databricks_account

Account-level features, identity and provisioning for Databricks.

info

For Databricks workspace operations use the databricks_workspace provider.

Provider Summary

total services: 10
total resources: 94
source project: stackql-provider-databricks

Installation

REGISTRY PULL databricks_account;

Authentication

To use the databricks_account provider, you can authenticate using one of the following methods:

OAuth2 (Service Principal) [Default]

Set the following environment variables:

DATABRICKS_ACCOUNT_ID - a uuid representing your Databricks account id, you can get this from the Databricks UI (see Locate your account id)
DATABRICKS_CLIENT_ID - obtained after creating a service principal through the Databricks UI (see Authenticate access to Databricks with a service principal using OAuth)
DATABRICKS_CLIENT_SECRET - obtained after creating a service principal secret through the Databricks UI, using the "Generate Secret" function (see Authenticate access to Databricks with a service principal using OAuth)

These are the same variables that Terraform, the Databricks SDKs, and CLI use.

Cloud selection (AWS, Azure, GCP)

The provider works against Databricks accounts on AWS, Azure and Google Cloud with the same statements and the same three credential variables. It defaults to Databricks on AWS; one more variable selects another cloud, and both the OAuth token endpoint and the account API host follow it:

DATABRICKS_CLOUD - aws (default), azure or gcp
DATABRICKS_ACCOUNT_HOST - optional, a bare account console host (no scheme) for accounts that are not on the standard hosts; overrides DATABRICKS_CLOUD

Cloud	`DATABRICKS_CLOUD`	Account console and API host	Token endpoint
AWS	`aws` (default)	`accounts.cloud.databricks.com`	`https://accounts.cloud.databricks.com/oidc/accounts/<account_id>/v1/token`
Azure	`azure`	`accounts.azuredatabricks.net`	`https://accounts.azuredatabricks.net/oidc/accounts/<account_id>/v1/token`
GCP	`gcp`	`accounts.gcp.databricks.com`	`https://accounts.gcp.databricks.com/oidc/accounts/<account_id>/v1/token`

Cloud selection needs stackql v1.0.888 or later. One cloud per process: the token endpoint follows the environment, so run a separate stackql process (or shell) for each account you work with.

# Azure Databricks account
export DATABRICKS_CLOUD=azure
export DATABRICKS_ACCOUNT_ID=...
export DATABRICKS_CLIENT_ID=...
export DATABRICKS_CLIENT_SECRET=...
stackql exec "SELECT workspace_id, workspace_name, location, deployment_name FROM databricks_account.provisioning.workspaces WHERE account_id = '<account_id>'"

# Databricks on Google Cloud account (PowerShell)
$env:DATABRICKS_CLOUD = "gcp"
$env:DATABRICKS_ACCOUNT_ID = "..."
$env:DATABRICKS_CLIENT_ID = "..."
$env:DATABRICKS_CLIENT_SECRET = "..."
stackql.exe exec "SELECT workspace_id, workspace_name, location, deployment_name FROM databricks_account.provisioning.workspaces WHERE account_id = '<account_id>'"

Queries are unchanged across clouds: account_id stays the only required predicate, and with no cloud variables set the provider behaves exactly as before (AWS).

Service principal by cloud

On every cloud the credential is a service principal with a Databricks OAuth secret, created in the account console under User management > Service principals (add the principal, then Generate secret), with the Account admin role for account-level operations. Cloud identity tokens (AWS IAM, Microsoft Entra ID, Google service accounts) are not used by the provider.

Cloud	Account console	Notes
AWS	accounts.cloud.databricks.com	Databricks-managed service principal (see OAuth M2M on AWS)
Azure	accounts.azuredatabricks.net	Sign in with the Microsoft Entra ID identity that administers the Databricks account. A Databricks-managed service principal, or an Entra ID application registered as a service principal, both work when the OAuth secret is generated in the Databricks account console (see OAuth M2M on Azure)
GCP	accounts.gcp.databricks.com	Databricks-managed service principal; the Google service account that Databricks itself uses is not the principal (see OAuth M2M on GCP)

What differs by cloud

provisioning.workspaces reports the region in aws_region on AWS and in location on Azure and GCP. Azure rows also carry azure_workspace_info (subscription and resource group); GCP rows carry cloud_resource_container (the Google project) and network_id. The deployment_name column is the workspace predicate for the databricks_workspace provider on every cloud: dbc-... on AWS, adb-<workspace_id>.<n> on Azure, <workspace_id>.<n> on GCP.
The infrastructure objects in provisioning (credentials, storage, networks, vpc_endpoints, private_access, encryption_keys) and the views over them (vw_credentials, vw_storage_configurations, vw_networks, vw_network_errors, vw_network_warnings, vw_vpc_endpoints, vw_encryption_keys) are the AWS and GCP account APIs. Azure Databricks workspaces are created through Azure Resource Manager, so none of these objects exist on an Azure account and Databricks answers those calls with an HTML error page rather than an empty list. On GCP, credentials is not offered (the API answers 503); networks, vpc_endpoints, private_access, encryption_keys and workspaces cover customer-managed VPCs, Private Service Connect, customer-managed keys and workspace creation as they do on AWS.
billing.billable_usage (the usage CSV download) returns data for AWS and GCP accounts. An Azure Databricks account returns no rows because consumption is billed and reported through the Azure subscription (Azure Cost Management). Budgets, budget policies and budget spend statuses work on all three clouds.
Identity (iam, iamv2), settings (network connectivity configurations, network policies, IP access lists), oauth2, networking, catalog and the remaining services are the same on all three clouds.

Personal Access Token (Bearer)

Alternatively, set DATABRICKS_TOKEN to a Databricks personal access token (see Databricks personal access tokens), then supply the auth config when starting the shell:

export DATABRICKS_TOKEN=xxx

# Linux/Mac
AUTH='{ "databricks_account": { "type": "bearer", "credentialsenvvar": "DATABRICKS_TOKEN" }}'
./stackql shell --auth="${AUTH}"

# PowerShell
$Auth = "{ 'databricks_account': { 'type': 'bearer', 'credentialsenvvar': 'DATABRICKS_TOKEN' }}"
stackql.exe shell --auth=$Auth

Example Queries

Try the following queries using stackql shell, or run them from a script or CI pipeline with stackql exec.

Workspace inventory

Every workspace in the account, with status, region and when it was created (aws_region is populated on AWS, location on Azure and GCP):

SELECT
  workspace_id,
  workspace_name,
  workspace_status,
  aws_region,
  location,
  deployment_name,
  datetime(creation_time/1000, 'unixepoch') AS created
FROM databricks_account.provisioning.workspaces
WHERE account_id = '<account_id>'
ORDER BY creation_time DESC;

Join workspaces to their permission assignments - who can access what:

SELECT
  w.workspace_id,
  w.workspace_name,
  w.workspace_status,
  json_extract(wa.principal, '$.display_name') AS principal,
  wa.permissions
FROM databricks_account.provisioning.workspaces w
LEFT JOIN databricks_account.iam.workspace_assignment wa
ON w.workspace_id = wa.workspace_id
WHERE account_id = '<account_id>';

Identity at a glance

Account users flattened to one row per role assignment, using a built-in view:

SELECT *
FROM databricks_account.iam.vw_account_user_roles
WHERE account_id = '<account_id>';

Find the account admins:

SELECT
  id AS user_id,
  userName AS user_name,
  displayName AS display_name
FROM databricks_account.iam.vw_account_user_roles
WHERE account_id = '<account_id>'
AND role = 'account_admin';

FinOps queries

Budget policies and budget configurations:

SELECT *
FROM databricks_account.billing.vw_budget_policies
WHERE account_id = '<account_id>';

SELECT *
FROM databricks_account.billing.vw_budgets
WHERE account_id = '<account_id>';

Download a month of billable usage to CSV:

stackql exec -o text --hideheaders -f billable_usage.csv \
  "SELECT contents FROM databricks_account.billing.billable_usage
   WHERE start_month = '2026-06' AND end_month = '2026-07'
   AND account_id = '<account_id>'"

Network and storage configuration

Audit the account's registered infrastructure - credentials, storage configurations, networks and encryption keys - using the built-in views (these are the AWS and GCP account APIs; on Azure the infrastructure is managed through Azure Resource Manager, see What differs by cloud):

SELECT * FROM databricks_account.provisioning.vw_credentials WHERE account_id = '<account_id>';
SELECT * FROM databricks_account.provisioning.vw_storage_configurations WHERE account_id = '<account_id>';
SELECT * FROM databricks_account.provisioning.vw_networks WHERE account_id = '<account_id>';
SELECT * FROM databricks_account.settings.vw_network_connectivity_configs WHERE account_id = '<account_id>';

Services

billing
catalog
disasterrecovery
iam
iamv2

networking
oauth2
provisioning
settings
settingsv2

Installation​

Authentication​

OAuth2 (Service Principal) [Default]​

Cloud selection (AWS, Azure, GCP)​

Service principal by cloud​

What differs by cloud​

Personal Access Token (Bearer)​

Example Queries​

Workspace inventory​

Identity at a glance​

FinOps queries​

Network and storage configuration​

Services​