databricks / terraform-provider-databricks

Databricks Terraform Provider
https://registry.terraform.io/providers/databricks/databricks/latest
Other
444 stars 384 forks source link

[ISSUE] Azure MSI authentication doesn't work for the account-level APIs #2427

Closed ChrisMoon-DB closed 1 year ago

ChrisMoon-DB commented 1 year ago

Configuration

terraform {
  required_providers {
    databricks = {
      source = "databricks/databricks"
      version = "1.19.0"
    }
  }
}
provider "azurerm" {
  features{}
}

provider "databricks" {
  host = "https://accounts.azuredatabricks.net"
  account_id = "xxxx-xxxx-xxxx-xxxx-xxxxxxx"
  azure_use_msi = true
  auth_type = "azure-msi"
}

resource "databricks_mws_permission_assignment" "add_admin_group" {
  workspace_id = "000000000000"
  principal_id = "00000000000"
  permissions = ["ADMIN"]
}

Expected Behavior Add a user to the workspace and grant an admin privilege without an error

Actual Behavior It fails with the default auth error

Steps to Reproduce terraform init terraform apply

Terraform and provider versions Terraform v1.5.2 Databricks 1.19

Debug Output

[ERROR] provider.terraform-provider-databricks_v1.18.0.exe: 
Response contains error diagnostic: 
diagnostic_severity=ERROR 
diagnostic_summary="cannot create mws permission assignment: 
default auth: cannot configure default credentials. 
Config: 
host=https://accounts.azuredatabricks.net, 
account_id=xxxxxxx-xxxxx-xxxxx-xxxxx-xxxxxxxxxxx, 
azure_use_msi=true" 
tf_provider_addr=registry.terraform.io/databricks/databricks tf_req_id=a1a9544c-45b5-a788-8f7b-f309b3cc30ac
tf_resource_type=databricks_mws_permission_assignment 
diagnostic_detail= tf_proto_version=5.3 tf_rpc=ApplyResourceChange 
@caller=/home/runner/work/terraform-provider-databricks/terraform-provider-databricks/vendor/github    .com/hashicorp/terraform-plugin-go/tfprotov5/internal/diag/diagnostics.go:55

Important Factoids This is an account-level API and authenticating via MSI. I tested workspace-level APIs with the MSI auth, and it had no issues.

More importantly, I was able to find the below debug log when I run the workspace-level APIs which didn't exist in account-level auth. [DEBUG] provider.terraform-provider-databricks_v1.18.0.exe: Generating AAD token via Azure MSI

nfx commented 1 year ago

fixed in https://github.com/databricks/databricks-sdk-go/pull/544, pending go sdk upgrade

alexott commented 1 year ago

Should be fixed in 1.22.0