azure.databricks.WorkspaceRootDbfsCustomerManagedKey

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const current = azure.core.getClientConfig({});
const example = new azure.core.ResourceGroup("example", {
    name: "example-resources",
    location: "West Europe",
});
const exampleWorkspace = new azure.databricks.Workspace("example", {
    name: "databricks-test",
    resourceGroupName: example.name,
    location: example.location,
    sku: "premium",
    customerManagedKeyEnabled: true,
    tags: {
        Environment: "Production",
    },
});
const exampleKeyVault = new azure.keyvault.KeyVault("example", {
    name: "examplekeyvault",
    location: example.location,
    resourceGroupName: example.name,
    tenantId: current.then(current => current.tenantId),
    skuName: "premium",
    purgeProtectionEnabled: true,
    softDeleteRetentionDays: 7,
});
const terraform = new azure.keyvault.AccessPolicy("terraform", {
    keyVaultId: exampleKeyVault.id,
    tenantId: exampleKeyVault.tenantId,
    objectId: current.then(current => current.objectId),
    keyPermissions: [
        "Create",
        "Delete",
        "Get",
        "Purge",
        "Recover",
        "Update",
        "List",
        "Decrypt",
        "Sign",
        "GetRotationPolicy",
    ],
});
const exampleKey = new azure.keyvault.Key("example", {
    name: "example-certificate",
    keyVaultId: exampleKeyVault.id,
    keyType: "RSA",
    keySize: 2048,
    keyOpts: [
        "decrypt",
        "encrypt",
        "sign",
        "unwrapKey",
        "verify",
        "wrapKey",
    ],
}, {
    dependsOn: [terraform],
});
const databricks = new azure.keyvault.AccessPolicy("databricks", {
    keyVaultId: exampleKeyVault.id,
    tenantId: exampleWorkspace.storageAccountIdentities.apply(storageAccountIdentities => storageAccountIdentities[0].tenantId),
    objectId: exampleWorkspace.storageAccountIdentities.apply(storageAccountIdentities => storageAccountIdentities[0].principalId),
    keyPermissions: [
        "Create",
        "Delete",
        "Get",
        "Purge",
        "Recover",
        "Update",
        "List",
        "Decrypt",
        "Sign",
    ],
}, {
    dependsOn: [exampleWorkspace],
});
const exampleWorkspaceRootDbfsCustomerManagedKey = new azure.databricks.WorkspaceRootDbfsCustomerManagedKey("example", {
    workspaceId: exampleWorkspace.id,
    keyVaultKeyId: exampleKey.id,
}, {
    dependsOn: [databricks],
});

import pulumi
import pulumi_azure as azure

current = azure.core.get_client_config()
example = azure.core.ResourceGroup("example",
    name="example-resources",
    location="West Europe")
example_workspace = azure.databricks.Workspace("example",
    name="databricks-test",
    resource_group_name=example.name,
    location=example.location,
    sku="premium",
    customer_managed_key_enabled=True,
    tags={
        "Environment": "Production",
    })
example_key_vault = azure.keyvault.KeyVault("example",
    name="examplekeyvault",
    location=example.location,
    resource_group_name=example.name,
    tenant_id=current.tenant_id,
    sku_name="premium",
    purge_protection_enabled=True,
    soft_delete_retention_days=7)
terraform = azure.keyvault.AccessPolicy("terraform",
    key_vault_id=example_key_vault.id,
    tenant_id=example_key_vault.tenant_id,
    object_id=current.object_id,
    key_permissions=[
        "Create",
        "Delete",
        "Get",
        "Purge",
        "Recover",
        "Update",
        "List",
        "Decrypt",
        "Sign",
        "GetRotationPolicy",
    ])
example_key = azure.keyvault.Key("example",
    name="example-certificate",
    key_vault_id=example_key_vault.id,
    key_type="RSA",
    key_size=2048,
    key_opts=[
        "decrypt",
        "encrypt",
        "sign",
        "unwrapKey",
        "verify",
        "wrapKey",
    ],
    opts = pulumi.ResourceOptions(depends_on=[terraform]))
databricks = azure.keyvault.AccessPolicy("databricks",
    key_vault_id=example_key_vault.id,
    tenant_id=example_workspace.storage_account_identities[0].tenant_id,
    object_id=example_workspace.storage_account_identities[0].principal_id,
    key_permissions=[
        "Create",
        "Delete",
        "Get",
        "Purge",
        "Recover",
        "Update",
        "List",
        "Decrypt",
        "Sign",
    ],
    opts = pulumi.ResourceOptions(depends_on=[example_workspace]))
example_workspace_root_dbfs_customer_managed_key = azure.databricks.WorkspaceRootDbfsCustomerManagedKey("example",
    workspace_id=example_workspace.id,
    key_vault_key_id=example_key.id,
    opts = pulumi.ResourceOptions(depends_on=[databricks]))

package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/databricks"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/keyvault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := core.GetClientConfig(ctx, nil, nil)
		if err != nil {
			return err
		}
		example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
			Name:     pulumi.String("example-resources"),
			Location: pulumi.String("West Europe"),
		})
		if err != nil {
			return err
		}
		exampleWorkspace, err := databricks.NewWorkspace(ctx, "example", &databricks.WorkspaceArgs{
			Name:                      pulumi.String("databricks-test"),
			ResourceGroupName:         example.Name,
			Location:                  example.Location,
			Sku:                       pulumi.String("premium"),
			CustomerManagedKeyEnabled: pulumi.Bool(true),
			Tags: pulumi.StringMap{
				"Environment": pulumi.String("Production"),
			},
		})
		if err != nil {
			return err
		}
		exampleKeyVault, err := keyvault.NewKeyVault(ctx, "example", &keyvault.KeyVaultArgs{
			Name:                    pulumi.String("examplekeyvault"),
			Location:                example.Location,
			ResourceGroupName:       example.Name,
			TenantId:                pulumi.String(current.TenantId),
			SkuName:                 pulumi.String("premium"),
			PurgeProtectionEnabled:  pulumi.Bool(true),
			SoftDeleteRetentionDays: pulumi.Int(7),
		})
		if err != nil {
			return err
		}
		terraform, err := keyvault.NewAccessPolicy(ctx, "terraform", &keyvault.AccessPolicyArgs{
			KeyVaultId: exampleKeyVault.ID(),
			TenantId:   exampleKeyVault.TenantId,
			ObjectId:   pulumi.String(current.ObjectId),
			KeyPermissions: pulumi.StringArray{
				pulumi.String("Create"),
				pulumi.String("Delete"),
				pulumi.String("Get"),
				pulumi.String("Purge"),
				pulumi.String("Recover"),
				pulumi.String("Update"),
				pulumi.String("List"),
				pulumi.String("Decrypt"),
				pulumi.String("Sign"),
				pulumi.String("GetRotationPolicy"),
			},
		})
		if err != nil {
			return err
		}
		exampleKey, err := keyvault.NewKey(ctx, "example", &keyvault.KeyArgs{
			Name:       pulumi.String("example-certificate"),
			KeyVaultId: exampleKeyVault.ID(),
			KeyType:    pulumi.String("RSA"),
			KeySize:    pulumi.Int(2048),
			KeyOpts: pulumi.StringArray{
				pulumi.String("decrypt"),
				pulumi.String("encrypt"),
				pulumi.String("sign"),
				pulumi.String("unwrapKey"),
				pulumi.String("verify"),
				pulumi.String("wrapKey"),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			terraform,
		}))
		if err != nil {
			return err
		}
		databricks, err := keyvault.NewAccessPolicy(ctx, "databricks", &keyvault.AccessPolicyArgs{
			KeyVaultId: exampleKeyVault.ID(),
			TenantId: pulumi.String(exampleWorkspace.StorageAccountIdentities.ApplyT(func(storageAccountIdentities []databricks.WorkspaceStorageAccountIdentity) (*string, error) {
				return &storageAccountIdentities[0].TenantId, nil
			}).(pulumi.StringPtrOutput)),
			ObjectId: pulumi.String(exampleWorkspace.StorageAccountIdentities.ApplyT(func(storageAccountIdentities []databricks.WorkspaceStorageAccountIdentity) (*string, error) {
				return &storageAccountIdentities[0].PrincipalId, nil
			}).(pulumi.StringPtrOutput)),
			KeyPermissions: pulumi.StringArray{
				pulumi.String("Create"),
				pulumi.String("Delete"),
				pulumi.String("Get"),
				pulumi.String("Purge"),
				pulumi.String("Recover"),
				pulumi.String("Update"),
				pulumi.String("List"),
				pulumi.String("Decrypt"),
				pulumi.String("Sign"),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			exampleWorkspace,
		}))
		if err != nil {
			return err
		}
		_, err = databricks.NewWorkspaceRootDbfsCustomerManagedKey(ctx, "example", &databricks.WorkspaceRootDbfsCustomerManagedKeyArgs{
			WorkspaceId:   exampleWorkspace.ID(),
			KeyVaultKeyId: exampleKey.ID(),
		}, pulumi.DependsOn([]pulumi.Resource{
			databricks,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;

return await Deployment.RunAsync(() => 
{
    var current = Azure.Core.GetClientConfig.Invoke();

    var example = new Azure.Core.ResourceGroup("example", new()
    {
        Name = "example-resources",
        Location = "West Europe",
    });

    var exampleWorkspace = new Azure.DataBricks.Workspace("example", new()
    {
        Name = "databricks-test",
        ResourceGroupName = example.Name,
        Location = example.Location,
        Sku = "premium",
        CustomerManagedKeyEnabled = true,
        Tags = 
        {
            { "Environment", "Production" },
        },
    });

    var exampleKeyVault = new Azure.KeyVault.KeyVault("example", new()
    {
        Name = "examplekeyvault",
        Location = example.Location,
        ResourceGroupName = example.Name,
        TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
        SkuName = "premium",
        PurgeProtectionEnabled = true,
        SoftDeleteRetentionDays = 7,
    });

    var terraform = new Azure.KeyVault.AccessPolicy("terraform", new()
    {
        KeyVaultId = exampleKeyVault.Id,
        TenantId = exampleKeyVault.TenantId,
        ObjectId = current.Apply(getClientConfigResult => getClientConfigResult.ObjectId),
        KeyPermissions = new[]
        {
            "Create",
            "Delete",
            "Get",
            "Purge",
            "Recover",
            "Update",
            "List",
            "Decrypt",
            "Sign",
            "GetRotationPolicy",
        },
    });

    var exampleKey = new Azure.KeyVault.Key("example", new()
    {
        Name = "example-certificate",
        KeyVaultId = exampleKeyVault.Id,
        KeyType = "RSA",
        KeySize = 2048,
        KeyOpts = new[]
        {
            "decrypt",
            "encrypt",
            "sign",
            "unwrapKey",
            "verify",
            "wrapKey",
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            terraform,
        },
    });

    var databricks = new Azure.KeyVault.AccessPolicy("databricks", new()
    {
        KeyVaultId = exampleKeyVault.Id,
        TenantId = exampleWorkspace.StorageAccountIdentities.Apply(storageAccountIdentities => storageAccountIdentities[0].TenantId),
        ObjectId = exampleWorkspace.StorageAccountIdentities.Apply(storageAccountIdentities => storageAccountIdentities[0].PrincipalId),
        KeyPermissions = new[]
        {
            "Create",
            "Delete",
            "Get",
            "Purge",
            "Recover",
            "Update",
            "List",
            "Decrypt",
            "Sign",
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            exampleWorkspace,
        },
    });

    var exampleWorkspaceRootDbfsCustomerManagedKey = new Azure.DataBricks.WorkspaceRootDbfsCustomerManagedKey("example", new()
    {
        WorkspaceId = exampleWorkspace.Id,
        KeyVaultKeyId = exampleKey.Id,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            databricks,
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.databricks.Workspace;
import com.pulumi.azure.databricks.WorkspaceArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.AccessPolicy;
import com.pulumi.azure.keyvault.AccessPolicyArgs;
import com.pulumi.azure.keyvault.Key;
import com.pulumi.azure.keyvault.KeyArgs;
import com.pulumi.azure.databricks.WorkspaceRootDbfsCustomerManagedKey;
import com.pulumi.azure.databricks.WorkspaceRootDbfsCustomerManagedKeyArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();

        var example = new ResourceGroup("example", ResourceGroupArgs.builder()
            .name("example-resources")
            .location("West Europe")
            .build());

        var exampleWorkspace = new Workspace("exampleWorkspace", WorkspaceArgs.builder()
            .name("databricks-test")
            .resourceGroupName(example.name())
            .location(example.location())
            .sku("premium")
            .customerManagedKeyEnabled(true)
            .tags(Map.of("Environment", "Production"))
            .build());

        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .name("examplekeyvault")
            .location(example.location())
            .resourceGroupName(example.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("premium")
            .purgeProtectionEnabled(true)
            .softDeleteRetentionDays(7)
            .build());

        var terraform = new AccessPolicy("terraform", AccessPolicyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .tenantId(exampleKeyVault.tenantId())
            .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
            .keyPermissions(            
                "Create",
                "Delete",
                "Get",
                "Purge",
                "Recover",
                "Update",
                "List",
                "Decrypt",
                "Sign",
                "GetRotationPolicy")
            .build());

        var exampleKey = new Key("exampleKey", KeyArgs.builder()
            .name("example-certificate")
            .keyVaultId(exampleKeyVault.id())
            .keyType("RSA")
            .keySize(2048)
            .keyOpts(            
                "decrypt",
                "encrypt",
                "sign",
                "unwrapKey",
                "verify",
                "wrapKey")
            .build(), CustomResourceOptions.builder()
                .dependsOn(terraform)
                .build());

        var databricks = new AccessPolicy("databricks", AccessPolicyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .tenantId(exampleWorkspace.storageAccountIdentities().applyValue(storageAccountIdentities -> storageAccountIdentities[0].tenantId()))
            .objectId(exampleWorkspace.storageAccountIdentities().applyValue(storageAccountIdentities -> storageAccountIdentities[0].principalId()))
            .keyPermissions(            
                "Create",
                "Delete",
                "Get",
                "Purge",
                "Recover",
                "Update",
                "List",
                "Decrypt",
                "Sign")
            .build(), CustomResourceOptions.builder()
                .dependsOn(exampleWorkspace)
                .build());

        var exampleWorkspaceRootDbfsCustomerManagedKey = new WorkspaceRootDbfsCustomerManagedKey("exampleWorkspaceRootDbfsCustomerManagedKey", WorkspaceRootDbfsCustomerManagedKeyArgs.builder()
            .workspaceId(exampleWorkspace.id())
            .keyVaultKeyId(exampleKey.id())
            .build(), CustomResourceOptions.builder()
                .dependsOn(databricks)
                .build());

    }
}

resources:
  example:
    type: azure:core:ResourceGroup
    properties:
      name: example-resources
      location: West Europe
  exampleWorkspace:
    type: azure:databricks:Workspace
    name: example
    properties:
      name: databricks-test
      resourceGroupName: ${example.name}
      location: ${example.location}
      sku: premium
      customerManagedKeyEnabled: true
      tags:
        Environment: Production
  exampleWorkspaceRootDbfsCustomerManagedKey:
    type: azure:databricks:WorkspaceRootDbfsCustomerManagedKey
    name: example
    properties:
      workspaceId: ${exampleWorkspace.id}
      keyVaultKeyId: ${exampleKey.id}
    options:
      dependson:
        - ${databricks}
  exampleKeyVault:
    type: azure:keyvault:KeyVault
    name: example
    properties:
      name: examplekeyvault
      location: ${example.location}
      resourceGroupName: ${example.name}
      tenantId: ${current.tenantId}
      skuName: premium
      purgeProtectionEnabled: true
      softDeleteRetentionDays: 7
  exampleKey:
    type: azure:keyvault:Key
    name: example
    properties:
      name: example-certificate
      keyVaultId: ${exampleKeyVault.id}
      keyType: RSA
      keySize: 2048
      keyOpts:
        - decrypt
        - encrypt
        - sign
        - unwrapKey
        - verify
        - wrapKey
    options:
      dependson:
        - ${terraform}
  terraform:
    type: azure:keyvault:AccessPolicy
    properties:
      keyVaultId: ${exampleKeyVault.id}
      tenantId: ${exampleKeyVault.tenantId}
      objectId: ${current.objectId}
      keyPermissions:
        - Create
        - Delete
        - Get
        - Purge
        - Recover
        - Update
        - List
        - Decrypt
        - Sign
        - GetRotationPolicy
  databricks:
    type: azure:keyvault:AccessPolicy
    properties:
      keyVaultId: ${exampleKeyVault.id}
      tenantId: ${exampleWorkspace.storageAccountIdentities[0].tenantId}
      objectId: ${exampleWorkspace.storageAccountIdentities[0].principalId}
      keyPermissions:
        - Create
        - Delete
        - Get
        - Purge
        - Recover
        - Update
        - List
        - Decrypt
        - Sign
    options:
      dependson:
        - ${exampleWorkspace}
variables:
  current:
    fn::invoke:
      Function: azure:core:getClientConfig
      Arguments: {}

var workspaceRootDbfsCustomerManagedKeyResource = new Azure.DataBricks.WorkspaceRootDbfsCustomerManagedKey("workspaceRootDbfsCustomerManagedKeyResource", new()
{
    KeyVaultKeyId = "string",
    WorkspaceId = "string",
    KeyVaultId = "string",
});

example, err := databricks.NewWorkspaceRootDbfsCustomerManagedKey(ctx, "workspaceRootDbfsCustomerManagedKeyResource", &databricks.WorkspaceRootDbfsCustomerManagedKeyArgs{
	KeyVaultKeyId: pulumi.String("string"),
	WorkspaceId:   pulumi.String("string"),
	KeyVaultId:    pulumi.String("string"),
})

var workspaceRootDbfsCustomerManagedKeyResource = new WorkspaceRootDbfsCustomerManagedKey("workspaceRootDbfsCustomerManagedKeyResource", WorkspaceRootDbfsCustomerManagedKeyArgs.builder()
    .keyVaultKeyId("string")
    .workspaceId("string")
    .keyVaultId("string")
    .build());

workspace_root_dbfs_customer_managed_key_resource = azure.databricks.WorkspaceRootDbfsCustomerManagedKey("workspaceRootDbfsCustomerManagedKeyResource",
    key_vault_key_id="string",
    workspace_id="string",
    key_vault_id="string")

const workspaceRootDbfsCustomerManagedKeyResource = new azure.databricks.WorkspaceRootDbfsCustomerManagedKey("workspaceRootDbfsCustomerManagedKeyResource", {
    keyVaultKeyId: "string",
    workspaceId: "string",
    keyVaultId: "string",
});

type: azure:databricks:WorkspaceRootDbfsCustomerManagedKey
properties:
    keyVaultId: string
    keyVaultKeyId: string
    workspaceId: string