workspace_assignments

Creates, updates, deletes, gets or lists a workspace_assignments resource.

Overview

Name	workspace_assignments
Type	Resource
Id	databricks_account.iamv2.workspace_assignments

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
account_id	string	The account ID parent of the workspace where the principal is assigned
principal_id	integer	The internal ID of the principal (user/sp/group) in Databricks.
workspace_id	integer	The workspace ID where the principal is assigned.
effective_entitlements	array	Every entitlement the principal holds in this workspace, whether granted directly or through group membership. Get responses populate this field. List responses leave it empty.
entitlements	array	Entitlements granted directly to the principal on this workspace. This is the only client-settable field. Create and update manage exactly this set, including entitlements the principal also holds through a group. List responses leave this field empty. Get a single principal to read its entitlements.
principal_type	string	The type of the principal (user/service principal/group) that is assigned. (GROUP, SERVICE_PRINCIPAL, USER)

list

Name	Datatype	Description
account_id	string	The account ID parent of the workspace where the principal is assigned
principal_id	integer	The internal ID of the principal (user/sp/group) in Databricks.
workspace_id	integer	The workspace ID where the principal is assigned.
effective_entitlements	array	Every entitlement the principal holds in this workspace, whether granted directly or through group membership. Get responses populate this field. List responses leave it empty.
entitlements	array	Entitlements granted directly to the principal on this workspace. This is the only client-settable field. Create and update manage exactly this set, including entitlements the principal also holds through a group. List responses leave this field empty. Get a single principal to read its entitlements.
principal_type	string	The type of the principal (user/service principal/group) that is assigned. (GROUP, SERVICE_PRINCIPAL, USER)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	account_id, workspace_id, principal_id, account_host		Returns the assignment for a principal in a workspace.
list	select	account_id, workspace_id, account_host	page_size, page_token	Lists workspace assignments for a workspace. The response omits the per-principal entitlement fields
create	insert	account_id, workspace_id, account_host, principal_id		Creates a workspace assignment for a principal. Entitlements are granted one at a time rather than
update	update	account_id, workspace_id, principal_id, update_mask, account_host, principal_id		Updates the entitlements of a directly assigned principal in a workspace. Changes are applied one at a
delete	delete	account_id, workspace_id, principal_id, account_host		Deletes a workspace assignment for a principal, revoking all of its entitlements. Entitlements are

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
account_host	string	The Databricks account console host. Selected by DATABRICKS_CLOUD (aws, azure or gcp; default aws), or set explicitly with DATABRICKS_ACCOUNT_HOST (bare host, no scheme). (default: accounts.cloud.databricks.com, x-stackQL-envVar: DATABRICKS_ACCOUNT_HOST, x-stackQL-envVarSelector: {"envVar":"DATABRICKS_CLOUD","default":"aws","values":{"aws":"accounts.cloud.databricks.com","azure":"accounts.azuredatabricks.net","gcp":"accounts.gcp.databricks.com"}})
account_id	string
principal_id	integer	Required. ID of the principal in Databricks to delete workspace assignment for.
update_mask	object	Required. The list of fields to update.
workspace_id	integer	The workspace ID where the principal has access.
page_size	integer	The maximum number of workspace assignments to return. The service may return fewer than this value. If not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.
page_token	string	A page token, received from a previous ListWorkspaceAssignments call. Provide this to retrieve the subsequent page.

SELECT examples

get

Returns the assignment for a principal in a workspace.

SELECT
account_id,
principal_id,
workspace_id,
effective_entitlements,
entitlements,
principal_type
FROM databricks_account.iamv2.workspace_assignments
WHERE account_id = '{{ account_id }}' -- required
AND workspace_id = '{{ workspace_id }}' -- required
AND principal_id = '{{ principal_id }}' -- required
AND account_host = '{{ account_host }}' -- required
;

list

Lists workspace assignments for a workspace. The response omits the per-principal entitlement fields

SELECT
account_id,
principal_id,
workspace_id,
effective_entitlements,
entitlements,
principal_type
FROM databricks_account.iamv2.workspace_assignments
WHERE account_id = '{{ account_id }}' -- required
AND workspace_id = '{{ workspace_id }}' -- required
AND account_host = '{{ account_host }}' -- required
AND page_size = '{{ page_size }}'
AND page_token = '{{ page_token }}'
;

INSERT examples

create

Creates a workspace assignment for a principal. Entitlements are granted one at a time rather than

INSERT INTO databricks_account.iamv2.workspace_assignments (
principal_id,
account_id,
effective_entitlements,
entitlements,
principal_type,
workspace_id,
account_id,
workspace_id,
account_host
)
SELECT 
{{ principal_id }} /* required */,
'{{ account_id }}',
'{{ effective_entitlements }}',
'{{ entitlements }}',
'{{ principal_type }}',
{{ workspace_id }},
'{{ account_id }}',
{{ workspace_id }},
'{{ account_host }}'
RETURNING
account_id,
principal_id,
workspace_id,
effective_entitlements,
entitlements,
principal_type
;

Manifest

# Description fields are for documentation purposes
- name: workspace_assignments
props:
  - name: account_id
    value: "{{ account_id }}"
    description: Required parameter for the workspace_assignments resource.
  - name: workspace_id
    value: {{ workspace_id }}
    description: Required parameter for the workspace_assignments resource.
  - name: account_host
    value: "{{ account_host }}"
    description: Required parameter for the workspace_assignments resource.
  - name: principal_id
    value: {{ principal_id }}
    description: |
      The internal ID of the principal (user/sp/group) in Databricks.
  - name: account_id
    value: "{{ account_id }}"
    description: |
      The account ID parent of the workspace where the principal is assigned
  - name: effective_entitlements
    value:
      - "{{ effective_entitlements }}"
    description: |
      Every entitlement the principal holds in this workspace, whether granted directly or through group membership. Get responses populate this field. List responses leave it empty.
  - name: entitlements
    value:
      - "{{ entitlements }}"
    description: |
      Entitlements granted directly to the principal on this workspace. This is the only client-settable field. Create and update manage exactly this set, including entitlements the principal also holds through a group. List responses leave this field empty. Get a single principal to read its entitlements.
  - name: principal_type
    value: "{{ principal_type }}"
    description: |
      The type of the principal (user/service principal/group) that is assigned.
  - name: workspace_id
    value: {{ workspace_id }}
    description: |
      The workspace ID where the principal is assigned.

UPDATE examples

update

Updates the entitlements of a directly assigned principal in a workspace. Changes are applied one at a

UPDATE databricks_account.iamv2.workspace_assignments
SET 
principal_id = {{ principal_id }},
account_id = '{{ account_id }}',
effective_entitlements = '{{ effective_entitlements }}',
entitlements = '{{ entitlements }}',
principal_type = '{{ principal_type }}',
workspace_id = {{ workspace_id }}
WHERE 
account_id = '{{ account_id }}' --required
AND workspace_id = '{{ workspace_id }}' --required
AND principal_id = '{{ principal_id }}' --required
AND update_mask = '{{ update_mask }}' --required
AND account_host = '{{ account_host }}' --required
AND principal_id = '{{ principal_id }}' --required
RETURNING
account_id,
principal_id,
workspace_id,
effective_entitlements,
entitlements,
principal_type;

DELETE examples

delete

Deletes a workspace assignment for a principal, revoking all of its entitlements. Entitlements are

DELETE FROM databricks_account.iamv2.workspace_assignments
WHERE account_id = '{{ account_id }}' --required
AND workspace_id = '{{ workspace_id }}' --required
AND principal_id = '{{ principal_id }}' --required
AND account_host = '{{ account_host }}' --required
;