service_principal_federation_policy

Creates, updates, deletes, gets or lists a service_principal_federation_policy resource.

Overview

Name	service_principal_federation_policy
Type	Resource
Id	databricks_account.oauth2.service_principal_federation_policy

Fields

The following fields are returned by SELECT queries:

service_principal_federation_policy_get

Name	Datatype	Description
name	string	Resource name for the federation policy. Example values include ``accounts/<account-id>/federationPolicies/my-federation-policy`` for Account Federation Policies, and ``accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy`` for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.
policy_id	string	The ID of the federation policy. Output only.
service_principal_id	integer	The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.
create_time	string
description	string	Description of the federation policy.
▶oidc_policy	object	audit_mode INCLUDE is required on both this message field and its leaf fields so the OIDC policy configuration is captured in create/update audit logs (see go/auditlogs).
uid	string	Unique, immutable id of the federation policy.
update_time	string	Last update time of the federation policy.

service_principal_federation_policy_list

Name	Datatype	Description
name	string	Resource name for the federation policy. Example values include ``accounts/<account-id>/federationPolicies/my-federation-policy`` for Account Federation Policies, and ``accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy`` for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.
policy_id	string	The ID of the federation policy. Output only.
service_principal_id	integer	The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.
create_time	string
description	string	Description of the federation policy.
▶oidc_policy	object	audit_mode INCLUDE is required on both this message field and its leaf fields so the OIDC policy configuration is captured in create/update audit logs (see go/auditlogs).
uid	string	Unique, immutable id of the federation policy.
update_time	string	Last update time of the federation policy.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
service_principal_federation_policy_get	select	account_id, service_principal_id, policy_id, account_host		Get account federation policy.
service_principal_federation_policy_list	select	account_id, service_principal_id, account_host	page_size, page_token	List account federation policies.
service_principal_federation_policy_create	insert	account_id, service_principal_id, account_host	policy_id	Create account federation policy.
service_principal_federation_policy_update	update	account_id, service_principal_id, policy_id, account_host	update_mask	Update account federation policy.
service_principal_federation_policy_delete	delete	account_id, service_principal_id, policy_id, account_host		Delete account federation policy.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
account_host	string	The Databricks account console host. Selected by DATABRICKS_CLOUD (aws, azure or gcp; default aws), or set explicitly with DATABRICKS_ACCOUNT_HOST (bare host, no scheme). (default: accounts.cloud.databricks.com, x-stackQL-envVar: DATABRICKS_ACCOUNT_HOST, x-stackQL-envVarSelector: {"envVar":"DATABRICKS_CLOUD","default":"aws","values":{"aws":"accounts.cloud.databricks.com","azure":"accounts.azuredatabricks.net","gcp":"accounts.gcp.databricks.com"}})
account_id	string
policy_id	string	The identifier for the federation policy.
service_principal_id	integer	The service principal id for the federation policy.
page_size	integer
page_token	string
policy_id	string	The identifier for the federation policy. The identifier must contain only lowercase alphanumeric characters, numbers, hyphens, and slashes. If unspecified, the id will be assigned by Databricks.
update_mask	string	The field mask specifies which fields of the policy to update. To specify multiple fields in the field mask, use comma as the separator (no space). The special value '*' indicates that all fields should be updated (full replacement). If unspecified, all fields that are set in the policy provided in the update request will overwrite the corresponding fields in the existing policy. Example value: 'description,oidc_policy.audiences'.

SELECT examples

service_principal_federation_policy_get

Get account federation policy.

SELECT
name,
policy_id,
service_principal_id,
create_time,
description,
oidc_policy,
uid,
update_time
FROM databricks_account.oauth2.service_principal_federation_policy
WHERE account_id = '{{ account_id }}' -- required
AND service_principal_id = '{{ service_principal_id }}' -- required
AND policy_id = '{{ policy_id }}' -- required
AND account_host = '{{ account_host }}' -- required
;

service_principal_federation_policy_list

List account federation policies.

SELECT
name,
policy_id,
service_principal_id,
create_time,
description,
oidc_policy,
uid,
update_time
FROM databricks_account.oauth2.service_principal_federation_policy
WHERE account_id = '{{ account_id }}' -- required
AND service_principal_id = '{{ service_principal_id }}' -- required
AND account_host = '{{ account_host }}' -- required
AND page_size = '{{ page_size }}'
AND page_token = '{{ page_token }}'
;

INSERT examples

service_principal_federation_policy_create

Create account federation policy.

INSERT INTO databricks_account.oauth2.service_principal_federation_policy (
create_time,
description,
name,
oidc_policy,
policy_id,
service_principal_id,
uid,
update_time,
account_id,
service_principal_id,
account_host,
policy_id
)
SELECT 
'{{ create_time }}',
'{{ description }}',
'{{ name }}',
'{{ oidc_policy }}',
'{{ policy_id }}',
{{ service_principal_id }},
'{{ uid }}',
'{{ update_time }}',
'{{ account_id }}',
{{ service_principal_id }},
'{{ account_host }}',
'{{ policy_id }}'
RETURNING
name,
policy_id,
service_principal_id,
create_time,
description,
oidc_policy,
uid,
update_time
;

Manifest

# Description fields are for documentation purposes
- name: service_principal_federation_policy
props:
  - name: account_id
    value: "{{ account_id }}"
    description: Required parameter for the service_principal_federation_policy resource.
  - name: service_principal_id
    value: {{ service_principal_id }}
    description: Required parameter for the service_principal_federation_policy resource.
  - name: account_host
    value: "{{ account_host }}"
    description: Required parameter for the service_principal_federation_policy resource.
  - name: create_time
    value: "{{ create_time }}"
  - name: description
    value: "{{ description }}"
    description: |
      Description of the federation policy.
  - name: name
    value: "{{ name }}"
    description: |
      Resource name for the federation policy. Example values include ``accounts/<account-id>/federationPolicies/my-federation-policy`` for Account Federation Policies, and ``accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy`` for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.
  - name: oidc_policy
    description: |
      audit_mode INCLUDE is required on both this message field and its leaf fields so the OIDC policy configuration is captured in create/update audit logs (see go/auditlogs).
    value:
      audiences:
        - "{{ audiences }}"
      issuer: "{{ issuer }}"
      jwks_json: "{{ jwks_json }}"
      jwks_uri: "{{ jwks_uri }}"
      subject: "{{ subject }}"
      subject_claim: "{{ subject_claim }}"
  - name: policy_id
    value: "{{ policy_id }}"
    description: |
      The ID of the federation policy. Output only.
  - name: service_principal_id
    value: {{ service_principal_id }}
    description: |
      The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.
  - name: uid
    value: "{{ uid }}"
    description: |
      Unique, immutable id of the federation policy.
  - name: update_time
    value: "{{ update_time }}"
    description: |
      Last update time of the federation policy.
  - name: policy_id
    value: "{{ policy_id }}"
    description: The identifier for the federation policy. The identifier must contain only lowercase alphanumeric characters, numbers, hyphens, and slashes. If unspecified, the id will be assigned by Databricks.
    description: The identifier for the federation policy. The identifier must contain only lowercase alphanumeric characters, numbers, hyphens, and slashes. If unspecified, the id will be assigned by Databricks.

UPDATE examples

service_principal_federation_policy_update

Update account federation policy.

UPDATE databricks_account.oauth2.service_principal_federation_policy
SET 
create_time = '{{ create_time }}',
description = '{{ description }}',
name = '{{ name }}',
oidc_policy = '{{ oidc_policy }}',
policy_id = '{{ policy_id }}',
service_principal_id = {{ service_principal_id }},
uid = '{{ uid }}',
update_time = '{{ update_time }}'
WHERE 
account_id = '{{ account_id }}' --required
AND service_principal_id = '{{ service_principal_id }}' --required
AND policy_id = '{{ policy_id }}' --required
AND account_host = '{{ account_host }}' --required
AND update_mask = '{{ update_mask}}'
RETURNING
name,
policy_id,
service_principal_id,
create_time,
description,
oidc_policy,
uid,
update_time;

DELETE examples

service_principal_federation_policy_delete

Delete account federation policy.

DELETE FROM databricks_account.oauth2.service_principal_federation_policy
WHERE account_id = '{{ account_id }}' --required
AND service_principal_id = '{{ service_principal_id }}' --required
AND policy_id = '{{ policy_id }}' --required
AND account_host = '{{ account_host }}' --required
;