secrets_uc

Creates, updates, deletes, gets or lists a secrets_uc resource.

Overview

Name	secrets_uc
Type	Resource
Id	databricks_workspace.catalog.secrets_uc

Fields

The following fields are returned by SELECT queries:

secrets_uc_get_secret

Name	Datatype	Description
name	string	The name of the secret, relative to its parent schema.
metastore_id	string	Unique identifier of the metastore hosting the secret.
catalog_name	string	The name of the catalog where the schema and the secret reside.
full_name	string	The three-level (fully qualified) name of the secret, in the form of **catalog_name.schema_name.secret_name**.
schema_name	string	The name of the schema where the secret resides.
comment	string	User-provided free-form text description of the secret.
create_time	string (date-time)	The time at which this secret was created.
created_by	string	The principal that created the secret.
effective_owner	string	The effective owner of the secret, which may differ from the directly-set **owner** due to inheritance.
effective_value	string	The secret value. Only populated in responses when you have the **READ_SECRET** privilege and **include_value** is set to true in the request. The maximum size is 60 KiB.
expire_time	string (date-time)	User-provided expiration time of the secret. This field indicates when the secret should no longer be used and may be displayed as a warning in the UI. It is purely informational and does not trigger any automatic actions or affect the secret's lifecycle.
owner	string	The owner of the secret. Defaults to the creating principal on creation. Can be updated to transfer ownership of the secret to another principal.
update_time	string (date-time)	The time at which this secret was last updated.
updated_by	string	The principal that last updated the secret.
value	string	The secret value to store. This field is input-only and is not returned in responses — use the **effective_value** field (via GetSecret with **include_value** set to true) to read the secret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes passwords, tokens, keys, and other sensitive credential data.

secrets_uc_list_secrets

Name	Datatype	Description
name	string	The name of the secret, relative to its parent schema.
metastore_id	string	Unique identifier of the metastore hosting the secret.
catalog_name	string	The name of the catalog where the schema and the secret reside.
full_name	string	The three-level (fully qualified) name of the secret, in the form of **catalog_name.schema_name.secret_name**.
schema_name	string	The name of the schema where the secret resides.
comment	string	User-provided free-form text description of the secret.
create_time	string (date-time)	The time at which this secret was created.
created_by	string	The principal that created the secret.
effective_owner	string	The effective owner of the secret, which may differ from the directly-set **owner** due to inheritance.
effective_value	string	The secret value. Only populated in responses when you have the **READ_SECRET** privilege and **include_value** is set to true in the request. The maximum size is 60 KiB.
expire_time	string (date-time)	User-provided expiration time of the secret. This field indicates when the secret should no longer be used and may be displayed as a warning in the UI. It is purely informational and does not trigger any automatic actions or affect the secret's lifecycle.
owner	string	The owner of the secret. Defaults to the creating principal on creation. Can be updated to transfer ownership of the secret to another principal.
update_time	string (date-time)	The time at which this secret was last updated.
updated_by	string	The principal that last updated the secret.
value	string	The secret value to store. This field is input-only and is not returned in responses — use the **effective_value** field (via GetSecret with **include_value** set to true) to read the secret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes passwords, tokens, keys, and other sensitive credential data.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
secrets_uc_get_secret	select	full_name, deployment_name		Gets a secret by its three-level (fully qualified) name.
secrets_uc_list_secrets	select	deployment_name	catalog_name, page_size, page_token, schema_name	Lists secrets in Unity Catalog.
secrets_uc_create_secret	insert	deployment_name, secret		Creates a new secret in Unity Catalog.
secrets_uc_update_secret	update	full_name, update_mask, deployment_name, secret		Updates an existing secret in Unity Catalog.
secrets_uc_delete_secret	delete	full_name, deployment_name		Deletes a secret by its three-level (fully qualified) name.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
deployment_name	string	The Databricks Workspace Deployment Name (default: dbc-abcd0123-a1bc)
full_name	string	The three-level (fully qualified) name of the secret (for example, catalog_name.schema_name.secret_name).
update_mask	object	The field mask specifying which fields of the secret to update. - If update_mask is "*", all fields specified in secret are updated. - If update_mask specifies one or more fields, only those fields are updated. Each specified field must be set in secret. Supported fields: value, comment, owner, expire_time. To change the secret name, delete and recreate the secret.
catalog_name	string	The name of the catalog under which to list secrets. Both catalog_name and schema_name must be specified together.
page_size	integer	Maximum number of secrets to return. - If not specified, at most 1000 secrets are returned. - If set to a value greater than 0, the page length is the minimum of this value and 1000. - If set to 0, the page length is set to 1000. - If set to a value less than 0, an invalid parameter error is returned.
page_token	string	Opaque pagination token to go to the next page based on previous query. The maximum page length is determined by a server configured value.
schema_name	string	The name of the schema under which to list secrets. Both catalog_name and schema_name must be specified together.

SELECT examples

secrets_uc_get_secret

Gets a secret by its three-level (fully qualified) name.

SELECT
name,
metastore_id,
catalog_name,
full_name,
schema_name,
comment,
create_time,
created_by,
effective_owner,
effective_value,
expire_time,
owner,
update_time,
updated_by,
value
FROM databricks_workspace.catalog.secrets_uc
WHERE full_name = '{{ full_name }}' -- required
AND deployment_name = '{{ deployment_name }}' -- required
;

secrets_uc_list_secrets

Lists secrets in Unity Catalog.

SELECT
name,
metastore_id,
catalog_name,
full_name,
schema_name,
comment,
create_time,
created_by,
effective_owner,
effective_value,
expire_time,
owner,
update_time,
updated_by,
value
FROM databricks_workspace.catalog.secrets_uc
WHERE deployment_name = '{{ deployment_name }}' -- required
AND catalog_name = '{{ catalog_name }}'
AND page_size = '{{ page_size }}'
AND page_token = '{{ page_token }}'
AND schema_name = '{{ schema_name }}'
;

INSERT examples

secrets_uc_create_secret

Creates a new secret in Unity Catalog.

INSERT INTO databricks_workspace.catalog.secrets_uc (
secret,
deployment_name
)
SELECT 
'{{ secret }}' /* required */,
'{{ deployment_name }}'
RETURNING
name,
metastore_id,
catalog_name,
full_name,
schema_name,
comment,
create_time,
created_by,
effective_owner,
effective_value,
expire_time,
owner,
update_time,
updated_by,
value
;

Manifest

# Description fields are for documentation purposes
- name: secrets_uc
props:
  - name: deployment_name
    value: "{{ deployment_name }}"
    description: Required parameter for the secrets_uc resource.
  - name: secret
    description: |
      The secret object to create. The **name**, **catalog_name**, **schema_name**, and **value** fields are required.
    value:
      name: "{{ name }}"
      catalog_name: "{{ catalog_name }}"
      schema_name: "{{ schema_name }}"
      value: "{{ value }}"
      comment: "{{ comment }}"
      create_time: "{{ create_time }}"
      created_by: "{{ created_by }}"
      effective_owner: "{{ effective_owner }}"
      effective_value: "{{ effective_value }}"
      expire_time: "{{ expire_time }}"
      full_name: "{{ full_name }}"
      metastore_id: "{{ metastore_id }}"
      owner: "{{ owner }}"
      update_time: "{{ update_time }}"
      updated_by: "{{ updated_by }}"

UPDATE examples

secrets_uc_update_secret

Updates an existing secret in Unity Catalog.

UPDATE databricks_workspace.catalog.secrets_uc
SET 
secret = '{{ secret }}'
WHERE 
full_name = '{{ full_name }}' --required
AND update_mask = '{{ update_mask }}' --required
AND deployment_name = '{{ deployment_name }}' --required
AND secret = '{{ secret }}' --required
RETURNING
name,
metastore_id,
catalog_name,
full_name,
schema_name,
comment,
create_time,
created_by,
effective_owner,
effective_value,
expire_time,
owner,
update_time,
updated_by,
value;

DELETE examples

secrets_uc_delete_secret

Deletes a secret by its three-level (fully qualified) name.

DELETE FROM databricks_workspace.catalog.secrets_uc
WHERE full_name = '{{ full_name }}' --required
AND deployment_name = '{{ deployment_name }}' --required
;