Warn when bundle run_as may lack file/resource access

.nextchanges/bundles/warn-run-as-file-access.md

@@ -0,0 +1 @@
+* Warn when a bundle's `run_as` identity may lack access to deployed files, with guidance for top-level permissions and source-linked files. ([#7313](https://github.com/databricks/cli/pull/7313))

acceptance/bundle/migrate/command/runas/output.txt

@@ -4,6 +4,14 @@
 >>> print_requests.py //pipelines
 
 >>> print_state.py
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:22:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: [UUID]
+      level: CAN_VIEW
+
 Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
 If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
 
@@ -21,6 +29,14 @@ Notice: migrating your bundle to direct deployment engine (https://github.com/da
 >>> [CLI] pipelines get [UUID]
 
 >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deployment migrate
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:22:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: [UUID]
+      level: CAN_VIEW
+
 Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
 If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
 
@@ -45,6 +61,14 @@ To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/production/resou
 >>> print_state.py
 
 >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:22:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: [UUID]
+      level: CAN_VIEW
+
 Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
 If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
 
@@ -60,6 +84,14 @@ See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan -o json
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:22:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: [UUID]
+      level: CAN_VIEW
+
 Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
 If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
 
@@ -74,6 +106,14 @@ See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more
 
 
 >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle destroy --auto-approve
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:22:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: [UUID]
+      level: CAN_VIEW
+
 Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
 If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
 

acceptance/bundle/run_as/allowed/regular_user/output.txt

@@ -1,5 +1,13 @@
 
 >>> [CLI] bundle validate -o json
+Warning: run_as identity "my_service_principal" is not in bundle top-level permissions
+  in databricks.yml:5:3
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: my_service_principal
+      level: CAN_VIEW
+
 
 >>> jq .run_as
 {
@@ -38,6 +46,14 @@
 }
 
 >>> [CLI] bundle validate -o json -t development
+Warning: run_as identity "my_user_name" is not in bundle top-level permissions
+  in databricks.yml:13:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: my_user_name
+      level: CAN_VIEW
+
 
 >>> jq .run_as
 {

acceptance/bundle/run_as/allowed/service_principal/output.txt

@@ -1,5 +1,13 @@
 
 >>> [CLI] bundle validate -o json
+Warning: run_as identity "my_service_principal" is not in bundle top-level permissions
+  in databricks.yml:5:3
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: my_service_principal
+      level: CAN_VIEW
+
 
 >>> jq .run_as
 {
@@ -38,6 +46,14 @@
 }
 
 >>> [CLI] bundle validate -o json -t development
+Warning: run_as identity "my_user_name" is not in bundle top-level permissions
+  in databricks.yml:13:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: my_user_name
+      level: CAN_VIEW
+
 
 >>> jq .run_as
 {

acceptance/bundle/run_as/dashboard_embed/output.txt

@@ -1,12 +1,20 @@
 
 >>> errcode [CLI] bundle validate --var embed=false
+Warning: run_as identity "sp-name" is not in bundle top-level permissions
+  in databricks.yml:5:3
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: sp-name
+      level: CAN_VIEW
+
 Name: dashboard_embed
 Target: default
 Workspace:
   User: [USERNAME]
   Path: /Workspace/Users/[USERNAME]/.bundle/dashboard_embed/default
 
-Validation OK!
+Found 1 warning
 
 >>> errcode [CLI] bundle validate --var embed=true
 Error: dashboards with embed_credentials set to true do not support a setting a run_as user that is different from the owner.

acceptance/bundle/run_as/empty_override/output.txt

@@ -1,2 +1,10 @@
+Warning: run_as identity "my_user_name" is not in bundle top-level permissions
+  in databricks.yml:5:3
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: my_user_name
+      level: CAN_VIEW
+
         "run_as": {
   "run_as": {

acceptance/bundle/run_as/empty_override/script

@@ -1 +1 @@
-$CLI bundle validate -o json | grep run_as
+$CLI bundle validate -o json | grep '"run_as"'

acceptance/bundle/run_as/empty_run_as_dict/script

@@ -1 +1 @@
-musterr $CLI bundle validate -o json | grep run_as
+musterr $CLI bundle validate -o json | grep '"run_as"'

acceptance/bundle/run_as/output.txt

@@ -8,6 +8,14 @@ pipelines.pipeline_three: {"user_name":"user_override"}
 pipelines.pipeline_two: {"service_principal_name":"sp_override"}
 
 >>> [CLI] bundle validate -o json -t with_user_run_as
+Warning: run_as identity "user_base" is not in bundle top-level permissions
+  in databricks.yml:39:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: user_base
+      level: CAN_VIEW
+
 jobs.job_one: {"user_name":"user_base"}
 jobs.job_three: {"user_name":"user_override"}
 jobs.job_two: {"service_principal_name":"sp_override"}
@@ -16,6 +24,14 @@ pipelines.pipeline_three: {"user_name":"user_override"}
 pipelines.pipeline_two: {"service_principal_name":"sp_override"}
 
 >>> [CLI] bundle validate -o json -t with_sp_run_as
+Warning: run_as identity "sp_base" is not in bundle top-level permissions
+  in databricks.yml:43:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: sp_base
+      level: CAN_VIEW
+
 jobs.job_one: {"service_principal_name":"sp_base"}
 jobs.job_three: {"user_name":"user_override"}
 jobs.job_two: {"service_principal_name":"sp_override"}

acceptance/bundle/run_as/pipelines/regular_user/output.txt

@@ -25,21 +25,53 @@ Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 \nProcessing target: t_user_name_different
 
 >>> [CLI] bundle validate -t t_user_name_different
+Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
+  in databricks.yml:13:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: different@databricks.com
+      level: CAN_VIEW
+
 Name: run_as
 Target: t_user_name_different
 Workspace:
   User: [USERNAME]
   Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different
 
-Validation OK!
+Found 1 warning
 
 >>> [CLI] bundle plan -t t_user_name_different
+Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
+  in databricks.yml:13:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: different@databricks.com
+      level: CAN_VIEW
+
 create pipelines.nyc_taxi_pipeline
 create pipelines.nyc_taxi_pipeline.permissions
 
 Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
+Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
+  in databricks.yml:13:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: different@databricks.com
+      level: CAN_VIEW
+
 
 >>> [CLI] bundle deploy -t t_user_name_different
+Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
+  in databricks.yml:13:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: different@databricks.com
+      level: CAN_VIEW
+
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files...
 Created pipelines.nyc_taxi_pipeline
 Created pipelines.nyc_taxi_pipeline.permissions
@@ -48,21 +80,53 @@ Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 \nProcessing target: t_service_principal_name
 
 >>> [CLI] bundle validate -t t_service_principal_name
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:10:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: [UUID]
+      level: CAN_VIEW
+
 Name: run_as
 Target: t_service_principal_name
 Workspace:
   User: [USERNAME]
   Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name
 
-Validation OK!
+Found 1 warning
 
 >>> [CLI] bundle plan -t t_service_principal_name
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:10:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: [UUID]
+      level: CAN_VIEW
+
 create pipelines.nyc_taxi_pipeline
 create pipelines.nyc_taxi_pipeline.permissions
 
 Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:10:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: [UUID]
+      level: CAN_VIEW
+
 
 >>> [CLI] bundle deploy -t t_service_principal_name
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:10:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - service_principal_name: [UUID]
+      level: CAN_VIEW
+
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/files...
 Created pipelines.nyc_taxi_pipeline
 Created pipelines.nyc_taxi_pipeline.permissions
@@ -71,21 +135,53 @@ Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 \nProcessing target: t_service_principal_name_different
 
 >>> [CLI] bundle validate -t t_service_principal_name_different
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:16:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: [UUID]
+      level: CAN_VIEW
+
 Name: run_as
 Target: t_service_principal_name_different
 Workspace:
   User: [USERNAME]
   Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different
 
-Validation OK!
+Found 1 warning
 
 >>> [CLI] bundle plan -t t_service_principal_name_different
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:16:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: [UUID]
+      level: CAN_VIEW
+
 create pipelines.nyc_taxi_pipeline
 create pipelines.nyc_taxi_pipeline.permissions
 
 Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:16:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: [UUID]
+      level: CAN_VIEW
+
 
 >>> [CLI] bundle deploy -t t_service_principal_name_different
+Warning: run_as identity "[UUID]" is not in bundle top-level permissions
+  in databricks.yml:16:7
+
+Add a top-level permission so this identity can access deployed files and resources:
+  permissions:
+    - user_name: [UUID]
+      level: CAN_VIEW
+
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files...
 Created pipelines.nyc_taxi_pipeline
 Created pipelines.nyc_taxi_pipeline.permissions