templates/databricks-multi-workspace-withoutIAM.template.yaml [306:375]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  assetsS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls       : true
        BlockPublicPolicy     : true
        IgnorePublicAcls      : true
        RestrictPublicBuckets : true
      LifecycleConfiguration:
        Rules:
          - Id: DeleteContentAfter5days
            Status: Enabled
            NoncurrentVersionExpirationInDays: 5
      VersioningConfiguration:
        Status: Enabled
  bucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: Grant Databricks Access
            Effect: Allow
            Principal:
              AWS: arn:aws:iam::414351767826:root
            Action:
              - 's3:GetObject'
              - 's3:GetObjectVersion'
              - 's3:PutObject'
              - 's3:DeleteObject'
              - 's3:ListBucket'
              - 's3:GetBucketLocation'
            Resource:
              - !Sub 'arn:${AWS::Partition}:s3:::${assetsS3Bucket}/*'
              - !Sub 'arn:${AWS::Partition}:s3:::${assetsS3Bucket}'
      Bucket: !Ref assetsS3Bucket

  # Databricks API for configuring notebook encryption with a customer managed KMS, if provided
  createCustomerManagedKey:
    Condition: IsKMSKeyProvided
    DependsOn: updateCustomManagedKeys
    Type: Custom::CreateCustomerManagedKey
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_CUSTOMER_MANAGED_KEY'
      accountId: !Ref AccountId
      key_arn: !Ref KeyArn
      key_alias: !Ref KeyAlias
      use_cases: !Ref KeyUseCases
      reuse_key_for_cluster_volumes: !Ref KeyReuseForClusterVolumes
      encodedbase64:
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      user_agent: 'databricks-CloudFormation-provider'

  # Databricks API for workspace credentials
  createCredentials:
    Type: Custom::CreateCredentials
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_CREDENTIALS'
      accountId: !Ref AccountId
      credentials_name: !Join
        - '-'
        - - !Ref DeploymentName
          - 'credentials'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/databricks-multi-workspace.template.yaml [602:671]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  assetsS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls       : true
        BlockPublicPolicy     : true
        IgnorePublicAcls      : true
        RestrictPublicBuckets : true
      LifecycleConfiguration:
        Rules: 
          - Id: DeleteContentAfter5days
            Status: Enabled
            NoncurrentVersionExpirationInDays: 5
      VersioningConfiguration: 
        Status: Enabled
  bucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties: 
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: Grant Databricks Access
            Effect: Allow
            Principal:
              AWS: arn:aws:iam::414351767826:root
            Action:
              - 's3:GetObject'
              - 's3:GetObjectVersion'
              - 's3:PutObject'
              - 's3:DeleteObject'
              - 's3:ListBucket'
              - 's3:GetBucketLocation'
            Resource:
              - !Sub 'arn:${AWS::Partition}:s3:::${assetsS3Bucket}/*'
              - !Sub 'arn:${AWS::Partition}:s3:::${assetsS3Bucket}'
      Bucket: !Ref assetsS3Bucket 

  # Databricks API for configuring notebook encryption with a customer managed AWS KMS, if provided
  createCustomerManagedKey:
    Condition: IsKMSKeyProvided
    DependsOn: updateCustomManagedKeys
    Type: Custom::CreateCustomerManagedKey
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_CUSTOMER_MANAGED_KEY'
      accountId: !Ref AccountId
      key_arn: !Ref KeyArn
      key_alias: !Ref KeyAlias
      use_cases: !Ref KeyUseCases
      reuse_key_for_cluster_volumes: !Ref KeyReuseForClusterVolumes
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      user_agent: 'databricks-CloudFormation-provider'

  # Databricks API for workspace credentials
  createCredentials:
    Type: Custom::CreateCredentials
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_CREDENTIALS'
      accountId: !Ref AccountId
      credentials_name: !Join
        - '-'
        - - !Ref DeploymentName
          - 'credentials'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



