databricksobotoken Resource

June 12, 2026 ยท View on GitHub

API Documentation

This resource creates On-Behalf-Of tokens for a databricks_service_principal in Databricks workspaces on AWS and GCP. In general it's best to use OAuth authentication using client ID and secret, and use this resource mostly for integrations that doesn't support OAuth.

-> This resource can only be used with a workspace-level provider!

~> To create On-Behalf-Of token for Azure Service Principal, configure Terraform provider to use Azure service principal's client ID and secret, and use databricks_token resource to create a personal access token.

Example Usage

Creating a token for a narrowly-scoped service principal, that would be the only one (besides admins) allowed to use PAT token in this given workspace, keeping your automated deployment highly secure.

-> A given declaration of databricks_permissions.token_usage would OVERWRITE permissions to use PAT tokens from any existing groups with token usage permissions such as the users group. To avoid this, be sure to include any desired groups in additional access_control blocks in the Terraform configuration file.

resource "databricks_service_principal" "this" {
  display_name = "Automation-only SP"
}

resource "databricks_permissions" "token_usage" {
  authorization = "tokens"
  access_control {
    service_principal_name = databricks_service_principal.this.application_id
    permission_level       = "CAN_USE"
  }
}

resource "databricks_obo_token" "this" {
  depends_on       = [databricks_permissions.token_usage]
  application_id   = databricks_service_principal.this.application_id
  comment          = "PAT on behalf of ${databricks_service_principal.this.display_name}"
  lifetime_seconds = 3600
}

output "obo" {
  value     = databricks_obo_token.this.token_value
  sensitive = true
}

Creating a token for a service principal with admin privileges

resource "databricks_service_principal" "this" {
  display_name = "Terraform"
}

data "databricks_group" "admins" {
  display_name = "admins"
}

resource "databricks_group_member" "this" {
  group_id  = data.databricks_group.admins.id
  member_id = databricks_service_principal.this.id
}

resource "databricks_obo_token" "this" {
  depends_on       = [databricks_group_member.this]
  application_id   = databricks_service_principal.this.application_id
  comment          = "PAT on behalf of ${databricks_service_principal.this.display_name}"
  lifetime_seconds = 3600
}

Argument Reference

The following arguments are required:

  • application_id - Application ID of databricks_service_principal to create a PAT token for.
  • lifetime_seconds - (Integer, Optional) The number of seconds before the token expires. Token resource is re-created when it expires. If no lifetime is specified, the token remains valid indefinitely.
  • comment - (String, Optional) Comment that describes the purpose of the token.
  • provider_config - (Optional) Configure the provider for management through account provider. This block consists of the following fields:
    • workspace_id - (Required) Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.

Attribute Reference

In addition to all arguments above, the following attributes are exported:

  • id - Canonical unique identifier for the token.
  • token_value - Sensitive value of the newly-created token.

Import

!> Importing this resource is not currently supported.

The following resources are often used in the same context: