secrets

Creates, updates, deletes, gets or lists a secrets resource.

Overview

Name	secrets
Type	Resource
Id	databricks_workspace.workspace.secrets

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
key	string
value	string	The value of the secret in its byte representation.

list

Name	Datatype	Description
key	string	A unique name to identify the secret.
last_updated_timestamp	integer	The last updated timestamp (in milliseconds) for the secret.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	scope, key, deployment_name, workspace_domain		Gets a secret for a given key and scope. This API can only be called from the DBUtils interface. Users
list	select	scope, deployment_name, workspace_domain		Lists the secret keys that are stored at this scope. This is a metadata-only operation; secret data
put	insert	deployment_name, workspace_domain, scope, key		Inserts a secret under the provided scope with the given name. If a secret already exists with the
delete	exec	deployment_name, workspace_domain, scope, key		Deletes the secret stored in this secret scope. You must have WRITE or MANAGE permission on

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
deployment_name	string	The Databricks workspace deployment name: the host prefix of the workspace URL (dbc-abcd0123-a1bc on AWS, adb-1234567890123456.7 on Azure, 1234567890123456.7 on GCP). Set DATABRICKS_DEPLOYMENT_NAME to default it for the session. (default: dbc-abcd0123-a1bc, x-stackQL-envVar: DATABRICKS_DEPLOYMENT_NAME)
key	string	Name of the secret to fetch value information.
scope	string	The name of the scope to list secrets within.
workspace_domain	string	The Databricks workspace domain suffix for the cloud. Selected by DATABRICKS_CLOUD (aws, azure or gcp; default aws). (default: cloud.databricks.com, x-stackQL-envVarSelector: {"envVar":"DATABRICKS_CLOUD","default":"aws","values":{"aws":"cloud.databricks.com","azure":"azuredatabricks.net","gcp":"gcp.databricks.com"}})

SELECT examples

get

Gets a secret for a given key and scope. This API can only be called from the DBUtils interface. Users

SELECT
key,
value
FROM databricks_workspace.workspace.secrets
WHERE scope = '{{ scope }}' -- required
AND key = '{{ key }}' -- required
AND deployment_name = '{{ deployment_name }}' -- required
AND workspace_domain = '{{ workspace_domain }}' -- required
;

list

Lists the secret keys that are stored at this scope. This is a metadata-only operation; secret data

SELECT
key,
last_updated_timestamp
FROM databricks_workspace.workspace.secrets
WHERE scope = '{{ scope }}' -- required
AND deployment_name = '{{ deployment_name }}' -- required
AND workspace_domain = '{{ workspace_domain }}' -- required
;

INSERT examples

put

Inserts a secret under the provided scope with the given name. If a secret already exists with the

INSERT INTO databricks_workspace.workspace.secrets (
scope,
key,
bytes_value,
string_value,
deployment_name,
workspace_domain
)
SELECT 
'{{ scope }}' /* required */,
'{{ key }}' /* required */,
'{{ bytes_value }}',
'{{ string_value }}',
'{{ deployment_name }}',
'{{ workspace_domain }}'
;

Manifest

# Description fields are for documentation purposes
- name: secrets
props:
  - name: deployment_name
    value: "{{ deployment_name }}"
    description: Required parameter for the secrets resource.
  - name: workspace_domain
    value: "{{ workspace_domain }}"
    description: Required parameter for the secrets resource.
  - name: scope
    value: "{{ scope }}"
    description: |
      The name of the scope to which the secret will be associated with.
  - name: key
    value: "{{ key }}"
    description: |
      A unique name to identify the secret.
  - name: bytes_value
    value: "{{ bytes_value }}"
    description: |
      If specified, value will be stored as bytes.
  - name: string_value
    value: "{{ string_value }}"
    description: |
      If specified, note that the value will be stored in UTF-8 (MB4) form.

Lifecycle Methods

delete

Deletes the secret stored in this secret scope. You must have WRITE or MANAGE permission on

EXEC databricks_workspace.workspace.secrets.delete 
@deployment_name='{{ deployment_name }}' --required, 
@workspace_domain='{{ workspace_domain }}' --required 
@@json=
'{
"scope": "{{ scope }}", 
"key": "{{ key }}"
}'
;