databricks_account
Account-level features, identity and provisioning for Databricks.
For Databricks workspace operations use the databricks_workspace provider.
total services: 9 total resources: 88
See also:
[SHOW] [DESCRIBE] [REGISTRY]
Installation
REGISTRY PULL databricks_account;
Authentication
To use the databricks_account provider, you can authenticate using one of the following methods:
OAuth2 (Service Principal) [Default]
Set the following environment variables:
DATABRICKS_ACCOUNT_ID- a uuid representing your Databricks account id, you can get this from the Databricks UI (see Locate your account id)DATABRICKS_CLIENT_ID- obtained after creating a service principal through the Databricks UI (see Authenticate access to Databricks with a service principal using OAuth)DATABRICKS_CLIENT_SECRET- obtained after creating a service principal secret through the Databricks UI, using the "Generate Secret" function (see Authenticate access to Databricks with a service principal using OAuth)
These are the same variables that Terraform, the Databricks SDKs, and CLI use.
Personal Access Token (Bearer)
Alternatively, set DATABRICKS_TOKEN to a Databricks personal access token (see Databricks personal access tokens), then supply the auth config when starting the shell:
export DATABRICKS_TOKEN=xxx
# Linux/Mac
AUTH='{ "databricks_account": { "type": "bearer", "credentialsenvvar": "DATABRICKS_TOKEN" }}'
./stackql shell --auth="${AUTH}"
# PowerShell
$Auth = "{ 'databricks_account': { 'type': 'bearer', 'credentialsenvvar': 'DATABRICKS_TOKEN' }}"
stackql.exe shell --auth=$Auth
Workspace inventory
Every workspace in the account, with status, region and when it was created:
SELECT
workspace_id,
workspace_name,
workspace_status,
aws_region,
deployment_name,
datetime(creation_time/1000, 'unixepoch') AS created
FROM databricks_account.provisioning.workspaces
WHERE account_id = '<account_id>'
ORDER BY creation_time DESC;
Join workspaces to their permission assignments - who can access what:
SELECT
w.workspace_id,
w.workspace_name,
w.workspace_status,
json_extract(wa.principal, '$.display_name') AS principal,
wa.permissions
FROM databricks_account.provisioning.workspaces w
LEFT JOIN databricks_account.iam.workspace_assignment wa
ON w.workspace_id = wa.workspace_id
WHERE account_id = '<account_id>';
Identity at a glance
Account users flattened to one row per role assignment, using a built-in view:
SELECT *
FROM databricks_account.iam.vw_account_user_roles
WHERE account_id = '<account_id>';
Find the account admins:
SELECT
id AS user_id,
userName AS user_name,
displayName AS display_name
FROM databricks_account.iam.vw_account_user_roles
WHERE account_id = '<account_id>'
AND role = 'account_admin';
FinOps queries
Budget policies and budget configurations:
SELECT *
FROM databricks_account.billing.vw_budget_policies
WHERE account_id = '<account_id>';
SELECT *
FROM databricks_account.billing.vw_budgets
WHERE account_id = '<account_id>';
Download a month of billable usage to CSV:
stackql exec -o text --hideheaders -f billable_usage.csv \
"SELECT contents FROM databricks_account.billing.billable_usage
WHERE start_month = '2026-06' AND end_month = '2026-07'
AND account_id = '<account_id>'"
Network and storage configuration
Audit the account's registered infrastructure - credentials, storage configurations, networks and encryption keys - using the built-in views:
SELECT * FROM databricks_account.provisioning.vw_credentials WHERE account_id = '<account_id>';
SELECT * FROM databricks_account.provisioning.vw_storage_configurations WHERE account_id = '<account_id>';
SELECT * FROM databricks_account.provisioning.vw_networks WHERE account_id = '<account_id>';
SELECT * FROM databricks_account.settings.vw_network_connectivity_configs WHERE account_id = '<account_id>';