Skip to content

Commit 8fd6666

Browse files
alexottnkvuong
alexott
and
nkvuong
authored
Switch to use service principal auth instead of username/password (#142)
* Switch to use service principal auth instead of username/password Fixes #141 * Update examples/aws-databricks-flat/networks_special.tf Co-authored-by: vuong-nguyen <[email protected]> * Update examples/aws-databricks-modular-privatelink/README.md Co-authored-by: vuong-nguyen <[email protected]> * Update examples/aws-databricks-flat/modules/mws_network/versions.tf Co-authored-by: vuong-nguyen <[email protected]> * Update examples/aws-databricks-uc/README.md Co-authored-by: vuong-nguyen <[email protected]> --------- Co-authored-by: vuong-nguyen <[email protected]>
1 parent c19bb6d commit 8fd6666

File tree

22 files changed

+116
-94
lines changed

22 files changed

+116
-94
lines changed

‎examples/aws-databricks-flat/modules/mws_network/variables.tf

+6-4
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,14 @@ variable "existing_vpc_id" {
33
type = string
44
}
55

6-
variable "databricks_account_username" {
7-
type = string
6+
variable "databricks_account_client_id" {
7+
type = string
8+
description = "Application ID of account-level service principal"
89
}
910

10-
variable "databricks_account_password" {
11-
type = string
11+
variable "databricks_account_client_secret" {
12+
type = string
13+
description = "Client secret of account-level service principal"
1214
}
1315

1416
variable "databricks_account_id" {

‎examples/aws-databricks-flat/modules/mws_network/versions.tf

+6-4
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,10 @@ provider "aws" {
1313

1414
// initialize provider in "MWS" mode to provision new workspace
1515
provider "databricks" {
16-
alias = "mws"
17-
host = "https://accounts.cloud.databricks.com"
18-
username = var.databricks_account_username
19-
password = var.databricks_account_password
16+
alias = "mws"
17+
host = "https://accounts.cloud.databricks.com"
18+
client_id = var.databricks_account_client_id
19+
client_secret = var.databricks_account_client_secret
20+
account_id = var.databricks_account_id
21+
auth_type = "oauth-m2m"
2022
}

‎examples/aws-databricks-flat/networks_special.tf

+10-10
Original file line numberDiff line numberDiff line change
@@ -74,14 +74,14 @@ resource "aws_security_group" "test_sg" {
7474
}
7575

7676
module "my_mws_network" {
77-
source = "./modules/mws_network"
78-
existing_vpc_id = aws_vpc.mainvpc.id
79-
databricks_account_username = var.databricks_account_username
80-
databricks_account_password = var.databricks_account_password
81-
databricks_account_id = var.databricks_account_id
82-
region = var.region
83-
aws_nat_gateway_id = aws_nat_gateway.nat_gateways[0].id
84-
private_subnet_pair = var.private_subnet_pair
85-
security_group_ids = [aws_security_group.test_sg.id]
86-
prefix = local.prefix
77+
source = "./modules/mws_network"
78+
existing_vpc_id = aws_vpc.mainvpc.id
79+
databricks_account_client_id = var.databricks_account_client_id
80+
databricks_account_client_secret = var.databricks_account_client_secret
81+
databricks_account_id = var.databricks_account_id
82+
region = var.region
83+
aws_nat_gateway_id = aws_nat_gateway.nat_gateways[0].id
84+
private_subnet_pair = var.private_subnet_pair
85+
security_group_ids = [aws_security_group.test_sg.id]
86+
prefix = local.prefix
8787
}

‎examples/aws-databricks-flat/providers.tf

+5-4
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,11 @@ provider "aws" {
1313

1414
// initialize provider in "MWS" mode to provision new workspace
1515
provider "databricks" {
16-
alias = "mws"
17-
host = "https://accounts.cloud.databricks.com"
18-
username = var.databricks_account_username
19-
password = var.databricks_account_password
16+
alias = "mws"
17+
host = "https://accounts.cloud.databricks.com"
18+
account_id = var.databricks_account_id
19+
client_id = var.databricks_account_client_id
20+
client_secret = var.databricks_account_client_secret
2021
}
2122

2223
// initialize provider in normal mode

‎examples/aws-databricks-flat/variables.tf

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
1-
variable "databricks_account_username" {
2-
type = string
1+
variable "databricks_account_client_id" {
2+
type = string
3+
description = "Application ID of account-level service principal"
34
}
45

5-
variable "databricks_account_password" {
6-
type = string
6+
variable "databricks_account_client_secret" {
7+
type = string
8+
description = "Client secret of account-level service principal"
79
}
810

911
variable "databricks_account_id" {

‎examples/aws-databricks-modular-privatelink/README.md

+6-6
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,9 @@ This modular design also allows customer to deploy, manage and delete `individua
5454
> Step 1: Clone this repo to local, set environment variables for `aws` and `databricks` providers authentication:
5555
5656
```bash
57-
export TF_VAR_databricks_account_username=your_username
58-
export TF_VAR_databricks_account_password=your_password
59-
export TF_VAR_databricks_account_id=your_databricks_E2_account_id
57+
export TF_VAR_databricks_account_client_id=your_account_level_spn_application_id
58+
export TF_VAR_databricks_account_client_secret=your_account_level_spn_secret
59+
export TF_VAR_databricks_account_id=your_databricks_account_id
6060

6161
export AWS_ACCESS_KEY_ID=your_aws_role_access_key_id
6262
export AWS_SECRET_ACCESS_KEY=your_aws_role_secret_access_key
@@ -260,8 +260,8 @@ By default, the instance profile you created from the above steps is only access
260260
| ----------------------------------------------------------------------------------------------------------------------- | ----------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------: |
261261
| <a name="input_cmk_admin"></a> [cmk\_admin](#input\_cmk\_admin) | cmk | `string` | `"arn:aws:iam::026655378770:user/hao"` | no |
262262
| <a name="input_databricks_account_id"></a> [databricks\_account\_id](#input\_databricks\_account\_id) | n/a | `string` | n/a | yes |
263-
| <a name="input_databricks_account_password"></a> [databricks\_account\_password](#input\_databricks\_account\_password) | n/a | `string` | n/a | yes |
264-
| <a name="input_databricks_account_username"></a> [databricks\_account\_username](#input\_databricks\_account\_username) | n/a | `string` | n/a | yes |
263+
| <a name="input_databricks_account_client_secret"></a> [databricks\_account\_password](#input\_databricks\_account\_client\_secret) | n/a | `string` | n/a | yes |
264+
| <a name="input_databricks_account_client_id"></a> [databricks\_account\_client_id](#input\_databricks\_account\_client\_id) | n/a | `string` | n/a | yes |
265265
| <a name="input_privatelink_subnets_cidr"></a> [privatelink\_subnets\_cidr](#input\_privatelink\_subnets\_cidr) | n/a | `list(string)` | <pre>[<br> "10.109.4.0/23"<br>]</pre> | no |
266266
| <a name="input_public_subnets_cidr"></a> [public\_subnets\_cidr](#input\_public\_subnets\_cidr) | n/a | `list(string)` | <pre>[<br> "10.109.2.0/23"<br>]</pre> | no |
267267
| <a name="input_region"></a> [region](#input\_region) | n/a | `string` | `"ap-southeast-1"` | no |
@@ -278,4 +278,4 @@ By default, the instance profile you created from the above steps is only access
278278
| -------------------------------------------------------------------------------------- | ----------- |
279279
| <a name="output_arn"></a> [arn](#output\_arn) | n/a |
280280
| <a name="output_databricks_hosts"></a> [databricks\_hosts](#output\_databricks\_hosts) | n/a |
281-
<!-- END_TF_DOCS -->
281+
<!-- END_TF_DOCS -->

‎examples/aws-databricks-modular-privatelink/providers.tf

+6-6
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,10 @@ provider "aws" {
2525

2626
// initialize provider in "MWS" mode to provision new workspace
2727
provider "databricks" {
28-
alias = "mws"
29-
host = "https://accounts.cloud.databricks.com"
30-
account_id = var.databricks_account_id
31-
username = var.databricks_account_username
32-
password = var.databricks_account_password
33-
auth_type = "basic"
28+
alias = "mws"
29+
host = "https://accounts.cloud.databricks.com"
30+
account_id = var.databricks_account_id
31+
client_id = var.databricks_account_client_id
32+
client_secret = var.databricks_account_client_secret
33+
auth_type = "oauth-m2m"
3434
}

‎examples/aws-databricks-modular-privatelink/variables.tf

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
1-
variable "databricks_account_username" {
2-
type = string
1+
variable "databricks_account_client_id" {
2+
type = string
3+
description = "Application ID of account-level service principal"
34
}
45

5-
variable "databricks_account_password" {
6-
type = string
6+
variable "databricks_account_client_secret" {
7+
type = string
8+
description = "Client secret of account-level service principal"
79
}
810

911
variable "databricks_account_id" {

‎examples/aws-databricks-uc-bootstrap/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@ AWS Databricks has 2 levels of resources:
1616
1. Account Level (unity metastore, account level users/groups, etc)
1717
2. Workspace Level (workspace level users/groups, workspace objects like clusters)
1818

19-
The 2 levels of resources use different providers configs and have different authentication method, username/password is the only method for account level provider authentication.
19+
The 2 levels of resources use different providers configs and have different authentication method, client ID/client secret is the only method for account level provider authentication.
2020

2121
For workspace level provider you can create `n` databricks providers for `n` existing workspaces, each provider to be authenticate via PAT token.
2222

23-
We propose 2-stage process to get onboarded to UC. Starting at the point where you only have `account owner`, and this identity will also be the first `account admin`. Account admins can add/remove other `account admin`.
23+
We propose 2-stage process to get onboarded to UC. Starting at the point where you only have `account owner`, and this identity will also be the first `account admin`. Account admins can add/remove other account admins, including service principals.
2424

2525
We recommend using `account admin` identities to deploy unity catalog related resources.
2626

‎examples/aws-databricks-uc-bootstrap/main.tf

+6-6
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,12 @@ terraform {
77
}
88

99
provider "databricks" {
10-
alias = "mws"
11-
host = "https://accounts.cloud.databricks.com"
12-
account_id = var.databricks_account_id // like a shared account? HA from multiple email accounts
13-
username = var.databricks_account_username
14-
password = var.databricks_account_password
15-
auth_type = "basic"
10+
alias = "mws"
11+
host = "https://accounts.cloud.databricks.com"
12+
account_id = var.databricks_account_id // like a shared account? HA from multiple email accounts
13+
client_id = var.databricks_account_client_id
14+
client_secret = var.databricks_account_client_secret
15+
auth_type = "oauth-m2m"
1616
}
1717

1818
// create users and groups at account level (not workspace user/group)

‎examples/aws-databricks-uc-bootstrap/variables.tf

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
1-
variable "databricks_account_username" {
2-
type = string
1+
variable "databricks_account_client_id" {
2+
type = string
3+
description = "Application ID of account-level service principal"
34
}
45

5-
variable "databricks_account_password" {
6-
type = string
6+
variable "databricks_account_client_secret" {
7+
type = string
8+
description = "Client secret of account-level service principal"
79
}
810

911
variable "databricks_account_id" {

‎examples/aws-databricks-uc/README.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@ When running tf configs for UC resources, due to sometimes requires a few minute
1818
1919

2020
```bash
21-
export TF_VAR_databricks_account_username=your_username
22-
export TF_VAR_databricks_account_password=your_password
23-
export TF_VAR_databricks_account_id=your_databricks_E2_account_id
21+
export TF_VAR_databricks_account_client_id=your_account_level_spn_application_id
22+
export TF_VAR_databricks_account_client_secret=your_account_level_spn_secret
23+
export TF_VAR_databricks_account_id=your_databricks_account_id
2424

2525
export AWS_ACCESS_KEY_ID=your_aws_role_access_key_id
2626
export AWS_SECRET_ACCESS_KEY=your_aws_role_secret_access_key
2727
```
2828

29-
> Step 2: Run `terraform init` and `terraform apply` to deploy the resources. This will deploy both AWS resources that Unity Catalog requires and Databricks Account Level resources.
29+
> Step 2: Run `terraform init` and `terraform apply` to deploy the resources. This will deploy both AWS resources that Unity Catalog requires and Databricks Account Level resources.

‎examples/aws-databricks-uc/providers.tf

+6-6
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ provider "aws" {
1616

1717
// initialize provider in "MWS" mode to provision new workspace
1818
provider "databricks" {
19-
alias = "mws"
20-
host = "https://accounts.cloud.databricks.com"
21-
account_id = var.databricks_account_id // like a shared account? HA from multiple email accounts
22-
username = var.databricks_account_username
23-
password = var.databricks_account_password
24-
auth_type = "basic"
19+
alias = "mws"
20+
host = "https://accounts.cloud.databricks.com"
21+
account_id = var.databricks_account_id // like a shared account? HA from multiple email accounts
22+
client_id = var.databricks_account_client_id
23+
client_secret = var.databricks_account_client_secret
24+
auth_type = "oauth-m2m"
2525
}
2626

2727
provider "databricks" {

‎examples/aws-databricks-uc/variables.tf

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
1-
variable "databricks_account_username" {
2-
type = string
1+
variable "databricks_account_client_id" {
2+
type = string
3+
description = "Application ID of account-level service principal"
34
}
45

5-
variable "databricks_account_password" {
6-
type = string
6+
variable "databricks_account_client_secret" {
7+
type = string
8+
description = "Client secret of account-level service principal"
79
}
810

911
variable "databricks_account_id" {

‎examples/aws-exfiltration-protection/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ This template provides an example deployment of AWS Databricks E2 workspace with
2020
2. Add a `variables.tf` with the same content in [variables.tf](variables.tf)
2121
3. Add a `terraform.tfvars` file and provide values to each defined variable
2222
4. Configure the following environment variables:
23-
* TF_VAR_databricks_account_username, set to the value of your Databricks account-level admin username.
24-
* TF_VAR_databricks_account_password, set to the value of the password for your Databricks account-level admin user.
23+
* TF_VAR_databricks_account_client_id, set to the value of application ID of your Databricks account-level service principal with admin permission.
24+
* TF_VAR_databricks_account_client_secret, set to the value of the client secret for your Databricks account-level service principal.
2525
* TF_VAR_databricks_account_id, set to the value of the ID of your Databricks account. You can find this value in the corner of your Databricks account console.
2626
5. (Optional) Configure your [remote backend](https://developer.hashicorp.com/terraform/language/settings/backends/s3)
2727
6. Run `terraform init` to initialize terraform and get provider ready.

‎examples/aws-exfiltration-protection/providers.tf

+6-6
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ provider "aws" {
44

55
// initialize provider in "MWS" mode to provision new workspace
66
provider "databricks" {
7-
alias = "mws"
8-
host = "https://accounts.cloud.databricks.com"
9-
account_id = var.databricks_account_id
10-
username = var.databricks_account_username
11-
password = var.databricks_account_password
12-
}
7+
alias = "mws"
8+
host = "https://accounts.cloud.databricks.com"
9+
account_id = var.databricks_account_id
10+
client_id = var.databricks_account_client_id
11+
client_secret = var.databricks_account_client_secret
12+
}

‎examples/aws-exfiltration-protection/variables.tf

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
1-
variable "databricks_account_username" {
2-
type = string
1+
variable "databricks_account_client_id" {
2+
type = string
3+
description = "Application ID of account-level service principal"
34
}
45

5-
variable "databricks_account_password" {
6-
type = string
6+
variable "databricks_account_client_secret" {
7+
type = string
8+
description = "Client secret of account-level service principal"
79
}
810

911
variable "databricks_account_id" {

0 commit comments

Comments
 (0)