templates/databricks-multi-workspace-oem.template.yaml [237:324]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: String
    Default: ''
  SubnetIDs:
    Description: "At least two private-subnet IDs in your VPC, separated by commas. These subnets cannot be shared with other workspaces nor any other non-Databricks resources. Each subnet must have a netmask between /17 and /25. Subnets must be private. Subnets must have outbound access to the public network using a NAT gateway and internet gateway or similar customer-managed appliance infrastructure. The NAT gateway must be set up in its own subnet that routes quad-zero (0.0.0.0/0) traffic to an internet gateway or similar customer-managed appliance infrastructure.  Keep blank if you didn't specify VPCID. See https://docs.databricks.com/administration-guide/cloud-configurations/aws/customer-managed-vpc.html."
    Type: String 
    Default: ''
  KeyArn:
    Description: "AWS KMS key ARN to encrypt and decrypt the workspace notebooks in the control plane. Set only if using the feature customer-managed key for notebooks. See https://docs.databricks.com/security/keys/customer-managed-keys-notebook-aws.html."
    Type: String
    Default: ''
  KeyAlias:
    Description: "(Optional) AWS KMS key alias."
    Type: String
    Default: ''
  KeyUseCases:
    Description: "Enter MANAGED_SERVICES, STORAGE or BOTH to configure customer-managed encryptioon keys. Refer to https://docs.databricks.com/administration-guide/account-api/new-workspace.html#step-5-configure-customer-managed-keys-optional for details"
    Type: String   
  KeyReuseForClusterVolumes:
    Description: "True or False. Set ONLY if the use case is set to STORAGE or BOTH"
    Type: String  
  QSS3BucketName:
    Description: "S3 bucket that you created for your copy of Quick Start assets. Use this if you decide to customize the Quick Start. This bucket name can include numbers, lowercase letters, uppercase letters, and hyphens, but do not start or end with a hyphen (-)."
    AllowedPattern: '^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$'
    Default: aws-quickstart
    Type: String
    MinLength: '3'
    MaxLength: '63'
    ConstraintDescription: The Quick Start bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
  QSS3KeyPrefix:
    Description: "S3 key prefix that is used to simulate a folder for your copy of Quick Start assets. Use this if you decide to customize the Quick Start. This prefix can include numbers, lowercase letters, uppercase letters, hyphens (-), and forward slashes (/). See https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMetadata.html."
    AllowedPattern: '^[0-9a-zA-Z-/]*$'
    Type: String  
    Default: quickstart-databricks-unified-data-analytics-platform/
  

Conditions:
  # Condition to check if a VPC ID is provided by the user
  CustomerManagedVPC: !Not [!Equals [!Ref VPCID, '']]
   # Condition to check if a VPC ID is not provided by the user
  CreateDBManagedVPC: !Equals [!Ref VPCID, '']
  # Condition to check if an AWS KMS key ID is provided by the user
  IsKMSKeyProvided: !Not [!Equals [!Ref KeyArn, '']]
  # Test for STORAGE CMK use case      
  IsClusterVolumeSet: !Equals [!Ref KeyReuseForClusterVolumes, 'True']  

Rules:
# 1. Validate the selected Region from drop-down matches the Region from the Console
  RunningTemplateFromDifferentRegionThanDropDown:
    Assertions:
    - Assert: !Equals [!Ref AWSRegion, !Ref 'AWS::Region']
      AssertDescription: The region from the AWS Management Console MUST be the same as the selected region from the drop-down.

# 2. HIPAA supported regions, if HIPAA flaf is set
  SupportedHipaaRegions:
    RuleCondition: !Equals [!Ref HIPAAparm, 'Yes']
    Assertions:
    - Assert: !Contains [['us-east-1', 'us-east-2', 'ca-central-1'], !Ref AWSRegion]
      AssertDescription: Can only create a workspace for HIPAA tier accounts in the us-east-1, us-east-2 and ca-central-1 regions.

# 3. Optional section. Ensure that the SubnetIds and SecurityGroupIds are provided, if the user provides a customer-managed VPC ID
  CustomerManagedVPC:
    RuleCondition: !Not [!Equals [!Ref VPCID, '']]
    Assertions:
    - Assert: !Not [!Equals ['', !Ref SubnetIDs]]
      AssertDescription: SubnetIDs is required when VPCID is provided.
    - Assert: !Not [!Equals ['', !Ref SecurityGroupIDs]]
      AssertDescription: SecurityGroupIDs is required when VPCID is provided.

# 4. Optional Section. Ensure the KeyARN is provided when a use case is specified.
  KeyUseCases1:
    RuleCondition: !Not [!Equals [!Ref KeyArn, '']]
    Assertions:
    - Assert: !Contains [['MANAGED_SERVICES', 'STORAGE', 'BOTH'],!Ref KeyUseCases]
      AssertDescription: Valid values are MANAGED_SERVICES, STORAGE or BOTH when the role arn is provided
    
  KeyUseCases2:
    RuleCondition: !Or
      - !Equals [!Ref KeyUseCases, 'STORAGE']
      - !Equals [!Ref KeyUseCases, 'BOTH']
    Assertions:
    - Assert: !Contains [['True', 'False'], !Ref KeyReuseForClusterVolumes]
      AssertDescription: Must specify True or False when STORAGE or BOTH is selected as a use case. 
 
  KeyUseCases3:
    RuleCondition: !Equals [!Ref KeyUseCases, 'MANAGED_SERVICES']
    Assertions: 
    - Assert: !Equals [!Ref KeyReuseForClusterVolumes, '']
      AssertDescription: This value must be empty when MANAGED_SERVICES is specified
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/databricks-multi-workspace-test.template.yaml [214:301]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: String  
    Default: '' 
  SubnetIDs:
    Description: "At least two private-subnet IDs in your VPC, separated by commas. These subnets cannot be shared with other workspaces nor any other non-Databricks resources. Each subnet must have a netmask between /17 and /25. Subnets must be private. Subnets must have outbound access to the public network using a NAT gateway and internet gateway or similar customer-managed appliance infrastructure. The NAT gateway must be set up in its own subnet that routes quad-zero (0.0.0.0/0) traffic to an internet gateway or similar customer-managed appliance infrastructure. See https://docs.databricks.com/administration-guide/cloud-configurations/aws/customer-managed-vpc.html. Specify only if you have set a VPCID. Otherwise, keep blank."
    Type: String  
    Default: '' 
  KeyArn:
    Description: "AWS KMS key ARN to encrypt and decrypt the workspace notebooks in the control plane. Set only if using the feature customer-managed key for notebooks. See https://docs.databricks.com/security/keys/customer-managed-keys-notebook-aws.html."
    Type: String
    Default: ''
  KeyAlias:
    Description: "(Optional) AWS KMS key alias."
    Type: String
    Default: ''
  KeyUseCases:
    Description: "Enter MANAGED_SERVICES, STORAGE or BOTH to configure customer-managed encryptioon keys. Refer to https://docs.databricks.com/administration-guide/account-api/new-workspace.html#step-5-configure-customer-managed-keys-optional for details"
    Type: String   
  KeyReuseForClusterVolumes:
    Description: "True or False. Set ONLY if the use case is set to STORAGE or BOTH"
    Type: String
  QSS3BucketName:
    Description: "S3 bucket that you created for your copy of Quick Start assets. Use this if you decide to customize the Quick Start. This bucket name can include numbers, lowercase letters, uppercase letters, and hyphens, but do not start or end with a hyphen (-)."
    AllowedPattern: '^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$'
    Default: aws-quickstart
    Type: String
    MinLength: '3'
    MaxLength: '63'
    ConstraintDescription: The Quick Start bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
  QSS3KeyPrefix:
    Description: "S3 key prefix that is used to simulate a folder for your copy of Quick Start assets. Use this if you decide to customize the Quick Start. This prefix can include numbers, lowercase letters, uppercase letters, hyphens (-), and forward slashes (/). See https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMetadata.html."
    AllowedPattern: '^[0-9a-zA-Z-/]*$'
    Type: String  
    Default: quickstart-databricks-unified-data-analytics-platform/
  

Conditions:
# Set condition when VPC ID is provided by the user
  CustomerManagedVPC: !Not [!Equals [!Ref VPCID, '']]
# Set condition when VPC ID is NOT provided by the user
  CreateDBManagedVPC: !Equals [!Ref VPCID, '']  
# Set condition when AWS KMS key ID is provided by the user. 
  IsKMSKeyProvided: !Not [!Equals [!Ref KeyArn, '']]
# Test for STORAGE CMK use case      
  IsClusterVolumeSet: !Equals [!Ref KeyReuseForClusterVolumes, 'True']  

Rules:
# 1. Validate the selected Region from drop-down matches the Region from the Console
  RunningTemplateFromDifferentRegionThanDropDown:
    Assertions:
    - Assert: !Equals [!Ref AWSRegion, !Ref 'AWS::Region']
      AssertDescription: The region from the AWS Management Console MUST be the same as the selected region from the drop-down.

# 2. HIPAA supported regions, if HIPAA flaf is set
  SupportedHipaaRegions:
    RuleCondition: !Equals [!Ref HIPAAparm, 'Yes']
    Assertions:
    - Assert: !Contains [['us-east-1', 'us-east-2', 'ca-central-1'], !Ref AWSRegion]
      AssertDescription: Can only create a workspace for HIPAA tier accounts in the us-east-1, us-east-2 and ca-central-1 regions.

# 3. Optional section. Ensure that the SubnetIds and SecurityGroupIds are provided, if the user provides a customer-managed VPC ID
  CustomerManagedVPC:
    RuleCondition: !Not [!Equals [!Ref VPCID, '']]
    Assertions:
    - Assert: !Not [!Equals ['', !Ref SubnetIDs]]
      AssertDescription: SubnetIDs is required when VPCID is provided.
    - Assert: !Not [!Equals ['', !Ref SecurityGroupIDs]]
      AssertDescription: SecurityGroupIDs is required when VPCID is provided.

# 4. Optional Section. Ensure the KeyARN is provided when a use case is specified.
  KeyUseCases1:
    RuleCondition: !Not [!Equals [!Ref KeyArn, '']]
    Assertions:
    - Assert: !Contains [['MANAGED_SERVICES', 'STORAGE', 'BOTH'],!Ref KeyUseCases]
      AssertDescription: Valid values are MANAGED_SERVICES, STORAGE or BOTH when the role arn is provided
    
  KeyUseCases2:
    RuleCondition: !Or
      - !Equals [!Ref KeyUseCases, 'STORAGE']
      - !Equals [!Ref KeyUseCases, 'BOTH']
    Assertions:
    - Assert: !Contains [['True', 'False'], !Ref KeyReuseForClusterVolumes]
      AssertDescription: Must specify True or False when STORAGE or BOTH is selected as a use case. 
 
  KeyUseCases3:
    RuleCondition: !Equals [!Ref KeyUseCases, 'MANAGED_SERVICES']
    Assertions: 
    - Assert: !Equals [!Ref KeyReuseForClusterVolumes, '']
      AssertDescription: This value must be empty when MANAGED_SERVICES is specified
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



