databricks.getAccountFederationPolicy

Databricks v1.118.1, Oct 27 26

Viewing docs for Databricks v1.118.1
published on Tuesday, Oct 27, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-databricks

Viewing docs for Databricks v1.118.1
published on Tuesday, Oct 27, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-databricks

Example Usage

Referring to an account federation policy by id:

import * as pulumi from "@pulumi/pulumi";
import * as databricks from "@pulumi/databricks";

const myPolicy = databricks.getAccountFederationPolicy({
    policyId: "my-policy",
    oidcPolicy: {
        issuer: "https://myidp.example.com",
        subjectClaim: "sub",
    },
});

import pulumi
import pulumi_databricks as databricks

my_policy = databricks.get_account_federation_policy(policy_id="my-policy",
    oidc_policy={
        "issuer": "https://myidp.example.com",
        "subjectClaim": "sub",
    })

package main

import (
	"github.com/pulumi/pulumi-databricks/sdk/go/databricks"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := databricks.GetAccountFederationPolicy(ctx, &databricks.LookupAccountFederationPolicyArgs{
			PolicyId: "my-policy",
			OidcPolicy: map[string]string{
				"issuer":       "https://myidp.example.com",
				"subjectClaim": "sub",
			},
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Databricks = Pulumi.Databricks;

return await Deployment.RunAsync(() => 
{
    var myPolicy = Databricks.GetAccountFederationPolicy.Invoke(new()
    {
        PolicyId = "my-policy",
        OidcPolicy = 
        {
            { "issuer", "https://myidp.example.com" },
            { "subjectClaim", "sub" },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.databricks.DatabricksFunctions;
import com.pulumi.databricks.inputs.GetAccountFederationPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var myPolicy = DatabricksFunctions.getAccountFederationPolicy(GetAccountFederationPolicyArgs.builder()
            .policyId("my-policy")
            .oidcPolicy(Map.ofEntries(
                Map.entry("issuer", "https://myidp.example.com"),
                Map.entry("subjectClaim", "sub")
            ))
            .build());

    }
}

variables:
  myPolicy:
    fn::invoke:
      function: databricks:getAccountFederationPolicy
      arguments:
        policyId: my-policy
        oidcPolicy:
          issuer: https://myidp.example.com
          subjectClaim: sub

terraform {
  required_providers {
    databricks = {
      source = "pulumi/databricks"
    }
  }
}

data "databricks_account_federation_policy" "myPolicy" {
  policy_id = "my-policy"
  oidc_policy = {
    "issuer"       = "https://myidp.example.com"
    "subjectClaim" = "sub"
  }
}

Using getAccountFederationPolicy

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getAccountFederationPolicy(args: GetAccountFederationPolicyArgs, opts?: InvokeOptions): Promise<GetAccountFederationPolicyResult>
function getAccountFederationPolicyOutput(args: GetAccountFederationPolicyOutputArgs, opts?: InvokeOutputOptions): Output<GetAccountFederationPolicyResult>

def get_account_federation_policy(policy_id: Optional[str] = None,
                                  opts: Optional[InvokeOptions] = None) -> GetAccountFederationPolicyResult
def get_account_federation_policy_output(policy_id: pulumi.Input[Optional[str]] = None,
                                  opts: Optional[InvokeOutputOptions] = None) -> Output[GetAccountFederationPolicyResult]

func LookupAccountFederationPolicy(ctx *Context, args *LookupAccountFederationPolicyArgs, opts ...InvokeOption) (*LookupAccountFederationPolicyResult, error)
func LookupAccountFederationPolicyOutput(ctx *Context, args *LookupAccountFederationPolicyOutputArgs, opts ...InvokeOption) LookupAccountFederationPolicyResultOutput

> Note: This function is named LookupAccountFederationPolicy in the Go SDK.

public static class GetAccountFederationPolicy 
{
    public static Task<GetAccountFederationPolicyResult> InvokeAsync(GetAccountFederationPolicyArgs args, InvokeOptions? opts = null)
    public static Output<GetAccountFederationPolicyResult> Invoke(GetAccountFederationPolicyInvokeArgs args, InvokeOptions? opts = null)
    public static Output<GetAccountFederationPolicyResult> Invoke(GetAccountFederationPolicyInvokeArgs args, InvokeOutputOptions opts)
}

public static CompletableFuture<GetAccountFederationPolicyResult> getAccountFederationPolicy(GetAccountFederationPolicyArgs args, InvokeOptions options)
public static Output<GetAccountFederationPolicyResult> getAccountFederationPolicy(GetAccountFederationPolicyArgs args, InvokeOptions options)
public static Output<GetAccountFederationPolicyResult> getAccountFederationPolicy(GetAccountFederationPolicyArgs args, InvokeOutputOptions options)

fn::invoke:
  function: databricks:index/getAccountFederationPolicy:getAccountFederationPolicy
  arguments:
    # arguments dictionary

data "databricks_get_account_federation_policy" "name" {
    # arguments
}

The following arguments are supported:

PolicyId string: The ID of the federation policy. Output only

PolicyId string: The ID of the federation policy. Output only

policy_id string: The ID of the federation policy. Output only

policyId String: The ID of the federation policy. Output only

policyId string: The ID of the federation policy. Output only

policy_id str: The ID of the federation policy. Output only

policyId String: The ID of the federation policy. Output only

getAccountFederationPolicy Result

The following output properties are available:

CreateTime string: (string) - Creation time of the federation policy
Description string: (string) - Description of the federation policy
Name string: (string) - Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL
OidcPolicy GetAccountFederationPolicyOidcPolicy: (OidcFederationPolicy) - auditMode INCLUDE is required on both this message field and its leaf fields so the OIDC policy configuration is captured in create/update audit logs (see go/auditlogs)
PolicyId string: (string) - The ID of the federation policy. Output only
ServicePrincipalId int: (integer) - The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies
Uid string: (string) - Unique, immutable id of the federation policy
UpdateTime string: (string) - Last update time of the federation policy

CreateTime string: (string) - Creation time of the federation policy
Description string: (string) - Description of the federation policy
Name string: (string) - Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL
OidcPolicy GetAccountFederationPolicyOidcPolicy: (OidcFederationPolicy) - auditMode INCLUDE is required on both this message field and its leaf fields so the OIDC policy configuration is captured in create/update audit logs (see go/auditlogs)
PolicyId string: (string) - The ID of the federation policy. Output only
ServicePrincipalId int: (integer) - The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies
Uid string: (string) - Unique, immutable id of the federation policy
UpdateTime string: (string) - Last update time of the federation policy

create_time string: (string) - Creation time of the federation policy
description string: (string) - Description of the federation policy
name string: (string) - Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL
oidc_policy object: (OidcFederationPolicy) - auditMode INCLUDE is required on both this message field and its leaf fields so the OIDC policy configuration is captured in create/update audit logs (see go/auditlogs)
policy_id string: (string) - The ID of the federation policy. Output only
service_principal_id number: (integer) - The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies
uid string: (string) - Unique, immutable id of the federation policy
update_time string: (string) - Last update time of the federation policy

createTime String: (string) - Creation time of the federation policy
description String: (string) - Description of the federation policy
name String: (string) - Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL
oidcPolicy GetAccountFederationPolicyOidcPolicy: (OidcFederationPolicy) - auditMode INCLUDE is required on both this message field and its leaf fields so the OIDC policy configuration is captured in create/update audit logs (see go/auditlogs)
policyId String: (string) - The ID of the federation policy. Output only
servicePrincipalId Integer: (integer) - The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies
uid String: (string) - Unique, immutable id of the federation policy
updateTime String: (string) - Last update time of the federation policy

createTime string: (string) - Creation time of the federation policy
description string: (string) - Description of the federation policy
name string: (string) - Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL
oidcPolicy GetAccountFederationPolicyOidcPolicy: (OidcFederationPolicy) - auditMode INCLUDE is required on both this message field and its leaf fields so the OIDC policy configuration is captured in create/update audit logs (see go/auditlogs)
policyId string: (string) - The ID of the federation policy. Output only
servicePrincipalId number: (integer) - The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies
uid string: (string) - Unique, immutable id of the federation policy
updateTime string: (string) - Last update time of the federation policy

create_time str: (string) - Creation time of the federation policy
description str: (string) - Description of the federation policy
name str: (string) - Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL
oidc_policy GetAccountFederationPolicyOidcPolicy: (OidcFederationPolicy) - auditMode INCLUDE is required on both this message field and its leaf fields so the OIDC policy configuration is captured in create/update audit logs (see go/auditlogs)
policy_id str: (string) - The ID of the federation policy. Output only
service_principal_id int: (integer) - The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies
uid str: (string) - Unique, immutable id of the federation policy
update_time str: (string) - Last update time of the federation policy

createTime String: (string) - Creation time of the federation policy
description String: (string) - Description of the federation policy
name String: (string) - Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL
oidcPolicy Property Map: (OidcFederationPolicy) - auditMode INCLUDE is required on both this message field and its leaf fields so the OIDC policy configuration is captured in create/update audit logs (see go/auditlogs)
policyId String: (string) - The ID of the federation policy. Output only
servicePrincipalId Number: (integer) - The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies
uid String: (string) - Unique, immutable id of the federation policy
updateTime String: (string) - Last update time of the federation policy

Supporting Types

GetAccountFederationPolicyOidcPolicy

Audiences List<string>: (list of string) - The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your Databricks account id
Issuer string: (string) - The required token issuer, as specified in the 'iss' claim of federated tokens
JwksJson string: (string) - The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
JwksUri string: (string) - URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
Subject string: (string) - The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies
SubjectClaim string: (string) - The claim that contains the subject of the token. If unspecified, the default value is 'sub'

Audiences []string: (list of string) - The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your Databricks account id
Issuer string: (string) - The required token issuer, as specified in the 'iss' claim of federated tokens
JwksJson string: (string) - The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
JwksUri string: (string) - URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
Subject string: (string) - The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies
SubjectClaim string: (string) - The claim that contains the subject of the token. If unspecified, the default value is 'sub'

audiences list(string): (list of string) - The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your Databricks account id
issuer string: (string) - The required token issuer, as specified in the 'iss' claim of federated tokens
jwks_json string: (string) - The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
jwks_uri string: (string) - URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
subject string: (string) - The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies
subject_claim string: (string) - The claim that contains the subject of the token. If unspecified, the default value is 'sub'

audiences List<String>: (list of string) - The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your Databricks account id
issuer String: (string) - The required token issuer, as specified in the 'iss' claim of federated tokens
jwksJson String: (string) - The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
jwksUri String: (string) - URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
subject String: (string) - The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies
subjectClaim String: (string) - The claim that contains the subject of the token. If unspecified, the default value is 'sub'

audiences string[]: (list of string) - The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your Databricks account id
issuer string: (string) - The required token issuer, as specified in the 'iss' claim of federated tokens
jwksJson string: (string) - The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
jwksUri string: (string) - URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
subject string: (string) - The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies
subjectClaim string: (string) - The claim that contains the subject of the token. If unspecified, the default value is 'sub'

audiences Sequence[str]: (list of string) - The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your Databricks account id
issuer str: (string) - The required token issuer, as specified in the 'iss' claim of federated tokens
jwks_json str: (string) - The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
jwks_uri str: (string) - URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
subject str: (string) - The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies
subject_claim str: (string) - The claim that contains the subject of the token. If unspecified, the default value is 'sub'

audiences List<String>: (list of string) - The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your Databricks account id
issuer String: (string) - The required token issuer, as specified in the 'iss' claim of federated tokens
jwksJson String: (string) - The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
jwksUri String: (string) - URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwksUri and jwksJson are both unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys
subject String: (string) - The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies
subjectClaim String: (string) - The claim that contains the subject of the token. If unspecified, the default value is 'sub'

Package Details

Repository: databricks pulumi/pulumi-databricks
License: Apache-2.0
Notes: This Pulumi package is based on the databricks Terraform Provider.

Viewing docs for Databricks v1.118.1
published on Tuesday, Oct 27, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-databricks

databricks.getAccountFederationPolicy

On this page

On this page

Example Usage

Using getAccountFederationPolicy

getAccountFederationPolicy Result

Supporting Types

GetAccountFederationPolicyOidcPolicy

Package Details

On this page

On this page

Try Pulumi Cloud free.
Your team will thank you.

databricks.getAccountFederationPolicy

On this page

On this page

Example Usage

Using getAccountFederationPolicy

getAccountFederationPolicy Result

Supporting Types

GetAccountFederationPolicyOidcPolicy

Package Details

On this page

On this page

Try Pulumi Cloud free.Your team will thank you.

Try Pulumi Cloud free.
Your team will thank you.