fix: Assign all listed Databricks usergroups to associated Databricks cluster policy groups (#728)

* fix: Assign all listed Databricks usergroups to associated Databricks cluster policies, refactor

* missed

* fix nesting syntax

* fix iterator

* fix result type

* fix result type

* more type conformity

* fix refs

* add output for debugging

* flatten list

* fix iterator

* ticky tick

* fix iterator

* fix ref

* use maps

* removed stale piece

* fix iterator

* refactor

* fix type

* toset

* fix typo

* remove stale code

Author: jjb007

databricks-default-cluster-policies/groups.tf

@@ -3,44 +3,46 @@ locals {
     var.policy_name_prefix,
   ])
 
-  # Define the policies with existing groups mapped to each policy
-  policies = var.policy_map
-
-  # Generate full workspace policy names by prefixing policy names
-  all_ws_policy_names = flatten([
+  policy_group_memberships = flatten([
     for prefix in local.ws_policy_name_prefixes : [
-      for policy_map in local.policies :
-      "${prefix}${keys(policy_map)[0]}"
+      for policy_suffix, groups_names in merge(var.policy_map...) : [
+        for group_name in groups_names : {
+          policy = "${prefix}${policy_suffix}",
+          group  = group_name
+        }
+      ]
     ]
   ])
 
-  # Create a flat map of policy names to associated groups
-  policy_group_map = merge([for policy_map in local.policies : policy_map]...)
+  ws_cluster_policy_names = toset(flatten([for pair in local.policy_group_memberships : pair.policy]))
+  usergroups_names        = toset(flatten([for pair in local.policy_group_memberships : pair.group]))
 }
 
 # Create Databricks groups for each policy name
-resource "databricks_group" "ws_policy_groups" {
-  for_each = toset(local.all_ws_policy_names)
+resource "databricks_group" "ws_cluster_policy_groups" {
+  for_each = local.ws_cluster_policy_names
 
   display_name     = each.key
   workspace_access = true
 }
 
-# Retrieve the existing Databricks groups that need to be assigned
-data "databricks_group" "groups" {
-  for_each = toset(flatten([
-    for group in local.policy_group_map : group
-  ]))
+# Retrieve the existing Databricks usergroups that need to be assigned
+data "databricks_group" "usergroups" {
+  for_each = local.usergroups_names
 
   display_name = each.value
 }
 
-# Assign the existing groups to the newly created policy groups
+# Assign user groups to policy groups per policy-usergroup pair
 resource "databricks_group_member" "ws_policy_group_members" {
-  for_each = databricks_group.ws_policy_groups
-
-  group_id = each.value.id
-
-  # Assign all existing groups that correspond to this policy group
-  member_id = data.databricks_group.groups[local.policy_group_map[replace(each.key, var.policy_name_prefix, "")][0]].id
+  for_each = {
+    for pair in local.policy_group_memberships :
+    "${pair.policy}+${pair.group}" => {
+      policy : pair.policy,
+      group : pair.group,
+    }
+  }
+
+  group_id  = databricks_group.ws_cluster_policy_groups[each.value.policy].id
+  member_id = data.databricks_group.usergroups[each.value.group].id
 }

databricks-default-cluster-policies/outputs.tf

@@ -0,0 +1,3 @@
+output "policy_group_memberships" {
+  value = local.policy_group_memberships
+}