Warn when bundle run_as may lack file/resource access by lennartkats-db · Pull Request #7313 · databricks/cli

lennartkats-db · 2026-11-03T13:27:10Z

Changes

Warn when a bundle run_as identity may lack access to deployed files or resources. Suggest top-level CAN_VIEW, or folder-level CAN_READ for source-linked and Shared files. Top-level permissions also apply to bundle resources, including clusters (CAN_VIEW maps to CAN_ATTACH_TO).

$ databricks bundle deploy
Warning: run_as identity "sp_test" is not in bundle top-level permissions
  in databricks.yml:5:3

Add a top-level permission so this identity can access deployed files and resources:
  permissions:
    - service_principal_name: sp_test
      level: CAN_VIEW

Why

Access to a job or pipeline does not necessarily grant its run_as identity access to referenced files or resources such as clusters.

Tests

go test ./bundle/phases ./bundle/permissions -count=1
go test ./acceptance -run 'TestAccept/bundle/run_as' -count=1
go test ./acceptance -run 'TestAccept/bundle/telemetry/deploy-(experimental|run-as)' -count=1
go test ./acceptance -run 'TestAccept/bundle/migrate/command/runas/DMS=' -count=1

github-actions · 2026-11-03T13:36:27Z

Commit: dd70370de | Workflow run

Regression test report

Selected 12 changed tests (limit=20, 0 not selected)

21 tests: regression=19 unreleased=0 coverage=2 failing=0

test	branch	main (`aae07ca`)	latest (v1.23.0)
TestAccept/bundle/migrate/command/runas/DMS=	✅	❌	❌
TestAccept/bundle/run_as/DMS=	✅	❌	❌
TestAccept/bundle/run_as/DMS=true	✅	❌	❌
TestAccept/bundle/run_as/allowed/regular_user/DMS=	✅	❌	❌
TestAccept/bundle/run_as/allowed/regular_user/DMS=true	✅	❌	❌
TestAccept/bundle/run_as/allowed/service_principal/DMS=	✅	❌	❌
TestAccept/bundle/run_as/allowed/service_principal/DMS=true	✅	❌	❌
TestAccept/bundle/run_as/dashboard_embed/DMS=	✅	❌	❌
TestAccept/bundle/run_as/dashboard_embed/DMS=true	✅	❌	❌
TestAccept/bundle/run_as/empty_override/DMS=	✅	❌	❌
TestAccept/bundle/run_as/empty_override/DMS=true	✅	❌	❌
TestAccept/bundle/run_as/empty_run_as_dict/DMS=	✅	✅	✅
TestAccept/bundle/run_as/empty_run_as_dict/DMS=true	✅	✅	✅
TestAccept/bundle/run_as/pipelines/regular_user/DMS=	✅	❌	❌
TestAccept/bundle/run_as/pipelines/regular_user/DMS=true	✅	❌	❌
TestAccept/bundle/run_as/pipelines/service_principal/DMS=	✅	❌	❌
TestAccept/bundle/run_as/pipelines/service_principal/DMS=true	✅	❌	❌
TestAccept/bundle/run_as/pipelines_legacy/DMS=	✅	❌	❌
TestAccept/bundle/run_as/pipelines_legacy/DMS=true	✅	❌	❌
TestAccept/bundle/telemetry/deploy-experimental/DMS=	✅	❌	❌
TestAccept/bundle/telemetry/deploy-run-as/DMS=	✅	❌	❌

TestAccept/bundle/migrate/command/runas/DMS=: branch ✅ | main (aae07ca) ❌ | latest (v1.23.0) ❌

main (aae07ca):

acceptance_test.go:1342: Diff:
        --- bundle/migrate/command/runas/output.txt
        +++ /tmp/TestAcceptbundlemigratecommandrunasDMS=2480312248/002/output.txt
        @@ -4,14 +4,6 @@
         >>> print_requests.py //pipelines
         
         >>> print_state.py
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:22:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -29,14 +21,6 @@
         >>> [CLI] pipelines get [UUID]
         
         >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deployment migrate
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:22:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -61,14 +45,6 @@
         >>> print_state.py
         
         >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:22:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -84,14 +60,6 @@
         Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
         
         >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan -o json
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:22:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -106,14 +74,6 @@
         
         
         >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle destroy --auto-approve
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:22:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.