templates/databricks-multi-workspace-test.template.yaml [618:780]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  bucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:     
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: Grant Databricks Access
            Effect: Allow
            Principal:
              AWS: arn:aws:iam::414351767826:root
            Action:
              - 's3:GetObject'
              - 's3:GetObjectVersion'
              - 's3:PutObject'
              - 's3:DeleteObject'
              - 's3:ListBucket'
              - 's3:GetBucketLocation'
            Resource:
              - !Sub 'arn:${AWS::Partition}:s3:::${assetsS3Bucket}/*'
              - !Sub 'arn:${AWS::Partition}:s3:::${assetsS3Bucket}'
      Bucket: !Ref assetsS3Bucket                       

  # Databricks API for configuring notebook encryption with a customer-managed AWS KMS, if provided
  createCustomerManagedKey:
    Condition: IsKMSKeyProvided
    DependsOn: updateCustomManagedKeys
    Type: Custom::CreateCustomerManagedKey
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_CUSTOMER_MANAGED_KEY'
      accountId: !Ref AccountId
      key_arn: !Ref KeyArn
      key_alias: !Ref KeyAlias
      use_cases: !Ref KeyUseCases
      reuse_key_for_cluster_volumes: !Ref KeyReuseForClusterVolumes
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      user_agent: 'databricks-CloudFormation-provider'      

  # Databricks API for workspace credentials
  createCredentials:
    Type: Custom::CreateCredentials
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_CREDENTIALS'
      accountId: !Ref AccountId
      credentials_name: !Join
        - '-'
        - - !Ref DeploymentName
          - 'credentials'
      role_arn: !If [CustomerManagedVPC, !GetAtt 'accessRoleCustomerManagedVPC.Arn', !GetAtt 'accessRoleDBManagedVPC.Arn']
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      user_agent: 'databricks-CloudFormation-provider'      

  # Databricks API for workspace storage configuration    
  createStorageConfiguration:
    Type: Custom::CreateStorageConfigurations
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_STORAGE_CONFIGURATIONS'
      accountId: !Ref AccountId
      storage_config_name: !Join
        - '-'
        - - !Ref 'DeploymentName'
          - 'storage'
      s3bucket_name: !Ref assetsS3Bucket
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      user_agent: 'databricks-CloudFormation-provider'      

  # Databricks API for customer-managed VPC    
  createNetworks:
    DependsOn: createStorageConfiguration
    Condition: CustomerManagedVPC
    Type: Custom::createNetworks
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_NETWORKS'
      accountId: !Ref AccountId
      network_name: !Join
        - '-'
        - - !Ref 'DeploymentName'
          - 'network'
      vpc_id: !Ref VPCID
      subnet_ids: !Ref SubnetIDs
      security_group_ids: !Ref SecurityGroupIDs
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      user_agent: 'databricks-CloudFormation-provider'      

  # Databricks API for workspace creation    
  createWorkspace:
    Type: Custom::CreateWorkspace
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_WORKSPACES'
      accountId: !Ref AccountId
      workspace_name: !Join
        - '-'
        - - !Ref 'DeploymentName'
          - 'workspace'
      deployment_name: !Ref 'DeploymentName'
      aws_region: !Ref AWSRegion
      credentials_id: !GetAtt createCredentials.CredentialsId
      storage_config_id: !GetAtt createStorageConfiguration.StorageConfigId
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      network_id: !If [CustomerManagedVPC, !GetAtt 'createNetworks.NetworkId', '']
      customer_managed_key_id: !If [IsKMSKeyProvided, !GetAtt 'createCustomerManagedKey.CustomerManagedKeyId', '']
      pricing_tier: !Ref PricingTier
      hipaa_parm: !Ref HIPAAparm
      customer_name: ''
      authoritative_user_email: ''
      authoritative_user_full_name: ''
      user_agent: 'databricks-CloudFormation-provider'
  
  # Customer managed VPC - Create databricks-cross-account-iam-role-policy-sg policy 
  updateIAMSecurityGroupIds:
    Condition: CustomerManagedVPC 
    DependsOn: updateIAMRoleFunction
    Type: Custom::UpdateRoleAssumePolicy
    Properties:
      ServiceToken: !GetAtt 'updateIAMRoleFunction.Arn'
      role_name: !Ref IAMRole
      aws_region: !Ref AWSRegion
      accountId: !Ref AWS::AccountId
      security_group_ids: !Ref SecurityGroupIDs
      VPCID: !Ref VPCID

  # Customer managed Keys - Update Storage policy for S3 and EBS volumes 
  updateCustomManagedKeys:
    Condition: IsKMSKeyProvided
    DependsOn: updateKMSkeysFunction
    Type: Custom::updateCustomManagedKeys
    Properties:
      ServiceToken: !GetAtt 'updateKMSkeysFunction.Arn'
      key_id: !Ref KeyArn
      arn_credentials: !If [CreateDBManagedVPC, !GetAtt 'accessRoleDBManagedVPC.Arn', !GetAtt 'accessRoleCustomerManagedVPC.Arn']
      use_cases: !Ref KeyUseCases
      reuse_key_for_cluster_volumes: !Ref KeyReuseForClusterVolumes

  # Databricks main Lambda for all E2 objects and workspace creation
  databricksApiFunction:
    DependsOn: CopyZips
    Type: AWS::Lambda::Function
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/databricks-multi-workspace.template.yaml [618:780]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  bucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties: 
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: Grant Databricks Access
            Effect: Allow
            Principal:
              AWS: arn:aws:iam::414351767826:root
            Action:
              - 's3:GetObject'
              - 's3:GetObjectVersion'
              - 's3:PutObject'
              - 's3:DeleteObject'
              - 's3:ListBucket'
              - 's3:GetBucketLocation'
            Resource:
              - !Sub 'arn:${AWS::Partition}:s3:::${assetsS3Bucket}/*'
              - !Sub 'arn:${AWS::Partition}:s3:::${assetsS3Bucket}'
      Bucket: !Ref assetsS3Bucket 

  # Databricks API for configuring notebook encryption with a customer managed AWS KMS, if provided
  createCustomerManagedKey:
    Condition: IsKMSKeyProvided
    DependsOn: updateCustomManagedKeys
    Type: Custom::CreateCustomerManagedKey
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_CUSTOMER_MANAGED_KEY'
      accountId: !Ref AccountId
      key_arn: !Ref KeyArn
      key_alias: !Ref KeyAlias
      use_cases: !Ref KeyUseCases
      reuse_key_for_cluster_volumes: !Ref KeyReuseForClusterVolumes
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      user_agent: 'databricks-CloudFormation-provider'

  # Databricks API for workspace credentials
  createCredentials:
    Type: Custom::CreateCredentials
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_CREDENTIALS'
      accountId: !Ref AccountId
      credentials_name: !Join
        - '-'
        - - !Ref DeploymentName
          - 'credentials'
      role_arn: !If [CustomerManagedVPC, !GetAtt 'accessRoleCustomerManagedVPC.Arn', !GetAtt 'accessRoleDBManagedVPC.Arn']
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      user_agent: 'databricks-CloudFormation-provider'

  # Databricks API for workspace storage configuration
  createStorageConfiguration:
    Type: Custom::CreateStorageConfigurations
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_STORAGE_CONFIGURATIONS'
      accountId: !Ref AccountId
      storage_config_name: !Join
        - '-'
        - - !Ref 'DeploymentName'
          - 'storage'
      s3bucket_name: !Ref assetsS3Bucket
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      user_agent: 'databricks-CloudFormation-provider'

  # Databricks API for customer managed VPC
  createNetworks:
    DependsOn: createStorageConfiguration
    Condition: CustomerManagedVPC
    Type: Custom::createNetworks
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_NETWORKS'
      accountId: !Ref AccountId
      network_name: !Join
        - '-'
        - - !Ref 'DeploymentName'
          - 'network'
      vpc_id: !Ref VPCID
      subnet_ids: !Ref SubnetIDs
      security_group_ids: !Ref SecurityGroupIDs
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      user_agent: 'databricks-CloudFormation-provider'

  # Databricks API for workspace creation
  createWorkspace:
    Type: Custom::CreateWorkspace
    Properties:
      ServiceToken: !GetAtt 'databricksApiFunction.Arn'
      action: 'CREATE_WORKSPACES'
      accountId: !Ref AccountId
      workspace_name: !Join
        - '-'
        - - !Ref 'DeploymentName'
          - 'workspace'
      deployment_name: !Ref 'DeploymentName'
      aws_region: !Ref AWSRegion
      credentials_id: !GetAtt createCredentials.CredentialsId
      storage_config_id: !GetAtt createStorageConfiguration.StorageConfigId
      encodedbase64: 
        Fn::Base64: !Join
          - ':'
          - - !Ref 'Username'
            - !Ref 'Password'
      network_id: !If [CustomerManagedVPC, !GetAtt 'createNetworks.NetworkId', '']
      customer_managed_key_id: !If [IsKMSKeyProvided, !GetAtt 'createCustomerManagedKey.CustomerManagedKeyId', '']
      pricing_tier: !Ref PricingTier
      hipaa_parm: !Ref HIPAAparm
      customer_name: ''
      authoritative_user_email: ''
      authoritative_user_full_name: ''
      user_agent: 'databricks-CloudFormation-provider'
  
  # Customer managed VPC - Create databricks-cross-account-iam-role-policy-sg policy 
  updateIAMSecurityGroupIds:
    Condition: CustomerManagedVPC 
    DependsOn: updateIAMRoleFunction
    Type: Custom::UpdateRoleAssumePolicy
    Properties:
      ServiceToken: !GetAtt 'updateIAMRoleFunction.Arn'
      role_name: !Ref IAMRole
      aws_region: !Ref AWSRegion
      accountId: !Ref AWS::AccountId
      security_group_ids: !Ref SecurityGroupIDs
      VPCID: !Ref VPCID

  # Customer managed Keys - Update Storage policy for S3 and EBS volumes 
  updateCustomManagedKeys:
    Condition: IsKMSKeyProvided
    DependsOn: updateKMSkeysFunction
    Type: Custom::updateCustomManagedKeys
    Properties:
      ServiceToken: !GetAtt 'updateKMSkeysFunction.Arn'
      key_id: !Ref KeyArn
      arn_credentials: !If [CreateDBManagedVPC, !GetAtt 'accessRoleDBManagedVPC.Arn', !GetAtt 'accessRoleCustomerManagedVPC.Arn']
      use_cases: !Ref KeyUseCases
      reuse_key_for_cluster_volumes: !Ref KeyReuseForClusterVolumes

  # Databricks main Lambda for all E2 objects and workspace creation
  databricksApiFunction:
    DependsOn: CopyZips
    Type: AWS::Lambda::Function
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



