# Create Accounts Storage Credential

Launch stage: GA

`POST /api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials`

Creates a new storage credential. The request object is specific to the cloud:
 - **AwsIamRole** for AWS credentials
 - **AzureServicePrincipal** for Azure credentials
 - **GcpServiceAccountKey** for GCP credentials

 The caller must be a metastore admin and have the `CREATE_STORAGE_CREDENTIAL` privilege on the metastore.

API scopes: unity-catalog

## Path parameters

- `account_id` (string, optional)
  <Databricks> account ID of any type. For non-E2 account types, get your account ID from the [Accounts Console](https://docs.databricks.com/administration-guide/account-settings/usage.html)
- `metastore_id` (string, optional)
  Unity Catalog metastore ID

## Request body

- `credential_info` (object, optional)
  - `name` (string, optional)
    The credential name. The name must be unique among storage and service
     credentials within the metastore.
  - `aws_iam_role` (object, required)
    The AWS IAM role configuration.
    - `role_arn` (string, optional)
      The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.
    - `unity_catalog_iam_arn` (string, optional)
      The Amazon Resource Name (ARN) of the AWS IAM user managed by <Databricks>.
       This is the identity that is going to assume the AWS IAM role.
    - `external_id` (string, optional)
      The external ID used in role assumption to prevent the confused deputy problem.
  - `azure_service_principal` (object, required)
    The Azure service principal configuration.
    - `directory_id` (string, optional)
      The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.
    - `application_id` (string, optional)
      The application ID of the application registration within the referenced AAD tenant.
    - `client_secret` (string, optional)
      The client secret generated for the above app ID in AAD.
  - `gcp_service_account_key` (object, required)
    - `email` (string, optional)
      The email of the service account.
    - `private_key_id` (string, optional)
      The ID of the service account's private key.
    - `private_key` (string, optional)
      The service account's RSA private key.
  - `azure_managed_identity` (object, required)
    The Azure managed identity configuration.
    - `access_connector_id` (string, optional)
      The Azure resource ID of the Azure Databricks Access Connector. Use the format
       `/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}`.
    - `managed_identity_id` (string, optional)
      The Azure resource ID of the managed identity. Use the format,
       `/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name}`
       This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity.
       If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.
    - `credential_id` (string, optional)
      The <Databricks> internal ID that represents this managed identity.
  - `databricks_gcp_service_account` (object, required)
    The <Databricks> managed GCP service account configuration.
    - `email` (string, optional)
      The email of the service account.
    - `private_key_id` (string, optional)
      The ID that represents the private key for this Service Account
    - `credential_id` (string, optional)
      The <Databricks> internal ID that represents this managed identity.
  - `comment` (string, optional)
    Comment associated with the credential.
  - `read_only` (boolean, optional)
    Whether the credential is usable only for read operations. Only applicable
     when purpose is **STORAGE**.
  - `owner` (string, optional)
    Username of current owner of credential.
  - `id` (string, optional)
    The unique identifier of the credential.
  - `metastore_id` (string, optional)
    Unique identifier of the parent metastore.
  - `created_at` (int64, optional)
    Time at which this credential was created, in epoch milliseconds.
  - `created_by` (string, optional)
    Username of credential creator.
  - `updated_at` (int64, optional)
    Time at which this credential was last modified, in epoch milliseconds.
  - `updated_by` (string, optional)
    Username of user who last modified the credential.
  - `used_for_managed_storage` (boolean, optional)
    Whether this credential is the current metastore's root storage credential.
     Only applicable when purpose is **STORAGE**.
  - `full_name` (string, optional)
    The full name of the credential.
  - `isolation_mode` (string, optional)
    Whether the current securable is accessible from all workspaces or a
     specific set of workspaces.
    Possible values: `ISOLATION_MODE_UNSPECIFIED`, `ISOLATION_MODE_OPEN`, `ISOLATION_MODE_ISOLATED`
- `skip_validation` (boolean, optional)
  Optional, default false.
   Supplying true to this argument skips validation of the created set of credentials.

## Returns

- `credential_info` (object, optional)
  - `name` (string, optional)
    The credential name. The name must be unique among storage and service
     credentials within the metastore.
  - `aws_iam_role` (object, required)
    The AWS IAM role configuration.
    - `role_arn` (string, optional)
      The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.
    - `unity_catalog_iam_arn` (string, optional)
      The Amazon Resource Name (ARN) of the AWS IAM user managed by <Databricks>.
       This is the identity that is going to assume the AWS IAM role.
    - `external_id` (string, optional)
      The external ID used in role assumption to prevent the confused deputy problem.
  - `azure_service_principal` (object, required)
    The Azure service principal configuration.
    - `directory_id` (string, optional)
      The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.
    - `application_id` (string, optional)
      The application ID of the application registration within the referenced AAD tenant.
    - `client_secret` (string, optional)
      The client secret generated for the above app ID in AAD.
  - `gcp_service_account_key` (object, required)
    - `email` (string, optional)
      The email of the service account.
    - `private_key_id` (string, optional)
      The ID of the service account's private key.
    - `private_key` (string, optional)
      The service account's RSA private key.
  - `azure_managed_identity` (object, required)
    The Azure managed identity configuration.
    - `access_connector_id` (string, optional)
      The Azure resource ID of the Azure Databricks Access Connector. Use the format
       `/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}`.
    - `managed_identity_id` (string, optional)
      The Azure resource ID of the managed identity. Use the format,
       `/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name}`
       This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity.
       If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.
    - `credential_id` (string, optional)
      The <Databricks> internal ID that represents this managed identity.
  - `databricks_gcp_service_account` (object, required)
    The <Databricks> managed GCP service account configuration.
    - `email` (string, optional)
      The email of the service account.
    - `private_key_id` (string, optional)
      The ID that represents the private key for this Service Account
    - `credential_id` (string, optional)
      The <Databricks> internal ID that represents this managed identity.
  - `comment` (string, optional)
    Comment associated with the credential.
  - `read_only` (boolean, optional)
    Whether the credential is usable only for read operations. Only applicable
     when purpose is **STORAGE**.
  - `owner` (string, optional)
    Username of current owner of credential.
  - `id` (string, optional)
    The unique identifier of the credential.
  - `metastore_id` (string, optional)
    Unique identifier of the parent metastore.
  - `created_at` (int64, optional)
    Time at which this credential was created, in epoch milliseconds.
  - `created_by` (string, optional)
    Username of credential creator.
  - `updated_at` (int64, optional)
    Time at which this credential was last modified, in epoch milliseconds.
  - `updated_by` (string, optional)
    Username of user who last modified the credential.
  - `used_for_managed_storage` (boolean, optional)
    Whether this credential is the current metastore's root storage credential.
     Only applicable when purpose is **STORAGE**.
  - `full_name` (string, optional)
    The full name of the credential.
  - `isolation_mode` (string, optional)
    Whether the current securable is accessible from all workspaces or a
     specific set of workspaces.
    Possible values: `ISOLATION_MODE_UNSPECIFIED`, `ISOLATION_MODE_OPEN`, `ISOLATION_MODE_ISOLATED`

## Response

```json
{
  "credential_info": {
    "name": "string",
    "aws_iam_role": {},
    "azure_service_principal": {},
    "gcp_service_account_key": {},
    "azure_managed_identity": {},
    "databricks_gcp_service_account": {},
    "comment": "string",
    "read_only": true,
    "owner": "string",
    "id": "string",
    "metastore_id": "string",
    "created_at": 0,
    "created_by": "string",
    "updated_at": 0,
    "updated_by": "string",
    "used_for_managed_storage": true,
    "full_name": "string",
    "isolation_mode": "string"
  }
}
```