secret_scopes

Creates, updates, deletes, gets or lists a secret_scopes resource.

Overview

Name	secret_scopes
Type	Resource
Id	databricks_workspace.workspace.secret_scopes

Fields

The following fields are returned by SELECT queries:

list

Name	Datatype	Description
name	string	A unique name to identify the secret scope.
backend_type	string	The type of secret scope backend. (AZURE_KEYVAULT, DATABRICKS)
▶keyvault_metadata	object	The metadata for the secret scope if the type is ``AZURE_KEYVAULT``

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list	select	deployment_name, workspace_domain		Lists all secret scopes available in the workspace.
create	insert	deployment_name, workspace_domain, scope		Creates a new secret scope.
delete	exec	deployment_name, workspace_domain, scope		Deletes a secret scope.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
deployment_name	string	The Databricks workspace deployment name: the host prefix of the workspace URL (dbc-abcd0123-a1bc on AWS, adb-1234567890123456.7 on Azure, 1234567890123456.7 on GCP). Set DATABRICKS_DEPLOYMENT_NAME to default it for the session. (default: dbc-abcd0123-a1bc, x-stackQL-envVar: DATABRICKS_DEPLOYMENT_NAME)
workspace_domain	string	The Databricks workspace domain suffix for the cloud. Selected by DATABRICKS_CLOUD (aws, azure or gcp; default aws). (default: cloud.databricks.com, x-stackQL-envVarSelector: {"envVar":"DATABRICKS_CLOUD","default":"aws","values":{"aws":"cloud.databricks.com","azure":"azuredatabricks.net","gcp":"gcp.databricks.com"}})

SELECT examples

list

Lists all secret scopes available in the workspace.

SELECT
name,
backend_type,
keyvault_metadata
FROM databricks_workspace.workspace.secret_scopes
WHERE deployment_name = '{{ deployment_name }}' -- required
AND workspace_domain = '{{ workspace_domain }}' -- required
;

INSERT examples

create

Creates a new secret scope.

INSERT INTO databricks_workspace.workspace.secret_scopes (
scope,
backend_azure_keyvault,
initial_manage_principal,
scope_backend_type,
deployment_name,
workspace_domain
)
SELECT 
'{{ scope }}' /* required */,
'{{ backend_azure_keyvault }}',
'{{ initial_manage_principal }}',
'{{ scope_backend_type }}',
'{{ deployment_name }}',
'{{ workspace_domain }}'
;

Manifest

# Description fields are for documentation purposes
- name: secret_scopes
props:
  - name: deployment_name
    value: "{{ deployment_name }}"
    description: Required parameter for the secret_scopes resource.
  - name: workspace_domain
    value: "{{ workspace_domain }}"
    description: Required parameter for the secret_scopes resource.
  - name: scope
    value: "{{ scope }}"
    description: |
      Scope name requested by the user. Scope names are unique.
  - name: backend_azure_keyvault
    description: |
      The metadata for the secret scope if the type is ``AZURE_KEYVAULT``
    value:
      resource_id: "{{ resource_id }}"
      dns_name: "{{ dns_name }}"
  - name: initial_manage_principal
    value: "{{ initial_manage_principal }}"
    description: |
      The principal that is initially granted ``MANAGE`` permission to the created scope.
  - name: scope_backend_type
    value: "{{ scope_backend_type }}"
    description: |
      The backend type the scope will be created with. If not specified, will default to ``DATABRICKS``

Lifecycle Methods

delete

Deletes a secret scope.

EXEC databricks_workspace.workspace.secret_scopes.delete 
@deployment_name='{{ deployment_name }}' --required, 
@workspace_domain='{{ workspace_domain }}' --required 
@@json=
'{
"scope": "{{ scope }}"
}'
;