Databricks external location Terraform module

One Unity Catalog external location.

Creates one external location on top of a storage credential and, when grants is not empty, one databricks_grants block on it.

Resources

• databricks_external_location.this
• databricks_grants.this[0] (count = 1 only when grants is not empty)

The resource addresses above are part of the DataTF import contract. Do not rename them.

Usage

module "external_location" {
  source  = "536tech/external-location/databricks"
  version = "1.0.0"

  name               = "lake_raw"
  url                = "abfss://raw@lake.dfs.core.windows.net/"
  credential_name    = "lake_cred"
  isolation_mode     = "ISOLATION_MODE_ISOLATED"
  owner              = "data-platform"
  read_only          = false
  fallback           = false
  enable_file_events = true

  grants = [{
    principal  = "data-engineers"
    privileges = ["READ_FILES", "WRITE_FILES"]
  }]
}

Compatibility

Configure the Databricks provider in the calling root with a workspace endpoint. This resource module is also used by the workspace pattern module. Each repository has its own releases. Consumers select an exact tested module version.

The resource addresses match the original workspace submodule in version 0.1.1. To migrate a direct submodule call, change its source and version. Keep the module block name. Run terraform init and require a plan with no resource changes. DataTF exports continue to use the workspace pattern module and its existing import addresses.

Development

Use Terraform 1.7 or later for the mock tests. The module supports Terraform 1.5 or later.

prek install
terraform init -backend=false -lockfile=readonly
terraform validate
terraform test
tflint --recursive
prek run --all-files

CI tests the committed provider version and the minimum supported provider, 1.128.0. The workspace pattern module checks the complete DataTF contract and its integration behavior.

License

Apache-2.0.

Requirements

The following requirements are needed by this module:

• terraform (>= 1.5.0)

• databricks (>= 1.128.0, < 2.0.0)

Providers

The following providers are used by this module:

• databricks (>= 1.128.0, < 2.0.0)

Resources

The following resources are used by this module:

• databricks_external_location.this (resource)
• databricks_grants.this (resource)

Required Inputs

The following input variables are required:

credential_name

Description: Storage credential that grants access to the URL.

Type: string

enable_file_events

Description: Turn on file events for the location.

Type: bool

fallback

Description: Let the workspace fall back to cluster credentials when the location has no access.

Type: bool

isolation_mode

Description: Isolation mode: ISOLATION_MODE_OPEN or ISOLATION_MODE_ISOLATED.

Type: string

name

Description: External location name.

Type: string

owner

Description: External location owner. A user, group, or service principal.

Type: string

read_only

Description: Limit the location to read access.

Type: bool

url

Description: Storage URL, for example abfss://container@account.dfs.core.windows.net/path.

Type: string

Optional Inputs

The following input variables are optional (have default values):

comment

Description: External location description.

Type: string

Default: null

force_destroy

Description: Allow Terraform to delete the location while tables still reference it.

Type: bool

Default: false

grants

Description: Direct location grants. A list permits computed service principal application IDs.

Type:

list(object({
    principal  = string
    privileges = list(string)
  }))

Default: []

Outputs

The following outputs are exported:

id

Description: External location id.

name

Description: External location name.

url

Description: External location URL.