Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-databricks-group-without-user-or-instance-profile

Provider: Databricks

Platform: Terraform

Severity: Low

Category: Access Control

Learn More

Description

Each databricks_group must be associated with at least one user or one instance profile. This rule checks for:

  • A databricks_group_member with a non-empty member_id, or
  • A databricks_group_instance_profile with a non-empty instance_profile_id

If neither is found referencing the group’s group_id, the databricks_group is flagged.

Compliant Code Examples

resource "databricks_group" "negative1_group" {
  display_name               = "Some Group"
  allow_cluster_create       = true
  allow_instance_pool_create = true
}

resource "databricks_user" "negative1_user" {
  user_name = "someone@example.com"
}

resource "databricks_group_member" "negative1_member" {
  group_id  = databricks_group.negative1_group.id
  member_id = databricks_user.negative1_user.id
}
resource "databricks_instance_profile" "negative2_instance_profile" {
  instance_profile_arn = "my_instance_profile_arn"
}

resource "databricks_group" "negative2_group" {
  display_name = "my_group_name"
}

resource "databricks_group_instance_profile" "negative2_group_instance_profile" {
  group_id            = databricks_group.negative2_group.id
  instance_profile_id = databricks_instance_profile.negative2_instance_profile.id
}
# group_id/member_id are cross-resource references to a group and user
# created in the same plan, so they're unresolved pre-apply and absent from
# planned_values.values in negative3.json (a real create plan for this exact
# configuration). The rule confirms via
# _dd_tfplan_meta.configuration_expressions that both references target this
# group (tf_lib.references_same_target) and that member_id was actually
# configured, so it correctly stays silent instead of treating this group as
# having no members.
resource "databricks_group" "negative3_group" {
  display_name               = "Some Group"
  allow_cluster_create       = true
  allow_instance_pool_create = true
}

resource "databricks_user" "negative3_user" {
  user_name = "someone@example.com"
}

resource "databricks_group_member" "negative3_member" {
  group_id  = databricks_group.negative3_group.id
  member_id = databricks_user.negative3_user.id
}

Non-Compliant Code Examples

resource "databricks_group" "positive_group" {
  display_name               = "Some Group"
  allow_cluster_create       = true
  allow_instance_pool_create = true
}

resource "databricks_user" "positive_user" {
  user_name = "someone@example.com"
}

resource "databricks_group_member" "positive_member" {
  group_id  = databricks_group.positive_group.id
  member_id = databricks_user.positive_user.id
}

resource "databricks_group" "positive_group_2" {
  display_name               = "Some Group"
  allow_cluster_create       = true
  allow_instance_pool_create = true
}
resource "databricks_instance_profile" "positive_instance_profile" {
  instance_profile_arn = "my_instance_profile_arn"
}

resource "databricks_group" "positive_group" {
  display_name = "my_group_name"
}

resource "databricks_group_instance_profile" "my_group_instance_profile" {
  group_id            = databricks_group.positive_group.id
  instance_profile_id = databricks_instance_profile.positive_instance_profile.id
}

resource "databricks_group" "positive_group2" {
  display_name = "my_group_name"
}