@billowy-army-68599 you mentioned that you have a lot of regular #aws knowledge - may I ask you for help on this one around outputs? It is about the databricks topic: for an IAM role that pulumi is creating I want to

from pulumi_aws_native import iam, s3


my_bucket = s3.Bucket("my_bucket")

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "{{ role_arn }}"
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:PutBucketOwnerControl"
            ],
            "Resource": [
                "arn:aws:s3:::{{ bucket_name }}",
                "arn:aws:s3:::{{ bucket_name }}/*"
            ]
        }
    ]
}

1. attach the following policy https://docs.databricks.com/en/administration-guide/account-settings-e2/credentials.html#option-1-default-deployment-policy (I am already doing this) 2. attach a 2nd inline policy to the pulumi managed role to give S3 access to this particular bucket I am currently exploring Jinja and the JSON templates - but this is somehow getting stuck in apply/Output[T] hell for me.

i would highly recommend reading that doc in its entirety and this blog post as well https://leebriggs.co.uk/blog/2021/05/09/pulumi-apply

I was able to feed:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:PutBucketOwnerControl"
      ],
      "Resource": [
        "arn:aws:s3:::{{ bucket_name }}",
        "arn:aws:s3:::{{ bucket_name }}/*"
      ]
    }
  ]
}

I still am very curious to learn how it works in a better way. However, ideally, I can also figure out how: cannot create mws workspaces: MALFORMED_REQUEST: Failed storage configuration validation checks: List,Put,PutWithBucketOwnerFullControl,Delete is fixed. I had hoped that feeding the policy would solve this as well.

I will check this out in detail tomorrow

Do I read correctly that in principle https://github.com/jaxxstorm/pulumi-examples/blob/main/python/aws/databricks/__main__.py#L72 databricks.get_aws_bucket_policy(bucket=root_bucket.bucket) is the missing piece?

Adding the policy on the bucket with the function instead of giving the user permission with the policy seems to solve the issue - many thanks

However, when trying to add an user pulumi fails with: * cannot create user: HTTP method POST is not supported by this URL for user = User('user', user_name = 'user@mail.com', active = True, allow_cluster_create = True, opts=pulumi.ResourceOptions(depends_on=[workspace]), )

Can it be that the

<https://accounts.cloud.databricks.com>

is the wrong URL here? I.e. that the workspace would be required instead? But this would not make sense as this is an account-level operation

may I ask one more question? @billowy-army-68599 In your code you have:

cross_account_role_policy = databricks.get_aws_cross_account_policy()
cross_account_role_policy_applied = aws.iam.RolePolicy(
    "databricks-policy",
    role=iam_role.name,
    policy=cross_account_role_policy.json,
)

creds = databricks.MwsCredentials(
    f"{prefix}-{ascii_env}-db-credentials",
    credentials_name=f"{prefix}-{ascii_env}-db-credentials",
    account_id=account_id,
    role_arn=iam_role.arn,
    
)

But for me even with:

opts=pulumi.ResourceOptions(
        depends_on=[iam_role, cross_account_role_policy_applied]
    ),

specified this fails with an not yet initialized underlying IAM role. This seems to be semi-reproducible and depend on race conditions based on how quickly certain resources create. I find it strange that the dependencies defined here are not honoured. It is fixed when running pulumi up a 2nd time.

do you mean to

_ cross_account_role_policy_applied.id.apply(lamba x: x)

?

i.e. force wait for the dependency to be initiated?

Instead of sleeping an arbitrary amount - is it possible to wait explicitly only as long as required for the resource to be come defined? i.e. block the execution flow but not unnecessarily / arbitrarily long?