Error: cannot create group: User not authorized - unless I login to the workspace UI

Chris Snow 0
Viewed 46

I'm creating a workspace with terraform. After the workspace resource has finished I'm then trying to create a databricks_group with this:

resource "databricks_group" "this" {
  for_each = data.azuread_group.this
  display_name = each.key
  external_id = data.azuread_group.this[each.key].object_id
  workspace_access = var.groups[each.key].workspace_access
  databricks_sql_access = var.groups[each.key].databricks_sql_access
  allow_cluster_create = var.groups[each.key].allow_cluster_create
  allow_instance_pool_create = var.groups[each.key].allow_instance_pool_create
  force = true
}

This fails with:

╷
│ Error: cannot create group: User not authorized. Using azure-cli auth: host=https://adb-5341709998635988.8.azuredatabricks.net
│ 
│   with databricks_group.this["dbadmins"],
│   on stuff.tf line 23, in resource "databricks_group" "this":
│   23: resource "databricks_group" "this" {
│

I then login to the workspace from the Azure portal until I see this screen:

enter image description here

At this point I can re-run terraform and the databricks_group gets created with no error:

Plan: 1 to add, 0 to change, 0 to destroy.
databricks_group.this["dbadmins"]: Creating...
databricks_group.this["dbadmins"]: Creation complete after 2s [id=1069087906420767]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

I'm using

databricks = {
  source = "databricks/databricks"
  version = "1.3.0"
}

The workspace and the databricks group are created in different terraform projects using terragrunt. The terragrunt config for the databricks group project has a dependency on the workspace project:

dependency "workspace" {
  config_path = "../workspace"
}

inputs = {
  databricks_resource_id = dependency.workspace.outputs.resource_id
}

Any idea why this is failing unless I login?

terraform-provider-databricks azure-databricks
1 Answers

I was missing a azure_workspace_resource_id in my provider definition:

provider "databricks" {
  host = local.databricks_workspace_host
  auth_type  = "azure-cli"
}

Adding this (as below) resolved the issue for me:

provider "databricks" {
  azure_workspace_resource_id = data.azurerm_databricks_workspace.this.id
  host = local.databricks_workspace_host
  auth_type  = "azure-cli"
}
Chris Snow0
Related