AccessControlRuleSet

laktory.models.resources.databricks.AccessControlRuleSet

Bases: AccessControlRuleSetBase

Databricks Access Control Rule Set

Examples:

import io

from laktory import models

ruleset_yaml = '''
name: accounts/acct-id/groups/group-id
grant_rules:
- role: roles/servicePrincipal.user
  principals:
  - users/user1@okube.ai
  - serviceAccounts/neptune@acct-id.iam.gserviceaccount.com
'''
ruleset = models.resources.databricks.AccessControlRuleSet.model_validate_yaml(
    io.StringIO(ruleset_yaml)
)

References

• Databricks Access Control Rule Set

BASE	DESCRIPTION
api	Specifies whether to use account-level or workspace-level API. Valid values are account and workspace. When not set, the API level is inferred from the provider host TYPE: str | None | VariableType DEFAULT: None
grant_rules	The access control rules to be granted by this rule set, consisting of a set of principals and roles to be granted to them TYPE: list[AccessControlRuleSetGrantRules] | None | VariableType DEFAULT: None
name	Unique identifier of a rule set. The name determines the resource to which the rule set applies. Changing the name recreates the resource!. Currently, only default rule sets are supported. The following rule set formats are supported: TYPE: str | VariableType

---

laktory.models.resources.databricks.accesscontrolruleset.AccessControlRuleSetGrantRules

Bases: BaseModel

PARAMETER	DESCRIPTION
principals	a list of principals who are granted a role. The following format is supported: * users/{username} (also exposed as acl_principal_id attribute of databricks_user resource). * groups/{groupname} (also exposed as acl_principal_id attribute of databricks_group resource). * servicePrincipals/{applicationId} (also exposed as acl_principal_id attribute of databricks_service_principal resource) TYPE: list[str] | None | VariableType DEFAULT: None
role	Role to be granted. The supported roles are listed below. For more information about these roles, refer to service principal roles, group roles, marketplace roles or budget policy permissions, depending on the name defined: * accounts/{account_id}/ruleSets/default TYPE: str | VariableType