├── aws-terragrunt-simple-mws ├── live │ ├── environments │ │ └── dev │ │ │ ├── eu-central-1 │ │ │ ├── region.hcl │ │ │ ├── bu-1 │ │ │ │ ├── business-unit.hcl │ │ │ │ ├── workspace-config │ │ │ │ │ └── terragrunt.hcl │ │ │ │ └── workspace │ │ │ │ │ └── terragrunt.hcl │ │ │ └── common │ │ │ │ ├── business-unit.hcl │ │ │ │ └── account-config │ │ │ │ └── terragrunt.hcl │ │ │ └── environment.hcl │ └── root.hcl ├── diagram.png ├── modules │ ├── account-config │ │ ├── main.tf │ │ ├── locals.tf │ │ ├── outputs.tf │ │ ├── metastore.tf │ │ ├── data.tf │ │ ├── groups.tf │ │ ├── variables.tf │ │ └── s3.tf │ ├── workspace │ │ ├── outputs.tf │ │ ├── locals.tf │ │ ├── main.tf │ │ ├── iam.tf │ │ ├── s3.tf │ │ ├── vpc.tf │ │ ├── privatelink.tf │ │ ├── workspace.tf │ │ ├── variables.tf │ │ └── data.tf │ └── workspace-config │ │ ├── system-schema.tf │ │ ├── data.tf │ │ ├── main.tf │ │ ├── catalog.tf │ │ ├── variables.tf │ │ └── compute.tf └── README.md ├── .gitignore ├── README.md └── LICENSE /aws-terragrunt-simple-mws/live/environments/dev/eu-central-1/region.hcl: -------------------------------------------------------------------------------- 1 | locals { 2 | name = "eu-central-1" 3 | } 4 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/live/environments/dev/eu-central-1/bu-1/business-unit.hcl: -------------------------------------------------------------------------------- 1 | locals { 2 | name = "bu-1" 3 | } 4 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/live/environments/dev/eu-central-1/common/business-unit.hcl: -------------------------------------------------------------------------------- 1 | locals { 2 | name = "common" 3 | } 4 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/diagram.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/alexott/dnks-terraform-lab/main/aws-terragrunt-simple-mws/diagram.png -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/live/environments/dev/environment.hcl: -------------------------------------------------------------------------------- 1 | locals { 2 | name = "dev" 3 | aws_account_id = "" # fill-in! 4 | } 5 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .terraform-version 2 | .terragrunt-version 3 | 4 | **/.dnks 5 | **/.idea 6 | 7 | **/.terragrunt-cache 8 | **/.terraform.lock.hcl 9 | **/error-signals.json -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/account-config/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | databricks = { 4 | source = "databricks/databricks" 5 | } 6 | } 7 | } 8 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/account-config/locals.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | databricks_account_admins = var.databricks_account_admins == [] ? [data.databricks_service_principal.this.id] : var.databricks_account_admins 3 | } 4 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/workspace/outputs.tf: -------------------------------------------------------------------------------- 1 | output "workspace_id" { 2 | value = databricks_mws_workspaces.this.workspace_id 3 | } 4 | 5 | output "workspace_host" { 6 | value = databricks_mws_workspaces.this.workspace_url 7 | } 8 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/workspace/locals.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | availability_zones = [ 3 | data.aws_availability_zones.this.names[0], 4 | data.aws_availability_zones.this.names[1], 5 | data.aws_availability_zones.this.names[2] 6 | ] 7 | } 8 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/workspace/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | aws = { 4 | source = "hashicorp/aws" 5 | } 6 | 7 | databricks = { 8 | source = "databricks/databricks" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/workspace-config/system-schema.tf: -------------------------------------------------------------------------------- 1 | resource "databricks_system_schema" "this" { 2 | for_each = toset(var.system_schemas) 3 | provider = databricks.workspace 4 | schema = each.value 5 | 6 | lifecycle { 7 | prevent_destroy = true 8 | } 9 | 10 | } 11 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/workspace-config/data.tf: -------------------------------------------------------------------------------- 1 | data "databricks_node_type" "smallest" { 2 | provider = databricks.workspace 3 | local_disk = true 4 | } 5 | 6 | data "databricks_spark_version" "latest-lts" { 7 | provider = databricks.workspace 8 | long_term_support = true 9 | } 10 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/workspace-config/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | databricks = { 4 | source = "databricks/databricks" 5 | } 6 | } 7 | } 8 | 9 | provider "databricks" { 10 | # authentication configured via env! 11 | alias = "workspace" 12 | host = var.workspace_host 13 | } 14 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/account-config/outputs.tf: -------------------------------------------------------------------------------- 1 | output "metastore_id" { 2 | value = databricks_metastore.this.id 3 | } 4 | 5 | output "metastore_bucket_arn" { 6 | value = aws_s3_bucket.this.arn 7 | } 8 | 9 | output "account_admin_group_id" { 10 | value = databricks_group.admin_group.id 11 | } 12 | 13 | output "account_admin_group_name" { 14 | value = databricks_group.admin_group.display_name 15 | } 16 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/account-config/metastore.tf: -------------------------------------------------------------------------------- 1 | resource "databricks_metastore" "this" { 2 | provider = databricks.mws 3 | name = "${var.prefix}-metastore" 4 | storage_root = "s3://${aws_s3_bucket.this.id}/metastore" 5 | owner = databricks_group.admin_group.display_name 6 | region = var.region 7 | force_destroy = true 8 | 9 | depends_on = [ 10 | databricks_group.admin_group, 11 | ] 12 | } 13 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # dnks-terraform-lab 2 | 3 | Curated collection of reusable Terraform snippets, samples, blueprints, examples, etc. designed 4 | to simplify and accelerate Infrastructure as Code (IaC) development. This repository aims to 5 | showcase best practices and providing modular examples for real-world infrastructure deployments. 6 | 7 | * [aws-terragrunt-simple-mws](aws-terragrunt-simple-mws) demonstrates a terragrunt setup to enable scalable databricks workspace deployments. -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/workspace/iam.tf: -------------------------------------------------------------------------------- 1 | resource "aws_iam_role" "this" { 2 | name = "${var.prefix}-crossaccount-role" 3 | assume_role_policy = data.databricks_aws_assume_role_policy.this.json 4 | tags = var.tags 5 | } 6 | 7 | 8 | resource "aws_iam_role_policy" "this" { 9 | name = "${var.prefix}-crossaccount-policy" 10 | role = aws_iam_role.this.id 11 | policy = data.databricks_aws_crossaccount_policy.this.json 12 | } 13 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/account-config/data.tf: -------------------------------------------------------------------------------- 1 | data "databricks_service_principal" "this" { 2 | provider = databricks.mws 3 | application_id = var.databricks_account_client_id 4 | } 5 | 6 | data "databricks_user" "account-admins" { 7 | provider = databricks.mws 8 | for_each = toset(concat(local.databricks_account_admins)) 9 | user_name = each.key 10 | } 11 | 12 | data "databricks_aws_bucket_policy" "this" { 13 | bucket = aws_s3_bucket.this.bucket 14 | } 15 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/workspace-config/catalog.tf: -------------------------------------------------------------------------------- 1 | resource "databricks_catalog" "this" { 2 | name = replace(var.business_unit, "-", "_") 3 | provider = databricks.workspace 4 | } 5 | 6 | resource "databricks_default_namespace_setting" "this" { 7 | provider = databricks.workspace 8 | namespace { 9 | value = databricks_catalog.this.name 10 | } 11 | } 12 | 13 | resource "databricks_grant" "this" { 14 | catalog = databricks_catalog.this.name 15 | provider = databricks.workspace 16 | principal = var.admin_group 17 | privileges = ["ALL_PRIVILEGES", "MANAGE"] 18 | } 19 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/workspace-config/variables.tf: -------------------------------------------------------------------------------- 1 | variable "business_unit" { 2 | type = string 3 | description = "Name of the BU" 4 | } 5 | 6 | variable "admin_group" { 7 | type = string 8 | description = "Name of the Databricks admin group" 9 | } 10 | 11 | variable "workspace_host" { 12 | type = string 13 | description = "Workspace Host URL" 14 | } 15 | 16 | variable "system_schemas" { 17 | type = list(string) 18 | description = "List of system schemas to enable" 19 | default = ["access", "billing", "compute", "lakeflow", "marketplace", "storage", "query", "serving"] 20 | } 21 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/account-config/groups.tf: -------------------------------------------------------------------------------- 1 | resource "databricks_group" "admin_group" { 2 | provider = databricks.mws 3 | display_name = "${var.prefix}-admins" 4 | } 5 | 6 | resource "databricks_group_member" "service-principal-admin-member" { 7 | provider = databricks.mws 8 | group_id = databricks_group.admin_group.id 9 | member_id = data.databricks_service_principal.this.id 10 | } 11 | 12 | resource "databricks_group_member" "account-admin-members" { 13 | for_each = toset(local.databricks_account_admins) 14 | provider = databricks.mws 15 | group_id = databricks_group.admin_group.id 16 | member_id = data.databricks_user.account-admins[each.value].id 17 | } 18 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/live/environments/dev/eu-central-1/common/account-config/terragrunt.hcl: -------------------------------------------------------------------------------- 1 | include "root" { 2 | path = find_in_parent_folders("root.hcl") 3 | expose = true 4 | } 5 | 6 | terraform { 7 | source = "${dirname(find_in_parent_folders("root.hcl"))}/../modules/account-config" 8 | # Deploy versions via git 9 | # source = "git::git@github.com:path/to/repo.git//path/to/module?ref=v0.0.1" 10 | } 11 | 12 | inputs = { 13 | prefix = "${include.root.locals.prefix}-dbx" 14 | region = include.root.locals.region.name 15 | tags = include.root.locals.default_tags 16 | databricks_account_id = include.root.locals.databricks_account_id 17 | databricks_account_client_id = include.root.locals.databricks_account_client_id 18 | databricks_account_admins = [] # add account-admins if required! default will use the current service-principal used for deployments 19 | } 20 | -------------------------------------------------------------------------------- /aws-terragrunt-simple-mws/modules/account-config/variables.tf: -------------------------------------------------------------------------------- 1 | variable "prefix" { 2 | type = string 3 | description = "Prefix to use for any resources" 4 | } 5 | 6 | variable "region" { 7 | type = string 8 | description = "The AWS region to deploy to" 9 | } 10 | 11 | variable "tags" { 12 | type = map(string) 13 | description = "Optional tags to add to created resources" 14 | } 15 | 16 | variable "databricks_account_id" { 17 | type = string 18 | description = "Databricks Account ID" 19 | } 20 | 21 | variable "databricks_account_client_id" { 22 | type = string 23 | description = "Service Principal Client-ID" 24 | } 25 | 26 | variable "databricks_account_admins" { 27 | type = list(string) 28 | description = <