-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1 from data-platform-hq/feat/databricks_workspace…
…_module feat: databricks workspace module
- Loading branch information
Showing
9 changed files
with
485 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,160 @@ | ||
| ################################################################################ | ||
| # Databricks Workspace | ||
| ################################################################################ | ||
| resource "databricks_mws_workspaces" "this" { | ||
| account_id = var.account_id | ||
| aws_region = var.region | ||
| workspace_name = var.label | ||
| credentials_id = databricks_mws_credentials.this.credentials_id | ||
| storage_configuration_id = databricks_mws_storage_configurations.this.storage_configuration_id | ||
| network_id = databricks_mws_networks.this.network_id | ||
| private_access_settings_id = try(databricks_mws_private_access_settings.this[0].private_access_settings_id, null) | ||
|
|
||
| dynamic "token" { | ||
| for_each = var.workspace_creator_token_enabled ? [1] : [] | ||
| content { | ||
| comment = "Workspace creator token managed by Terraform" | ||
| } | ||
| } | ||
|
|
||
| lifecycle { | ||
| replace_triggered_by = [databricks_mws_credentials.this] | ||
| } | ||
|
|
||
| } | ||
|
|
||
| resource "databricks_mws_private_access_settings" "this" { | ||
| count = var.private_access_settings_enabled ? 1 : 0 | ||
|
|
||
| private_access_settings_name = coalesce(var.private_access_settings_config.name, var.label) | ||
| region = var.region | ||
| public_access_enabled = var.private_access_settings_config.public_access_enabled | ||
| allowed_vpc_endpoint_ids = coalesce(var.private_access_settings_config.allowed_vpc_endpoint_ids, [var.privatelink_rest_vpce_id]) | ||
| private_access_level = "ENDPOINT" | ||
| } | ||
|
|
||
| ################################################################################ | ||
| # Network | ||
| ################################################################################ | ||
| resource "databricks_mws_networks" "this" { | ||
| account_id = var.account_id | ||
| network_name = var.label | ||
| security_group_ids = var.security_group_ids | ||
| subnet_ids = var.subnet_ids | ||
| vpc_id = var.vpc_id | ||
|
|
||
| dynamic "vpc_endpoints" { | ||
| for_each = var.privatelink_enabled ? [1] : [] | ||
| content { | ||
| dataplane_relay = [coalesce(try(module.privatelink_vpce.relay_vpce_id, null), var.privatelink_relay_vpce_id)] | ||
| rest_api = [coalesce(try(module.privatelink_vpce.rest_vpce_id, null), var.privatelink_rest_vpce_id)] | ||
| } | ||
| } | ||
| } | ||
|
|
||
| ################################################################################ | ||
| # Privatelink dedicated VPC Endpoints (REST/Relay) | ||
| ################################################################################ | ||
| module "privatelink_vpce" { | ||
| count = var.privatelink_dedicated_vpce_enabled ? 1 : 0 | ||
| source = "./modules/privatelink/" | ||
|
|
||
| account_id = var.account_id | ||
| region = var.region | ||
| relay_vpc_endpoint_name = var.privatelink_dedicated_vpce_config.relay_vpc_endpoint_name | ||
| relay_aws_vpc_endpoint_id = var.privatelink_dedicated_vpce_config.relay_aws_vpc_endpoint_id | ||
| rest_vpc_endpoint_name = var.privatelink_dedicated_vpce_config.rest_vpc_endpoint_name | ||
| rest_aws_vpc_endpoint_id = var.privatelink_dedicated_vpce_config.rest_aws_vpc_endpoint_id | ||
| } | ||
|
|
||
| ################################################################################ | ||
| # IAM | ||
| ################################################################################ | ||
| data "databricks_aws_assume_role_policy" "this" { | ||
| external_id = var.account_id | ||
| } | ||
|
|
||
| data "databricks_aws_crossaccount_policy" "this" {} | ||
|
|
||
| module "iam_cross_account_workspace_policy" { | ||
| source = "terraform-aws-modules/iam/aws//modules/iam-policy" | ||
| version = "5.41.0" | ||
|
|
||
| name = coalesce(var.iam_cross_account_workspace_role_config.policy_name, "${var.label}-dbx-crossaccount-policy") | ||
| policy = data.databricks_aws_crossaccount_policy.this.json | ||
| } | ||
|
|
||
| module "iam_cross_account_workspace_role" { | ||
| count = var.iam_cross_account_workspace_role_enabled ? 1 : 0 | ||
| source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role" | ||
| version = "5.41.0" | ||
|
|
||
| role_name = coalesce(var.iam_cross_account_workspace_role_config.role_name, "${var.label}-dbx-cross-account") | ||
| create_role = var.iam_cross_account_workspace_role_enabled | ||
| create_custom_role_trust_policy = true | ||
| custom_role_trust_policy = data.databricks_aws_assume_role_policy.this.json | ||
| role_permissions_boundary_arn = var.iam_cross_account_workspace_role_config.permission_boundary_arn | ||
| role_description = var.iam_cross_account_workspace_role_config.role_description | ||
| custom_role_policy_arns = [module.iam_cross_account_workspace_policy.arn] | ||
| tags = var.tags | ||
| } | ||
|
|
||
| # It is required to wait up to 30 seconds after role creation so Databricks would successfuly reference it | ||
| resource "time_sleep" "wait_30_seconds" { | ||
| depends_on = [module.iam_cross_account_workspace_role] | ||
|
|
||
| create_duration = "30s" | ||
| } | ||
|
|
||
| resource "databricks_mws_credentials" "this" { | ||
| account_id = var.account_id | ||
| credentials_name = "${var.label}-credentials" | ||
| role_arn = module.iam_cross_account_workspace_role[0].iam_role_arn | ||
|
|
||
| depends_on = [time_sleep.wait_30_seconds] | ||
| } | ||
|
|
||
| ################################################################################ | ||
| # Storage Configuration | ||
| ################################################################################ | ||
| data "databricks_aws_bucket_policy" "this" { | ||
| bucket = module.storage_configuration_dbfs_bucket[0].s3_bucket_id | ||
| } | ||
|
|
||
| module "storage_configuration_dbfs_bucket" { | ||
| count = var.storage_dbfs_enabled ? 1 : 0 | ||
| source = "terraform-aws-modules/s3-bucket/aws" | ||
| version = "4.1.2" | ||
|
|
||
| bucket_prefix = coalesce(var.storage_dbfs_config.bucket_name, "${var.label}-dbfs-") | ||
| acl = "private" | ||
|
|
||
| force_destroy = true | ||
|
|
||
| control_object_ownership = true | ||
| object_ownership = "BucketOwnerPreferred" | ||
|
|
||
| server_side_encryption_configuration = { | ||
| rule = { | ||
| apply_server_side_encryption_by_default = { | ||
| sse_algorithm = "AES256" | ||
| } | ||
| } | ||
| } | ||
|
|
||
| versioning = { | ||
| status = "Disabled" | ||
| } | ||
|
|
||
| } | ||
|
|
||
| resource "aws_s3_bucket_policy" "databricks_aws_bucket_policy" { | ||
| bucket = module.storage_configuration_dbfs_bucket[0].s3_bucket_id | ||
| policy = data.databricks_aws_bucket_policy.this.json | ||
| } | ||
|
|
||
| resource "databricks_mws_storage_configurations" "this" { | ||
| account_id = var.account_id | ||
| storage_configuration_name = var.label | ||
| bucket_name = module.storage_configuration_dbfs_bucket[0].s3_bucket_id | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| resource "databricks_mws_vpc_endpoint" "rest" { | ||
| account_id = var.account_id | ||
| aws_vpc_endpoint_id = var.rest_aws_vpc_endpoint_id | ||
| vpc_endpoint_name = var.rest_vpc_endpoint_name | ||
| region = var.region | ||
| } | ||
|
|
||
| resource "databricks_mws_vpc_endpoint" "relay" { | ||
| account_id = var.account_id | ||
| aws_vpc_endpoint_id = var.relay_aws_vpc_endpoint_id | ||
| vpc_endpoint_name = var.relay_vpc_endpoint_name | ||
| region = var.region | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| output "rest_vpce_id" { | ||
| value = databricks_mws_vpc_endpoint.rest.vpc_endpoint_id | ||
| description = "The ID of the AWS VPC endpoint associated with the Databricks REST API" | ||
| } | ||
|
|
||
| output "relay_vpce_id" { | ||
| value = databricks_mws_vpc_endpoint.relay.vpc_endpoint_id | ||
| description = "The ID of the AWS VPC endpoint associated with the Databricks Relay service" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| variable "region" { | ||
| type = string | ||
| description = "AWS region" | ||
| } | ||
|
|
||
| variable "rest_vpc_endpoint_name" { | ||
| type = string | ||
| description = "The name to assign to the AWS VPC endpoint for the Databricks REST API" | ||
| } | ||
| variable "rest_aws_vpc_endpoint_id" { | ||
| type = string | ||
| description = "The AWS VPC endpoint ID for the Databricks REST API" | ||
| } | ||
|
|
||
| variable "relay_vpc_endpoint_name" { | ||
| type = string | ||
| description = "The name to assign to the AWS VPC endpoint for the Databricks Relay service" | ||
| } | ||
|
|
||
| variable "relay_aws_vpc_endpoint_id" { | ||
| type = string | ||
| description = "The AWS VPC endpoint ID for the Databricks Relay service" | ||
| } | ||
|
|
||
| variable "account_id" { | ||
| type = string | ||
| description = "Databricks Account ID" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| terraform { | ||
| required_version = ">= 1.0" | ||
|
|
||
| required_providers { | ||
| databricks = { | ||
| source = "databricks/databricks" | ||
| version = ">= 1.55" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| output "workspace" { | ||
| value = databricks_mws_workspaces.this | ||
| description = "The Databricks workspace resource that has been created" | ||
| } | ||
|
|
||
| output "storage" { | ||
| value = try(module.storage_configuration_dbfs_bucket[0], null) | ||
| description = "The storage configuration for the DBFS bucket associated with the workspace" | ||
| } | ||
|
|
||
| output "iam_role" { | ||
| value = try(module.iam_cross_account_workspace_role[0], null) | ||
| description = "The IAM role created for cross-account access to the Databricks workspace" | ||
| } | ||
|
|
||
| output "workspace_url" { | ||
| value = databricks_mws_workspaces.this.workspace_url | ||
| description = "The URL for accessing the Databricks workspace" | ||
| } |
Oops, something went wrong.