Skip to main content

Account Storage Credential

View as Markdown

AccountsGetStorageCredentialResponse object

The storage credential was successfully retrieved.

credential_infoobject
Show child attributesHide child attributes
namestring

The credential name. The name must be unique among storage and service credentials within the metastore.

aws_iam_roleobject

The AWS IAM role configuration.

Show child attributesHide child attributes
role_arnstring

The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.

unity_catalog_iam_arnstringOutput only

The Amazon Resource Name (ARN) of the AWS IAM user managed by <Databricks>. This is the identity that is going to assume the AWS IAM role.

external_idstringOutput only

The external ID used in role assumption to prevent the confused deputy problem.

azure_service_principalobject

The Azure service principal configuration.

Show child attributesHide child attributes
directory_idstring

The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.

application_idstring

The application ID of the application registration within the referenced AAD tenant.

client_secretstring

The client secret generated for the above app ID in AAD.

gcp_service_account_keyobject
Show child attributesHide child attributes
emailstring

The email of the service account.

private_key_idstring

The ID of the service account's private key.

private_keystring

The service account's RSA private key.

azure_managed_identityobject

The Azure managed identity configuration.

Show child attributesHide child attributes
access_connector_idstring

The Azure resource ID of the Azure Databricks Access Connector. Use the format /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}.

managed_identity_idstring

The Azure resource ID of the managed identity. Use the format, /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name} This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity. If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.

credential_idstringOutput only

The <Databricks> internal ID that represents this managed identity.

databricks_gcp_service_accountobject

The <Databricks> managed GCP service account configuration.

Show child attributesHide child attributes
emailstringOutput only

The email of the service account.

private_key_idstringOutput only

The ID that represents the private key for this Service Account

credential_idstringOutput only

The <Databricks> internal ID that represents this managed identity.

commentstring

Comment associated with the credential.

read_onlyboolean

Whether the credential is usable only for read operations. Only applicable when purpose is STORAGE.

ownerstring

Username of current owner of credential.

idstring

The unique identifier of the credential.

metastore_idstring

Unique identifier of the parent metastore.

created_atint64

Time at which this credential was created, in epoch milliseconds.

created_bystring

Username of credential creator.

updated_atint64

Time at which this credential was last modified, in epoch milliseconds.

updated_bystring

Username of user who last modified the credential.

used_for_managed_storageboolean

Whether this credential is the current metastore's root storage credential. Only applicable when purpose is STORAGE.

full_namestring

The full name of the credential.

isolation_modestring

Whether the current securable is accessible from all workspaces or a specific set of workspaces.

Values:

  • ISOLATION_MODE_UNSPECIFIED
  • ISOLATION_MODE_OPEN
  • ISOLATION_MODE_ISOLATED

Gets the named storage credential GA

GET /api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials/{name_arg}

Gets a storage credential from the metastore. The caller must be a metastore admin, the owner of the storage credential, or have a level of privilege on the storage credential.

API scopes: unity-catalog

Parameters

account_idstringuuidRequiredpath

<Databricks> account ID of any type. For non-E2 account types, get your account ID from the Accounts Console

metastore_idstringuuidRequiredpath

Unity Catalog metastore ID

name_argstringRequiredpath

Required. Name of the storage credential.

Response

Returns the AccountsGetStorageCredentialResponse object.

Get all storage credentials assigned to a metastore GA

GET /api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials

Gets a list of all storage credentials that have been assigned to given metastore.

API scopes: unity-catalog

Parameters

account_idstringuuidRequiredpath

<Databricks> account ID of any type. For non-E2 account types, get your account ID from the Accounts Console

metastore_idstringuuidRequiredpath

Unity Catalog metastore ID

Response

storage_credentialsarray of object

An array of metastore storage credentials.

Show child attributesHide child attributes
namestring

The credential name. The name must be unique among storage and service credentials within the metastore.

aws_iam_roleobject

The AWS IAM role configuration.

Show child attributesHide child attributes
role_arnstring

The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.

unity_catalog_iam_arnstringOutput only

The Amazon Resource Name (ARN) of the AWS IAM user managed by <Databricks>. This is the identity that is going to assume the AWS IAM role.

external_idstringOutput only

The external ID used in role assumption to prevent the confused deputy problem.

azure_service_principalobject

The Azure service principal configuration.

Show child attributesHide child attributes
directory_idstringRequired

The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.

application_idstringRequired

The application ID of the application registration within the referenced AAD tenant.

client_secretstringRequired

The client secret generated for the above app ID in AAD.

gcp_service_account_keyobject
Show child attributesHide child attributes
emailstring

The email of the service account.

private_key_idstring

The ID of the service account's private key.

private_keystring

The service account's RSA private key.

azure_managed_identityobject

The Azure managed identity configuration.

Show child attributesHide child attributes
access_connector_idstringRequired

The Azure resource ID of the Azure Databricks Access Connector. Use the format /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}.

managed_identity_idstring

The Azure resource ID of the managed identity. Use the format, /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name} This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity. If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.

credential_idstringOutput only

The <Databricks> internal ID that represents this managed identity.

databricks_gcp_service_accountobject

The <Databricks> managed GCP service account configuration.

Show child attributesHide child attributes
emailstringOutput only

The email of the service account.

private_key_idstringOutput only

The ID that represents the private key for this Service Account

credential_idstringOutput only

The <Databricks> internal ID that represents this managed identity.

commentstring

Comment associated with the credential.

read_onlyboolean

Whether the credential is usable only for read operations. Only applicable when purpose is STORAGE.

ownerstring

Username of current owner of credential.

idstring

The unique identifier of the credential.

metastore_idstring

Unique identifier of the parent metastore.

created_atint64

Time at which this credential was created, in epoch milliseconds.

created_bystring

Username of credential creator.

updated_atint64

Time at which this credential was last modified, in epoch milliseconds.

updated_bystring

Username of user who last modified the credential.

used_for_managed_storageboolean

Whether this credential is the current metastore's root storage credential. Only applicable when purpose is STORAGE.

full_namestring

The full name of the credential.

isolation_modestring

Whether the current securable is accessible from all workspaces or a specific set of workspaces.

Values:

  • ISOLATION_MODE_UNSPECIFIED
  • ISOLATION_MODE_OPEN
  • ISOLATION_MODE_ISOLATED

Create a storage credential GA

POST /api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials

Creates a new storage credential. The request object is specific to the cloud:

  • AwsIamRole for AWS credentials
  • AzureServicePrincipal for Azure credentials
  • GcpServiceAccountKey for GCP credentials

The caller must be a metastore admin and have the CREATE_STORAGE_CREDENTIAL privilege on the metastore.

API scopes: unity-catalog

Parameters

account_idstringuuidRequiredpath

<Databricks> account ID of any type. For non-E2 account types, get your account ID from the Accounts Console

metastore_idstringuuidRequiredpath

Unity Catalog metastore ID

Request body

credential_infoobject
Show child attributesHide child attributes
namestring

The credential name. The name must be unique among storage and service credentials within the metastore.

aws_iam_roleobject

The AWS IAM role configuration.

Show child attributesHide child attributes
role_arnstring

The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.

azure_service_principalobject

The Azure service principal configuration.

Show child attributesHide child attributes
directory_idstringRequired

The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.

application_idstringRequired

The application ID of the application registration within the referenced AAD tenant.

client_secretstringRequired

The client secret generated for the above app ID in AAD.

gcp_service_account_keyobject
Show child attributesHide child attributes
emailstring

The email of the service account.

private_key_idstring

The ID of the service account's private key.

private_keystring

The service account's RSA private key.

azure_managed_identityobject

The Azure managed identity configuration.

Show child attributesHide child attributes
access_connector_idstringRequired

The Azure resource ID of the Azure Databricks Access Connector. Use the format /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}.

managed_identity_idstring

The Azure resource ID of the managed identity. Use the format, /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name} This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity. If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.

databricks_gcp_service_accountobject

The <Databricks> managed GCP service account configuration.

commentstring

Comment associated with the credential.

read_onlyboolean

Whether the credential is usable only for read operations. Only applicable when purpose is STORAGE.

ownerstring

Username of current owner of credential.

idstring

The unique identifier of the credential.

metastore_idstring

Unique identifier of the parent metastore.

created_atint64

Time at which this credential was created, in epoch milliseconds.

created_bystring

Username of credential creator.

updated_atint64

Time at which this credential was last modified, in epoch milliseconds.

updated_bystring

Username of user who last modified the credential.

used_for_managed_storageboolean

Whether this credential is the current metastore's root storage credential. Only applicable when purpose is STORAGE.

full_namestring

The full name of the credential.

isolation_modestring

Whether the current securable is accessible from all workspaces or a specific set of workspaces.

Values:

  • ISOLATION_MODE_UNSPECIFIED
  • ISOLATION_MODE_OPEN
  • ISOLATION_MODE_ISOLATED
skip_validationboolean

Optional, default false. Supplying true to this argument skips validation of the created set of credentials.

Response

credential_infoobject
Show child attributesHide child attributes
namestring

The credential name. The name must be unique among storage and service credentials within the metastore.

aws_iam_roleobject

The AWS IAM role configuration.

Show child attributesHide child attributes
role_arnstring

The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.

unity_catalog_iam_arnstringOutput only

The Amazon Resource Name (ARN) of the AWS IAM user managed by <Databricks>. This is the identity that is going to assume the AWS IAM role.

external_idstringOutput only

The external ID used in role assumption to prevent the confused deputy problem.

azure_service_principalobject

The Azure service principal configuration.

Show child attributesHide child attributes
directory_idstringRequired

The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.

application_idstringRequired

The application ID of the application registration within the referenced AAD tenant.

client_secretstringRequired

The client secret generated for the above app ID in AAD.

gcp_service_account_keyobject
Show child attributesHide child attributes
emailstring

The email of the service account.

private_key_idstring

The ID of the service account's private key.

private_keystring

The service account's RSA private key.

azure_managed_identityobject

The Azure managed identity configuration.

Show child attributesHide child attributes
access_connector_idstringRequired

The Azure resource ID of the Azure Databricks Access Connector. Use the format /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}.

managed_identity_idstring

The Azure resource ID of the managed identity. Use the format, /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name} This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity. If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.

credential_idstringOutput only

The <Databricks> internal ID that represents this managed identity.

databricks_gcp_service_accountobject

The <Databricks> managed GCP service account configuration.

Show child attributesHide child attributes
emailstringOutput only

The email of the service account.

private_key_idstringOutput only

The ID that represents the private key for this Service Account

credential_idstringOutput only

The <Databricks> internal ID that represents this managed identity.

commentstring

Comment associated with the credential.

read_onlyboolean

Whether the credential is usable only for read operations. Only applicable when purpose is STORAGE.

ownerstring

Username of current owner of credential.

idstring

The unique identifier of the credential.

metastore_idstring

Unique identifier of the parent metastore.

created_atint64

Time at which this credential was created, in epoch milliseconds.

created_bystring

Username of credential creator.

updated_atint64

Time at which this credential was last modified, in epoch milliseconds.

updated_bystring

Username of user who last modified the credential.

used_for_managed_storageboolean

Whether this credential is the current metastore's root storage credential. Only applicable when purpose is STORAGE.

full_namestring

The full name of the credential.

isolation_modestring

Whether the current securable is accessible from all workspaces or a specific set of workspaces.

Values:

  • ISOLATION_MODE_UNSPECIFIED
  • ISOLATION_MODE_OPEN
  • ISOLATION_MODE_ISOLATED

Updates a storage credential GA

PUT /api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials/{name_arg}

Updates a storage credential on the metastore. The caller must be the owner of the storage credential. If the caller is a metastore admin, only the owner credential can be changed.

API scopes: unity-catalog

Parameters

account_idstringuuidRequiredpath

<Databricks> account ID of any type. For non-E2 account types, get your account ID from the Accounts Console

metastore_idstringuuidRequiredpath

Unity Catalog metastore ID

name_argstringRequiredpath

Name of the storage credential.

Request body

credential_infoobject
Show child attributesHide child attributes
namestring

The credential name. The name must be unique among storage and service credentials within the metastore.

aws_iam_roleobject

The AWS IAM role configuration.

Show child attributesHide child attributes
role_arnstring

The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.

azure_service_principalobject

The Azure service principal configuration.

Show child attributesHide child attributes
directory_idstringRequired

The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.

application_idstringRequired

The application ID of the application registration within the referenced AAD tenant.

client_secretstringRequired

The client secret generated for the above app ID in AAD.

gcp_service_account_keyobject
Show child attributesHide child attributes
emailstring

The email of the service account.

private_key_idstring

The ID of the service account's private key.

private_keystring

The service account's RSA private key.

azure_managed_identityobject

The Azure managed identity configuration.

Show child attributesHide child attributes
access_connector_idstringRequired

The Azure resource ID of the Azure Databricks Access Connector. Use the format /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}.

managed_identity_idstring

The Azure resource ID of the managed identity. Use the format, /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name} This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity. If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.

databricks_gcp_service_accountobject

The <Databricks> managed GCP service account configuration.

commentstring

Comment associated with the credential.

read_onlyboolean

Whether the credential is usable only for read operations. Only applicable when purpose is STORAGE.

ownerstring

Username of current owner of credential.

idstring

The unique identifier of the credential.

metastore_idstring

Unique identifier of the parent metastore.

created_atint64

Time at which this credential was created, in epoch milliseconds.

created_bystring

Username of credential creator.

updated_atint64

Time at which this credential was last modified, in epoch milliseconds.

updated_bystring

Username of user who last modified the credential.

used_for_managed_storageboolean

Whether this credential is the current metastore's root storage credential. Only applicable when purpose is STORAGE.

full_namestring

The full name of the credential.

isolation_modestring

Whether the current securable is accessible from all workspaces or a specific set of workspaces.

Values:

  • ISOLATION_MODE_UNSPECIFIED
  • ISOLATION_MODE_OPEN
  • ISOLATION_MODE_ISOLATED
skip_validationboolean

Optional. Supplying true to this argument skips validation of the updated set of credentials.

Response

credential_infoobject
Show child attributesHide child attributes
namestring

The credential name. The name must be unique among storage and service credentials within the metastore.

aws_iam_roleobject

The AWS IAM role configuration.

Show child attributesHide child attributes
role_arnstring

The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.

unity_catalog_iam_arnstringOutput only

The Amazon Resource Name (ARN) of the AWS IAM user managed by <Databricks>. This is the identity that is going to assume the AWS IAM role.

external_idstringOutput only

The external ID used in role assumption to prevent the confused deputy problem.

azure_service_principalobject

The Azure service principal configuration.

Show child attributesHide child attributes
directory_idstringRequired

The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.

application_idstringRequired

The application ID of the application registration within the referenced AAD tenant.

client_secretstringRequired

The client secret generated for the above app ID in AAD.

gcp_service_account_keyobject
Show child attributesHide child attributes
emailstring

The email of the service account.

private_key_idstring

The ID of the service account's private key.

private_keystring

The service account's RSA private key.

azure_managed_identityobject

The Azure managed identity configuration.

Show child attributesHide child attributes
access_connector_idstringRequired

The Azure resource ID of the Azure Databricks Access Connector. Use the format /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}.

managed_identity_idstring

The Azure resource ID of the managed identity. Use the format, /subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name} This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity. If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.

credential_idstringOutput only

The <Databricks> internal ID that represents this managed identity.

databricks_gcp_service_accountobject

The <Databricks> managed GCP service account configuration.

Show child attributesHide child attributes
emailstringOutput only

The email of the service account.

private_key_idstringOutput only

The ID that represents the private key for this Service Account

credential_idstringOutput only

The <Databricks> internal ID that represents this managed identity.

commentstring

Comment associated with the credential.

read_onlyboolean

Whether the credential is usable only for read operations. Only applicable when purpose is STORAGE.

ownerstring

Username of current owner of credential.

idstring

The unique identifier of the credential.

metastore_idstring

Unique identifier of the parent metastore.

created_atint64

Time at which this credential was created, in epoch milliseconds.

created_bystring

Username of credential creator.

updated_atint64

Time at which this credential was last modified, in epoch milliseconds.

updated_bystring

Username of user who last modified the credential.

used_for_managed_storageboolean

Whether this credential is the current metastore's root storage credential. Only applicable when purpose is STORAGE.

full_namestring

The full name of the credential.

isolation_modestring

Whether the current securable is accessible from all workspaces or a specific set of workspaces.

Values:

  • ISOLATION_MODE_UNSPECIFIED
  • ISOLATION_MODE_OPEN
  • ISOLATION_MODE_ISOLATED

Delete a storage credential GA

DELETE /api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials/{name_arg}

Deletes a storage credential from the metastore. The caller must be an owner of the storage credential.

API scopes: unity-catalog

Parameters

account_idstringuuidRequiredpath

<Databricks> account ID of any type. For non-E2 account types, get your account ID from the Accounts Console

metastore_idstringuuidRequiredpath

Unity Catalog metastore ID

name_argstringRequiredpath

Name of the storage credential.

forcebooleanquery

Force deletion even if the Storage Credential is not empty. Default is false.