Access control is available only in the Premium plan (or, for customers who subscribed to Databricks before March 3, 2020, the Operational Security package).
By default, all users can create and modify clusters unless an administrator enables cluster access control. With cluster access control, permissions determine a user’s abilities. This article describes the permissions.
Before you can use cluster access control, a Databricks admin must enable it for the workspace. See Enable cluster access control for your workspace.
You can configure two types of cluster permissions:
- The Allow Cluster Creation permission controls your ability to create clusters.
- Cluster-level permissions control your ability to use and modify a specific cluster.
When cluster access control is enabled:
- An administrator can configure whether a user can create clusters.
- Any user with Can Manage permission for a cluster can configure whether a user can attach to, restart, resize, and manage that cluster.
There are four permission levels for a cluster: No Permissions, Can Attach To, Can Restart, and Can Manage. The table lists the abilities for each permission.
|Ability||No Permissions||Can Attach To||Can Restart||Can Manage|
|Attach notebook to cluster||x||x||x|
|View Spark UI||x||x||x|
|View cluster metrics||x||x||x|
|Attach library to cluster||x|
You have Can Manage permission for any cluster that you create.
This section describes how to manage permissions using the UI. You can also use the Permissions API.
Cluster access control must be enabled and you must have Can Manage permission for the cluster.
Click the clusters icon in the sidebar.
Click the icon under the Actions column of an existing cluster.
In the Permission settings for <cluster name> dialog, you can:
- Select users and groups from the Add Users and Groups drop-down and assign permission levels for them.
- Update cluster permissions for users and groups that have already been added, using the drop-down menu beside a user or group name.
One benefit of cluster access control is the ability to enforce cluster configurations so that users cannot change them.
For example, configurations that admins might want to enforce include:
- Tags to charge back costs
- IAM roles to control access to data
- Spot instances to save costs
- Standard libraries
Databricks recommends the following workflow for organizations that need to lock down cluster configurations:
Disable Allow cluster creation for all users.
After you create all of the cluster configurations that you want your users to use, give the users who need access to a given cluster Can Restart permission. This allows a user to freely start and stop the cluster without having to set up all of the configurations manually.