databricks_entitlements Resource

June 12, 2026 ยท View on GitHub

API Documentation

This resource allows you to set entitlements to existing databricks_users, databricks_group or databricks_service_principal.

-> This resource can only be used with a workspace-level provider!

-> You must define entitlements of a principal using either databricks_entitlements or directly within one of databricks_users, databricks_group or databricks_service_principal. Having entitlements defined in both resources will result in non-deterministic behaviour.

Example Usage

Setting entitlements for a regular user:

data "databricks_user" "me" {
  user_name = "me@example.com"
}

resource "databricks_entitlements" "me" {
  user_id                    = data.databricks_user.me.id
  allow_cluster_create       = true
  allow_instance_pool_create = true
}

Setting entitlements for a service principal:

data "databricks_service_principal" "this" {
  application_id = "11111111-2222-3333-4444-555666777888"
}

resource "databricks_entitlements" "this" {
  service_principal_id       = data.databricks_service_principal.this.sp_id
  allow_cluster_create       = true
  allow_instance_pool_create = true
}

Setting entitlements to all users in a workspace - referencing special users databricks_group

data "databricks_group" "users" {
  display_name = "users"
}

resource "databricks_entitlements" "workspace-users" {
  group_id                   = data.databricks_group.users.id
  allow_cluster_create       = true
  allow_instance_pool_create = true
}

Argument Reference

The following arguments are available to specify the identity you need to enforce entitlements. You must specify exactly one of those arguments otherwise resource creation will fail.

  • user_id - Canonical unique identifier for the user.
  • group_id - Canonical unique identifier for the group.
  • service_principal_id - Canonical unique identifier for the service principal.

The following entitlements are available.

  • allow_cluster_create - (Optional) Allow the principal to have cluster create privileges. Defaults to false. More fine grained permissions could be assigned with databricks_permissions and cluster_id argument. Everyone without allow_cluster_create argument set, but with permission to use Cluster Policy would be able to create clusters, but within boundaries of that specific policy.
  • allow_instance_pool_create - (Optional) Allow the principal to have instance pool create privileges. Defaults to false. More fine grained permissions could be assigned with databricks_permissions and instance_pool_id argument.
  • databricks_sql_access - (Optional) This is a field to allow the principal to have access to Databricks SQL UI, Databricks One and through databricks_sql_endpoint.
  • workspace_access - (Optional) This is a field to allow the principal to have access to a Databricks Workspace UI and Databricks One.
  • workspace_consume - (Optional) This is a field to allow the principal to have access only to Databricks One. Couldn't be used with workspace_access or databricks_sql_access.
  • provider_config - (Optional) Configure the provider for management through account provider. This block consists of the following fields:
    • workspace_id - (Required) Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.

Import

The resource can be imported using a synthetic identifier. Examples of valid synthetic identifiers are:

  • user/user_id - user user_id.
  • group/group_id - group group_id.
  • spn/spn_id - service principal spn_id.
import {
  to = databricks_entitlements.me
  id = "user/<user-id>"
}

Alternatively, when using terraform version 1.4 or earlier, import using the terraform import command:

terraform import databricks_entitlements.me user/<user-id>

The following resources are often used in the same context: