updated iam.tf, permissions.tf and variables.tf

Author: ivasm-ko

iam.tf

@@ -19,14 +19,22 @@ locals {
       }] if params.service_principal != null
     ])
   )
+  account_groups = { for group in var.account_groups : group.name => group if group.name != null }
+  iam_map        = length(var.iam) != 0 ? { for group, params in var.iam : group => params if length(var.account_groups) == 0 } : {}
+}
+
+data "databricks_group" "account_groups" {
+  for_each = local.account_groups
+
+  display_name = each.key
 }
 
 data "databricks_group" "admin" {
   display_name = "admins"
 }
 
 resource "databricks_group" "this" {
-  for_each = toset(keys(var.iam))
+  for_each = length(local.account_groups) != 0 ? [] : toset(keys(var.iam))
 
   display_name = each.key
   lifecycle { ignore_changes = [external_id, allow_cluster_create, allow_instance_pool_create, databricks_sql_access, workspace_access] }
@@ -54,14 +62,14 @@ resource "databricks_service_principal" "this" {
 }
 
 resource "databricks_group_member" "admin" {
-  for_each = merge(local.admin_user_map, local.admin_sp_map)
+  for_each = length(local.account_groups) != 0 ? {} : merge(local.admin_user_map, local.admin_sp_map)
 
   group_id  = data.databricks_group.admin.id
   member_id = startswith(each.key, "user") ? databricks_user.this[each.value].id : databricks_service_principal.this[each.value].id
 }
 
 resource "databricks_group_member" "this" {
-  for_each = {
+  for_each = length(local.account_groups) != 0 ? {} : {
     for entry in local.members_object_list : "${entry.type}.${entry.group}.${entry.member}" => entry
   }
 
@@ -70,11 +78,9 @@ resource "databricks_group_member" "this" {
 }
 
 resource "databricks_entitlements" "this" {
-  for_each = {
-    for group, params in var.iam : group => params
-  }
+  for_each = merge(local.account_groups, local.iam_map)
 
-  group_id                   = databricks_group.this[each.key].id
+  group_id                   = length(local.account_groups) != 0 ? data.databricks_group.account_groups[each.key].id : databricks_group.this[each.key].id
   allow_cluster_create       = contains(coalesce(each.value.entitlements, ["none"]), "allow_cluster_create")
   allow_instance_pool_create = contains(coalesce(each.value.entitlements, ["none"]), "allow_instance_pool_create")
   databricks_sql_access      = contains(coalesce(each.value.entitlements, ["none"]), "databricks_sql_access")

permissions.tf

@@ -4,20 +4,27 @@ locals {
       scope = param.scope_name, principal = permission.principal, permission = permission.permission
     }] if param.acl != null
   ])
+  account_level_group_permissions = { for group in var.account_groups : (group.cluster_name) => {
+    permissions = [{
+      group_name       = group.name,
+      permission_level = group.permission
+    }]
+    } if group.permission != null
+  }
+  workspace_level_group_permissions = length(var.account_groups) != 0 ? {} : {
+    for group in var.clusters : (group.cluster_name) => group if length(group.permissions) != 0
+  }
 }
 
 resource "databricks_permissions" "clusters" {
-  for_each = {
-    for v in var.clusters : (v.cluster_name) => v
-    if length(v.permissions) != 0
-  }
+  for_each = merge(local.account_level_group_permissions, local.workspace_level_group_permissions)
 
   cluster_id = databricks_cluster.cluster[each.key].id
 
   dynamic "access_control" {
     for_each = each.value.permissions
     content {
-      group_name       = databricks_group.this[access_control.value.group_name].display_name
+      group_name       = length(var.account_groups) != 0 ? data.databricks_group.account_groups[access_control.value.group_name].display_name : databricks_group.this[access_control.value.group_name].display_name
       permission_level = access_control.value.permission_level
     }
   }

variables.tf

@@ -43,6 +43,17 @@ variable "workspace_admins" {
   }
 }
 
+variable "account_groups" {
+  type = list(object({
+    name         = string
+    entitlements = optional(list(string))
+    cluster_name = optional(string)
+    permission   = optional(string)
+  }))
+  description = "List of objects with group name and entitlements for this group, cluster name to which should be added group and permissions for this group in cluster"
+  default     = []
+}
+
 variable "iam" {
   type = map(object({
     user              = optional(list(string))