Required permissions
For each workspace, Databricks creates a service account with the minimal permissions needed to create and manage the workspace. Your Google OAuth identity will be used to grant permissions to the service account on your project. All you have to do is click OK on a standard OAuth dialog. The Databricks account admin who creates the workspace must have the correct permissions on the project that was specified when the workspace was created.
Ensure that one of the following applies to you if you plan to create workspaces:
You are the Project Owner of the Google Cloud project that you specify during workspace creation.
You are the Project Editor and the IAM Admin for the Google Cloud project that you specify during workspace creation.
The set of project permissions that Databricks grants to the service account includes the permissions associated with the following roles:
Kubernetes Admin (built-in role)
Compute Storage Admin (built-in role)
Permissions for a custom role that Databricks automatically creates while launching a workspace.
See following list of permissions and how Databricks uses each one:
Required user permissions or service account permissions to create a workspace.
Permissions in the custom role that Databricks grants to the service account.
The rightmost column specifies one or more phases of the Databricks application:
Launch: Needed for initial launch of a Databricks workspace.
Operational: Needed for general ongoing functionality of a Databricks workspace.
Repair: Needed for potential repair of a Databricks workspace.
Delete: Needed for deletion of a workspace.
Required user permissions or service account permissions to create a workspace
To create a workspace, you must have the following Google permissions on your account, which can be a Google Account or a service account.
Google permission |
Purpose |
Required for phase |
---|---|---|
|
Create the custom role. |
Launch |
|
Delete the custom role. |
Delete |
|
Get the custom role. |
Launch |
|
Update the custom role. |
Repair |
|
Get IAM policy. |
Launch |
|
Set IAM policy. |
Launch |
|
Get a project number from its project ID. |
Launch |
|
Get IAM policy |
Launch |
|
Set IAM policy |
Launch |
|
Validate whether the customer project has enabled the required Google Cloud APIs. |
Launch |
|
Validate whether the customer project has enabled the required Google Cloud APIs. |
Launch |
|
Enable the required Google Cloud APIs on the project if they are not already enabled. |
Launch |
Permissions in the custom role that Databricks grants to the service account
While creating a workspace, Databricks creates a service account and grants a role with permissions that Databricks needs to manage your workspace.
If your workspace uses a customer-managed VPC, it does not need as many permissions. The role that Databricks creates omits permissions such as creating, updating, and deleting objects such as networks, routers, and subnets. For the full list, see Permissions in the custom role that Databricks grants to the service account.
Google permission |
Purpose |
Required for phase |
---|---|---|
|
Visibility into GCE operations during GCE outages. |
Operational |
|
GCE troubleshooting. |
Operational |
|
GCE troubleshooting. |
Operational |
|
GCE troubleshooting. |
Operational |
|
GCE troubleshooting. |
Operational |
|
Manage network resources. |
Operational |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Launch |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Delete |
|
Manage network resources. |
Launch, Operational |
|
Manage network resources. |
Operational |
|
Manage network resources. |
Repair |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Repair |
|
Manage network resources. |
Operational |
|
Manage network resources. |
Launch |
|
Visibility into GCE operations during GCE outages. |
Operational |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Launch |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Delete |
|
Manage network resources. |
Operational |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Repair |
|
Manage network resources. |
Operational |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Launch |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Delete |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Repair |
|
Manage network resources. |
Operational |
|
Manage network resources. |
Repair |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Launch |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Launch |
|
Manage network resources. If you use a customer-managed VPC, this permission is not in the custom role that Databricks grants to the service account. |
Repair |
|
Manage network resources. |
Operational |
|
Manage network resources. |
Launch |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Manage GKE cluster. |
Operational |
|
Inspect Google service accounts or bind them to a cluster. |
Operational |
|
Inspect Google service accounts or bind them to a cluster. |
Operational |
|
Converting customer project ID to a project number. |
Launch, Operational |
|
Check if the project IAM policy is correctly configured. |
Launch |
|
Implement DBFS, internal artifacts, and logging. |
Launch |
|
Implement DBFS, internal artifacts, and logging. |
Delete |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Repair |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Launch |
|
Implement DBFS, internal artifacts, and logging. |
Delete |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Launch, Operational |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Operational |
|
Implement DBFS, internal artifacts, and logging. |
Launch |
|
Implement DBFS, internal artifacts, and logging. |
Operational |