Open mixam24 opened 2 months ago
Any comments on this one?
@mixam24 This sounds like a product feature/issue, not a CLI issue. I forwarded the question internally.
I doubt that it matters, but could you try doing the same with the new CLI? You're using the legacy Python one.
Installation instructions can be found at https://docs.databricks.com/en/dev-tools/cli/install.html.
@pietern thanks for your reply.
This sounds like a product feature/issue, not a CLI issue.
I agree, the same problem arises in UI and in terraform (= anything that interacts with REST API).
I forwarded the question internally.
Could you kindly recommend an alternative communication channel for the discussion of this issue? I have already contacted Microsoft support, but I have serious doubts regarding their proficiency in the topic and overall effectiveness of the communication.
Describe the issue
I'm trying to create a new storage credential in Unity Catalog using my personal user that has Unity Metastore Admin permissions. Due to security reasons, our organization does not allow personal users to have the built-in "Contributor" role. Instead, we assign a custom one, which is almost identical to the built-in role. Hence, my personal identity does not have built-in "Contributor" role.
The custom role definition is as follows:
The attempt to create a storage credential fails with the following error:
Creation of a storage credential required the contributor role over the corresponding access connector with ID '...'. Please contact your account admin.
I believe that the service performs role assignment lookups only by ID and does not check that my user has the necessary permissions to perform the action.
Steps to reproduce the behavior
List the identity role assignments over the databricks access connector
Describe the
Custom Contributor
role definitionDemonstrate that the identity used has Metastore Admin permissions
Create storage credential using access connector ID and managed identity ID
Expected Behavior
Creation of the storage credential succeeded since the identity used has enough access permissions.
Actual Behavior
The attempt of a storage credential creation is failing with the following error:
Creation of a storage credential required the contributor role over the corresponding access connector with ID '...'. Please contact your account admin.
OS and CLI version
Is this a regression?
n.a.
Debug Logs
n.a.