = [
    azurerm_databricks_access_connector.my_connector,
  ]
}

可能的解决办法 #

1. 等待RBAC权限生效 #

Azure RBAC角色分配存在延迟，即使门户显示已分配，Databricks后端可能未同步。等待10-15分钟后重新执行terraform apply，或手动删除Terraform状态中的角色分配资源后重新创建。

2. 替换角色名称为固定ID #

避免角色名称匹配问题，将Reader角色的role_definition_name替换为固定角色ID（acdd72a7-3385-48ef-bd42-f606fba81ae7）：

resource "azurerm_role_assignment" "my_connector_reader_self" {
  scope                = azurerm_databricks_access_connector.my_connector.id
  role_definition_id   = "acdd72a7-3385-48ef-bd42-f606fba81ae7" # Reader角色固定ID
  principal_id         = azurerm_databricks_access_connector.my_connector.identity[0].principal_id
  depends_on = [
    azurerm_databricks_access_connector.my_connector,
  ]
}

3. 验证角色分配的实际参数 #

查看Terraform计划输出中的scope和principal_id值，确认与Azure门户中Access Connector的资源ID、系统标识ID完全一致，避免变量引用错误。

4. 重置Access Connector的系统标识 #

在Azure门户中禁用再重新启用Access Connector的系统分配标识，修复可能的标识状态异常，之后重新运行Terraform。

5. 验证Databricks权限 #

确保运行Terraform的服务主体拥有Databricks工作区的管理员权限，避免Metastore无法读取Access Connector的标识信息。也可以手动在Databricks门户创建存储凭据，排查是否为Terraform特定问题。

内容的提问来源于stack exchange，提问作者TheRealJimShady