PolicyInfo

laktory.models.resources.databricks.PolicyInfo

Bases: PolicyInfoBase

Databricks attribute-based access control (ABAC) policy

Row filter, column mask, grant or deny policy defined on a catalog, schema or table and applied to the securables it contains, based on governed tags and the user identity. Policies can also be declared directly on Catalog, Schema and Table with their policies field.

A policy referencing a governed tag created in the same deployment may fail with Unknown tag policy key while the new TagPolicy propagates; deploying again resolves it.

Examples:

import io

from laktory import models

policy_yaml = '''
name: mask_pii
on_securable_type: SCHEMA
on_securable_fullname: dev.finance
policy_type: POLICY_TYPE_COLUMN_MASK
for_securable_type: TABLE
to_principals:
- account users
except_principals:
- role-finance-admins
match_columns:
- condition: hasTag('pii')
  alias: pii_col
column_mask:
  function_name: dev.finance.mask_string
  on_column: pii_col
'''
policy = models.resources.databricks.PolicyInfo.model_validate_yaml(
    io.StringIO(policy_yaml)
)

References

• Databricks ABAC
• Terraform databricks_policy_info

BASE	DESCRIPTION
column_mask	Options for column mask policies. Valid only if policy_type is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole TYPE: PolicyInfoColumnMask | None | VariableType DEFAULT: None
comment	Optional description of the policy TYPE: str | None | VariableType DEFAULT: None
deny	Options for deny policies. Valid only if policy_type is POLICY_TYPE_DENY. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole TYPE: PolicyInfoDeny | None | VariableType DEFAULT: None
except_principals	Optional list of user or group names that should be excluded from the policy TYPE: list[str] | None | VariableType DEFAULT: None
for_securable_type	Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: AGENT_SERVICE, CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, SKILL, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME TYPE: str | VariableType
grant	Options for grant policies. Valid only if policy_type is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole TYPE: PolicyInfoGrant | None | VariableType DEFAULT: None
match_columns	Optional list of condition expressions used to match table columns. Only valid when for_securable_type is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions TYPE: list[PolicyInfoMatchColumns] | None | VariableType DEFAULT: None
name	Name of the policy TYPE: str | VariableType
on_securable_fullname	Full name of the securable on which the policy is defined. Set automatically when declared in the policies of a catalog, schema or table. TYPE: str | None | VariableType DEFAULT: None
on_securable_type	Type of the securable on which the policy is defined. Set automatically when declared in the policies of a catalog, schema or table. TYPE: Literal['CATALOG', 'SCHEMA', 'TABLE'] | None | VariableType DEFAULT: None
policy_type	Type of the policy TYPE: Literal['POLICY_TYPE_COLUMN_MASK', 'POLICY_TYPE_DENY', 'POLICY_TYPE_GRANT', 'POLICY_TYPE_ROW_FILTER'] | VariableType
provider_config	Configure the provider for management through account provider TYPE: PolicyInfoProviderConfig | None | VariableType DEFAULT: None
row_filter	Options for row filter policies. Valid only if policy_type is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole TYPE: PolicyInfoRowFilter | None | VariableType DEFAULT: None
to_principals	List of user or group names that the policy applies to. Required on create and optional on update TYPE: list[str] | VariableType
when_condition	Optional condition when the policy should take effect TYPE: str | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoColumnMask

Bases: BaseModel

PARAMETER	DESCRIPTION
function_name	The fully qualified name of the row filter function. The function is called on each row of the target table. It should return a boolean value indicating whether the row should be visible to the user. Required on create and update TYPE: str | VariableType
on_column	The alias of the column to be masked. The alias must refer to one of matched columns. The values of the column is passed to the column mask function as the first argument. Required on create and update TYPE: str | VariableType
using	Optional list of column aliases or constant literals to be passed as arguments to the row filter function. The type of each column should match the positional argument of the row filter function TYPE: list[PolicyInfoColumnMaskUsing] | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoColumnMaskUsing

Bases: BaseModel

PARAMETER	DESCRIPTION
alias	Optional alias of the matched column TYPE: str | None | VariableType DEFAULT: None
constant	A constant literal TYPE: str | None | VariableType DEFAULT: None
function_arg_expression	An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof TYPE: PolicyInfoColumnMaskUsingFunctionArgExpression | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoColumnMaskUsingFunctionArgExpression

Bases: BaseModel

PARAMETER	DESCRIPTION
tag_introspection	An expression that introspects tags at query time TYPE: PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospection | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospection

Bases: BaseModel

PARAMETER	DESCRIPTION
column_tag_value	Extracts the value of a column-level tag TYPE: PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionColumnTagValue | None | VariableType DEFAULT: None
tag_value	Extracts the value of a securable-level tag TYPE: PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionTagValue | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionColumnTagValue

Bases: BaseModel

PARAMETER	DESCRIPTION
column_alias	The alias from MATCH COLUMNS that identifies the column TYPE: str | VariableType
tag_key	1024 matches the max_length on FunctionArgument.constant above TYPE: str | VariableType

---

laktory.models.resources.databricks.policyinfo.PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionTagValue

Bases: BaseModel

PARAMETER	DESCRIPTION
tag_key	1024 matches the max_length on FunctionArgument.constant above TYPE: str | VariableType

---

laktory.models.resources.databricks.policyinfo.PolicyInfoDeny

Bases: BaseModel

PARAMETER	DESCRIPTION
privileges	List of privileges to grant. When any of these privileges are requested, the policy will grant access if the principal and condition match. Required on create and update TYPE: list[str] | VariableType

---

laktory.models.resources.databricks.policyinfo.PolicyInfoGrant

Bases: BaseModel

PARAMETER	DESCRIPTION
privileges	List of privileges to grant. When any of these privileges are requested, the policy will grant access if the principal and condition match. Required on create and update TYPE: list[str] | VariableType

---

laktory.models.resources.databricks.policyinfo.PolicyInfoMatchColumns

Bases: BaseModel

PARAMETER	DESCRIPTION
alias	Optional alias of the matched column TYPE: str | None | VariableType DEFAULT: None
condition	The condition expression used to match a table column TYPE: str | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoProviderConfig

Bases: BaseModel

PARAMETER	DESCRIPTION
workspace_id	Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with TYPE: str | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoRowFilter

Bases: BaseModel

PARAMETER	DESCRIPTION
function_name	The fully qualified name of the row filter function. The function is called on each row of the target table. It should return a boolean value indicating whether the row should be visible to the user. Required on create and update TYPE: str | VariableType
using	Optional list of column aliases or constant literals to be passed as arguments to the row filter function. The type of each column should match the positional argument of the row filter function TYPE: list[PolicyInfoRowFilterUsing] | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoRowFilterUsing

Bases: BaseModel

PARAMETER	DESCRIPTION
alias	Optional alias of the matched column TYPE: str | None | VariableType DEFAULT: None
constant	A constant literal TYPE: str | None | VariableType DEFAULT: None
function_arg_expression	An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof TYPE: PolicyInfoRowFilterUsingFunctionArgExpression | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoRowFilterUsingFunctionArgExpression

Bases: BaseModel

PARAMETER	DESCRIPTION
tag_introspection	An expression that introspects tags at query time TYPE: PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospection | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospection

Bases: BaseModel

PARAMETER	DESCRIPTION
column_tag_value	Extracts the value of a column-level tag TYPE: PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionColumnTagValue | None | VariableType DEFAULT: None
tag_value	Extracts the value of a securable-level tag TYPE: PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionTagValue | None | VariableType DEFAULT: None

---

laktory.models.resources.databricks.policyinfo.PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionColumnTagValue

Bases: BaseModel

PARAMETER	DESCRIPTION
column_alias	The alias from MATCH COLUMNS that identifies the column TYPE: str | VariableType
tag_key	1024 matches the max_length on FunctionArgument.constant above TYPE: str | VariableType

---

laktory.models.resources.databricks.policyinfo.PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionTagValue

Bases: BaseModel

PARAMETER	DESCRIPTION
tag_key	1024 matches the max_length on FunctionArgument.constant above TYPE: str | VariableType