databricks.MwsWorkspaces

import * as pulumi from "@pulumi/pulumi";
import * as databricks from "@pulumi/databricks";

const config = new pulumi.Config();
const databricksAccountId = config.requireObject("databricksAccountId");
const mws = new databricks.Provider("mws", {host: "https://accounts.cloud.databricks.com"});
// register cross-account ARN
const thisMwsCredentials = new databricks.MwsCredentials("thisMwsCredentials", {
    accountId: databricksAccountId,
    credentialsName: `${_var.prefix}-creds`,
    roleArn: _var.crossaccount_arn,
}, {
    provider: databricks.mws,
});
// register root bucket
const thisMwsStorageConfigurations = new databricks.MwsStorageConfigurations("thisMwsStorageConfigurations", {
    accountId: databricksAccountId,
    storageConfigurationName: `${_var.prefix}-storage`,
    bucketName: _var.root_bucket,
}, {
    provider: databricks.mws,
});
// register VPC
const thisMwsNetworks = new databricks.MwsNetworks("thisMwsNetworks", {
    accountId: databricksAccountId,
    networkName: `${_var.prefix}-network`,
    vpcId: _var.vpc_id,
    subnetIds: _var.subnets_private,
    securityGroupIds: [_var.security_group],
}, {
    provider: databricks.mws,
});
// create workspace in given VPC with DBFS on root bucket
const thisMwsWorkspaces = new databricks.MwsWorkspaces("thisMwsWorkspaces", {
    accountId: databricksAccountId,
    workspaceName: _var.prefix,
    awsRegion: _var.region,
    credentialsId: thisMwsCredentials.credentialsId,
    storageConfigurationId: thisMwsStorageConfigurations.storageConfigurationId,
    networkId: thisMwsNetworks.networkId,
    token: {},
}, {
    provider: databricks.mws,
});
export const databricksToken = thisMwsWorkspaces.token.apply(token => token?.tokenValue);

import pulumi
import pulumi_databricks as databricks

config = pulumi.Config()
databricks_account_id = config.require_object("databricksAccountId")
mws = databricks.Provider("mws", host="https://accounts.cloud.databricks.com")
# register cross-account ARN
this_mws_credentials = databricks.MwsCredentials("thisMwsCredentials",
    account_id=databricks_account_id,
    credentials_name=f"{var['prefix']}-creds",
    role_arn=var["crossaccount_arn"],
    opts=pulumi.ResourceOptions(provider=databricks["mws"]))
# register root bucket
this_mws_storage_configurations = databricks.MwsStorageConfigurations("thisMwsStorageConfigurations",
    account_id=databricks_account_id,
    storage_configuration_name=f"{var['prefix']}-storage",
    bucket_name=var["root_bucket"],
    opts=pulumi.ResourceOptions(provider=databricks["mws"]))
# register VPC
this_mws_networks = databricks.MwsNetworks("thisMwsNetworks",
    account_id=databricks_account_id,
    network_name=f"{var['prefix']}-network",
    vpc_id=var["vpc_id"],
    subnet_ids=var["subnets_private"],
    security_group_ids=[var["security_group"]],
    opts=pulumi.ResourceOptions(provider=databricks["mws"]))
# create workspace in given VPC with DBFS on root bucket
this_mws_workspaces = databricks.MwsWorkspaces("thisMwsWorkspaces",
    account_id=databricks_account_id,
    workspace_name=var["prefix"],
    aws_region=var["region"],
    credentials_id=this_mws_credentials.credentials_id,
    storage_configuration_id=this_mws_storage_configurations.storage_configuration_id,
    network_id=this_mws_networks.network_id,
    token=databricks.MwsWorkspacesTokenArgs(),
    opts=pulumi.ResourceOptions(provider=databricks["mws"]))
pulumi.export("databricksToken", this_mws_workspaces.token.token_value)

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-databricks/sdk/go/databricks"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		cfg := config.New(ctx, "")
		databricksAccountId := cfg.RequireObject("databricksAccountId")
		_, err := databricks.NewProvider(ctx, "mws", &databricks.ProviderArgs{
			Host: pulumi.String("https://accounts.cloud.databricks.com"),
		})
		if err != nil {
			return err
		}
		// register cross-account ARN
		thisMwsCredentials, err := databricks.NewMwsCredentials(ctx, "thisMwsCredentials", &databricks.MwsCredentialsArgs{
			AccountId:       pulumi.Any(databricksAccountId),
			CredentialsName: pulumi.String(fmt.Sprintf("%v-creds", _var.Prefix)),
			RoleArn:         pulumi.Any(_var.Crossaccount_arn),
		}, pulumi.Provider(databricks.Mws))
		if err != nil {
			return err
		}
		// register root bucket
		thisMwsStorageConfigurations, err := databricks.NewMwsStorageConfigurations(ctx, "thisMwsStorageConfigurations", &databricks.MwsStorageConfigurationsArgs{
			AccountId:                pulumi.Any(databricksAccountId),
			StorageConfigurationName: pulumi.String(fmt.Sprintf("%v-storage", _var.Prefix)),
			BucketName:               pulumi.Any(_var.Root_bucket),
		}, pulumi.Provider(databricks.Mws))
		if err != nil {
			return err
		}
		// register VPC
		thisMwsNetworks, err := databricks.NewMwsNetworks(ctx, "thisMwsNetworks", &databricks.MwsNetworksArgs{
			AccountId:   pulumi.Any(databricksAccountId),
			NetworkName: pulumi.String(fmt.Sprintf("%v-network", _var.Prefix)),
			VpcId:       pulumi.Any(_var.Vpc_id),
			SubnetIds:   pulumi.Any(_var.Subnets_private),
			SecurityGroupIds: pulumi.StringArray{
				_var.Security_group,
			},
		}, pulumi.Provider(databricks.Mws))
		if err != nil {
			return err
		}
		// create workspace in given VPC with DBFS on root bucket
		thisMwsWorkspaces, err := databricks.NewMwsWorkspaces(ctx, "thisMwsWorkspaces", &databricks.MwsWorkspacesArgs{
			AccountId:              pulumi.Any(databricksAccountId),
			WorkspaceName:          pulumi.Any(_var.Prefix),
			AwsRegion:              pulumi.Any(_var.Region),
			CredentialsId:          thisMwsCredentials.CredentialsId,
			StorageConfigurationId: thisMwsStorageConfigurations.StorageConfigurationId,
			NetworkId:              thisMwsNetworks.NetworkId,
			Token:                  nil,
		}, pulumi.Provider(databricks.Mws))
		if err != nil {
			return err
		}
		ctx.Export("databricksToken", thisMwsWorkspaces.Token.ApplyT(func(token databricks.MwsWorkspacesToken) (*string, error) {
			return &token.TokenValue, nil
		}).(pulumi.StringPtrOutput))
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Databricks = Pulumi.Databricks;

return await Deployment.RunAsync(() => 
{
    var config = new Config();
    var databricksAccountId = config.RequireObject<dynamic>("databricksAccountId");
    var mws = new Databricks.Provider("mws", new()
    {
        Host = "https://accounts.cloud.databricks.com",
    });

    // register cross-account ARN
    var thisMwsCredentials = new Databricks.MwsCredentials("thisMwsCredentials", new()
    {
        AccountId = databricksAccountId,
        CredentialsName = $"{@var.Prefix}-creds",
        RoleArn = @var.Crossaccount_arn,
    }, new CustomResourceOptions
    {
        Provider = databricks.Mws,
    });

    // register root bucket
    var thisMwsStorageConfigurations = new Databricks.MwsStorageConfigurations("thisMwsStorageConfigurations", new()
    {
        AccountId = databricksAccountId,
        StorageConfigurationName = $"{@var.Prefix}-storage",
        BucketName = @var.Root_bucket,
    }, new CustomResourceOptions
    {
        Provider = databricks.Mws,
    });

    // register VPC
    var thisMwsNetworks = new Databricks.MwsNetworks("thisMwsNetworks", new()
    {
        AccountId = databricksAccountId,
        NetworkName = $"{@var.Prefix}-network",
        VpcId = @var.Vpc_id,
        SubnetIds = @var.Subnets_private,
        SecurityGroupIds = new[]
        {
            @var.Security_group,
        },
    }, new CustomResourceOptions
    {
        Provider = databricks.Mws,
    });

    // create workspace in given VPC with DBFS on root bucket
    var thisMwsWorkspaces = new Databricks.MwsWorkspaces("thisMwsWorkspaces", new()
    {
        AccountId = databricksAccountId,
        WorkspaceName = @var.Prefix,
        AwsRegion = @var.Region,
        CredentialsId = thisMwsCredentials.CredentialsId,
        StorageConfigurationId = thisMwsStorageConfigurations.StorageConfigurationId,
        NetworkId = thisMwsNetworks.NetworkId,
        Token = null,
    }, new CustomResourceOptions
    {
        Provider = databricks.Mws,
    });

    return new Dictionary<string, object?>
    {
        ["databricksToken"] = thisMwsWorkspaces.Token.Apply(token => token?.TokenValue),
    };
});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.databricks.Provider;
import com.pulumi.databricks.ProviderArgs;
import com.pulumi.databricks.MwsCredentials;
import com.pulumi.databricks.MwsCredentialsArgs;
import com.pulumi.databricks.MwsStorageConfigurations;
import com.pulumi.databricks.MwsStorageConfigurationsArgs;
import com.pulumi.databricks.MwsNetworks;
import com.pulumi.databricks.MwsNetworksArgs;
import com.pulumi.databricks.MwsWorkspaces;
import com.pulumi.databricks.MwsWorkspacesArgs;
import com.pulumi.databricks.inputs.MwsWorkspacesTokenArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var config = ctx.config();
        final var databricksAccountId = config.get("databricksAccountId");
        var mws = new Provider("mws", ProviderArgs.builder()        
            .host("https://accounts.cloud.databricks.com")
            .build());

        var thisMwsCredentials = new MwsCredentials("thisMwsCredentials", MwsCredentialsArgs.builder()        
            .accountId(databricksAccountId)
            .credentialsName(String.format("%s-creds", var_.prefix()))
            .roleArn(var_.crossaccount_arn())
            .build(), CustomResourceOptions.builder()
                .provider(databricks.mws())
                .build());

        var thisMwsStorageConfigurations = new MwsStorageConfigurations("thisMwsStorageConfigurations", MwsStorageConfigurationsArgs.builder()        
            .accountId(databricksAccountId)
            .storageConfigurationName(String.format("%s-storage", var_.prefix()))
            .bucketName(var_.root_bucket())
            .build(), CustomResourceOptions.builder()
                .provider(databricks.mws())
                .build());

        var thisMwsNetworks = new MwsNetworks("thisMwsNetworks", MwsNetworksArgs.builder()        
            .accountId(databricksAccountId)
            .networkName(String.format("%s-network", var_.prefix()))
            .vpcId(var_.vpc_id())
            .subnetIds(var_.subnets_private())
            .securityGroupIds(var_.security_group())
            .build(), CustomResourceOptions.builder()
                .provider(databricks.mws())
                .build());

        var thisMwsWorkspaces = new MwsWorkspaces("thisMwsWorkspaces", MwsWorkspacesArgs.builder()        
            .accountId(databricksAccountId)
            .workspaceName(var_.prefix())
            .awsRegion(var_.region())
            .credentialsId(thisMwsCredentials.credentialsId())
            .storageConfigurationId(thisMwsStorageConfigurations.storageConfigurationId())
            .networkId(thisMwsNetworks.networkId())
            .token()
            .build(), CustomResourceOptions.builder()
                .provider(databricks.mws())
                .build());

        ctx.export("databricksToken", thisMwsWorkspaces.token().applyValue(token -> token.tokenValue()));
    }
}

configuration:
  databricksAccountId:
    type: dynamic
resources:
  mws:
    type: pulumi:providers:databricks
    properties:
      host: https://accounts.cloud.databricks.com
  # register cross-account ARN
  thisMwsCredentials:
    type: databricks:MwsCredentials
    properties:
      accountId: ${databricksAccountId}
      credentialsName: ${var.prefix}-creds
      roleArn: ${var.crossaccount_arn}
    options:
      provider: ${databricks.mws}
  # register root bucket
  thisMwsStorageConfigurations:
    type: databricks:MwsStorageConfigurations
    properties:
      accountId: ${databricksAccountId}
      storageConfigurationName: ${var.prefix}-storage
      bucketName: ${var.root_bucket}
    options:
      provider: ${databricks.mws}
  # register VPC
  thisMwsNetworks:
    type: databricks:MwsNetworks
    properties:
      accountId: ${databricksAccountId}
      networkName: ${var.prefix}-network
      vpcId: ${var.vpc_id}
      subnetIds: ${var.subnets_private}
      securityGroupIds:
        - ${var.security_group}
    options:
      provider: ${databricks.mws}
  # create workspace in given VPC with DBFS on root bucket
  thisMwsWorkspaces:
    type: databricks:MwsWorkspaces
    properties:
      accountId: ${databricksAccountId}
      workspaceName: ${var.prefix}
      awsRegion: ${var.region}
      credentialsId: ${thisMwsCredentials.credentialsId}
      storageConfigurationId: ${thisMwsStorageConfigurations.storageConfigurationId}
      networkId: ${thisMwsNetworks.networkId}
      token: {}
    options:
      provider: ${databricks.mws}
outputs:
  databricksToken: ${thisMwsWorkspaces.token.tokenValue}

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as databricks from "@pulumi/databricks";
import * as random from "@pulumi/random";

const config = new pulumi.Config();
const databricksAccountId = config.requireObject("databricksAccountId");
const naming = new random.RandomString("naming", {
    special: false,
    upper: false,
    length: 6,
});
const prefix = pulumi.interpolate`dltp${naming.result}`;
const thisAwsAssumeRolePolicy = databricks.getAwsAssumeRolePolicy({
    externalId: databricksAccountId,
});
const crossAccountRole = new aws.iam.Role("crossAccountRole", {
    assumeRolePolicy: thisAwsAssumeRolePolicy.then(thisAwsAssumeRolePolicy => thisAwsAssumeRolePolicy.json),
    tags: _var.tags,
});
const thisAwsCrossAccountPolicy = databricks.getAwsCrossAccountPolicy({});
const thisRolePolicy = new aws.iam.RolePolicy("thisRolePolicy", {
    role: crossAccountRole.id,
    policy: thisAwsCrossAccountPolicy.then(thisAwsCrossAccountPolicy => thisAwsCrossAccountPolicy.json),
});
const thisMwsCredentials = new databricks.MwsCredentials("thisMwsCredentials", {
    accountId: databricksAccountId,
    credentialsName: `${prefix}-creds`,
    roleArn: crossAccountRole.arn,
}, {
    provider: databricks.mws,
});
const rootStorageBucketBucketV2 = new aws.s3.BucketV2("rootStorageBucketBucketV2", {
    acl: "private",
    forceDestroy: true,
    tags: _var.tags,
});
const rootVersioning = new aws.s3.BucketVersioningV2("rootVersioning", {
    bucket: rootStorageBucketBucketV2.id,
    versioningConfiguration: {
        status: "Disabled",
    },
});
const rootStorageBucketBucketServerSideEncryptionConfigurationV2 = new aws.s3.BucketServerSideEncryptionConfigurationV2("rootStorageBucketBucketServerSideEncryptionConfigurationV2", {
    bucket: rootStorageBucketBucketV2.bucket,
    rules: [{
        applyServerSideEncryptionByDefault: {
            sseAlgorithm: "AES256",
        },
    }],
});
const rootStorageBucketBucketPublicAccessBlock = new aws.s3.BucketPublicAccessBlock("rootStorageBucketBucketPublicAccessBlock", {
    bucket: rootStorageBucketBucketV2.id,
    blockPublicAcls: true,
    blockPublicPolicy: true,
    ignorePublicAcls: true,
    restrictPublicBuckets: true,
}, {
    dependsOn: [rootStorageBucketBucketV2],
});
const thisAwsBucketPolicy = databricks.getAwsBucketPolicyOutput({
    bucket: rootStorageBucketBucketV2.bucket,
});
const rootBucketPolicy = new aws.s3.BucketPolicy("rootBucketPolicy", {
    bucket: rootStorageBucketBucketV2.id,
    policy: thisAwsBucketPolicy.apply(thisAwsBucketPolicy => thisAwsBucketPolicy.json),
}, {
    dependsOn: [rootStorageBucketBucketPublicAccessBlock],
});
const thisMwsStorageConfigurations = new databricks.MwsStorageConfigurations("thisMwsStorageConfigurations", {
    accountId: databricksAccountId,
    storageConfigurationName: `${prefix}-storage`,
    bucketName: rootStorageBucketBucketV2.bucket,
}, {
    provider: databricks.mws,
});
const thisMwsWorkspaces = new databricks.MwsWorkspaces("thisMwsWorkspaces", {
    accountId: databricksAccountId,
    workspaceName: prefix,
    awsRegion: "us-east-1",
    credentialsId: thisMwsCredentials.credentialsId,
    storageConfigurationId: thisMwsStorageConfigurations.storageConfigurationId,
    token: {},
    customTags: {
        SoldToCode: "1234",
    },
}, {
    provider: databricks.mws,
});
export const databricksToken = thisMwsWorkspaces.token.apply(token => token?.tokenValue);

import pulumi
import pulumi_aws as aws
import pulumi_databricks as databricks
import pulumi_random as random

config = pulumi.Config()
databricks_account_id = config.require_object("databricksAccountId")
naming = random.RandomString("naming",
    special=False,
    upper=False,
    length=6)
prefix = naming.result.apply(lambda result: f"dltp{result}")
this_aws_assume_role_policy = databricks.get_aws_assume_role_policy(external_id=databricks_account_id)
cross_account_role = aws.iam.Role("crossAccountRole",
    assume_role_policy=this_aws_assume_role_policy.json,
    tags=var["tags"])
this_aws_cross_account_policy = databricks.get_aws_cross_account_policy()
this_role_policy = aws.iam.RolePolicy("thisRolePolicy",
    role=cross_account_role.id,
    policy=this_aws_cross_account_policy.json)
this_mws_credentials = databricks.MwsCredentials("thisMwsCredentials",
    account_id=databricks_account_id,
    credentials_name=f"{prefix}-creds",
    role_arn=cross_account_role.arn,
    opts=pulumi.ResourceOptions(provider=databricks["mws"]))
root_storage_bucket_bucket_v2 = aws.s3.BucketV2("rootStorageBucketBucketV2",
    acl="private",
    force_destroy=True,
    tags=var["tags"])
root_versioning = aws.s3.BucketVersioningV2("rootVersioning",
    bucket=root_storage_bucket_bucket_v2.id,
    versioning_configuration=aws.s3.BucketVersioningV2VersioningConfigurationArgs(
        status="Disabled",
    ))
root_storage_bucket_bucket_server_side_encryption_configuration_v2 = aws.s3.BucketServerSideEncryptionConfigurationV2("rootStorageBucketBucketServerSideEncryptionConfigurationV2",
    bucket=root_storage_bucket_bucket_v2.bucket,
    rules=[aws.s3.BucketServerSideEncryptionConfigurationV2RuleArgs(
        apply_server_side_encryption_by_default=aws.s3.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs(
            sse_algorithm="AES256",
        ),
    )])
root_storage_bucket_bucket_public_access_block = aws.s3.BucketPublicAccessBlock("rootStorageBucketBucketPublicAccessBlock",
    bucket=root_storage_bucket_bucket_v2.id,
    block_public_acls=True,
    block_public_policy=True,
    ignore_public_acls=True,
    restrict_public_buckets=True,
    opts=pulumi.ResourceOptions(depends_on=[root_storage_bucket_bucket_v2]))
this_aws_bucket_policy = databricks.get_aws_bucket_policy_output(bucket=root_storage_bucket_bucket_v2.bucket)
root_bucket_policy = aws.s3.BucketPolicy("rootBucketPolicy",
    bucket=root_storage_bucket_bucket_v2.id,
    policy=this_aws_bucket_policy.json,
    opts=pulumi.ResourceOptions(depends_on=[root_storage_bucket_bucket_public_access_block]))
this_mws_storage_configurations = databricks.MwsStorageConfigurations("thisMwsStorageConfigurations",
    account_id=databricks_account_id,
    storage_configuration_name=f"{prefix}-storage",
    bucket_name=root_storage_bucket_bucket_v2.bucket,
    opts=pulumi.ResourceOptions(provider=databricks["mws"]))
this_mws_workspaces = databricks.MwsWorkspaces("thisMwsWorkspaces",
    account_id=databricks_account_id,
    workspace_name=prefix,
    aws_region="us-east-1",
    credentials_id=this_mws_credentials.credentials_id,
    storage_configuration_id=this_mws_storage_configurations.storage_configuration_id,
    token=databricks.MwsWorkspacesTokenArgs(),
    custom_tags={
        "SoldToCode": "1234",
    },
    opts=pulumi.ResourceOptions(provider=databricks["mws"]))
pulumi.export("databricksToken", this_mws_workspaces.token.token_value)

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/iam"
	"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/s3"
	"github.com/pulumi/pulumi-databricks/sdk/go/databricks"
	"github.com/pulumi/pulumi-random/sdk/v4/go/random"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		cfg := config.New(ctx, "")
		databricksAccountId := cfg.RequireObject("databricksAccountId")
		naming, err := random.NewRandomString(ctx, "naming", &random.RandomStringArgs{
			Special: pulumi.Bool(false),
			Upper:   pulumi.Bool(false),
			Length:  pulumi.Int(6),
		})
		if err != nil {
			return err
		}
		prefix := naming.Result.ApplyT(func(result string) (string, error) {
			return fmt.Sprintf("dltp%v", result), nil
		}).(pulumi.StringOutput)
		thisAwsAssumeRolePolicy, err := databricks.GetAwsAssumeRolePolicy(ctx, &databricks.GetAwsAssumeRolePolicyArgs{
			ExternalId: databricksAccountId,
		}, nil)
		if err != nil {
			return err
		}
		crossAccountRole, err := iam.NewRole(ctx, "crossAccountRole", &iam.RoleArgs{
			AssumeRolePolicy: pulumi.String(thisAwsAssumeRolePolicy.Json),
			Tags:             pulumi.Any(_var.Tags),
		})
		if err != nil {
			return err
		}
		thisAwsCrossAccountPolicy, err := databricks.GetAwsCrossAccountPolicy(ctx, nil, nil)
		if err != nil {
			return err
		}
		_, err = iam.NewRolePolicy(ctx, "thisRolePolicy", &iam.RolePolicyArgs{
			Role:   crossAccountRole.ID(),
			Policy: pulumi.String(thisAwsCrossAccountPolicy.Json),
		})
		if err != nil {
			return err
		}
		thisMwsCredentials, err := databricks.NewMwsCredentials(ctx, "thisMwsCredentials", &databricks.MwsCredentialsArgs{
			AccountId:       pulumi.Any(databricksAccountId),
			CredentialsName: pulumi.String(fmt.Sprintf("%v-creds", prefix)),
			RoleArn:         crossAccountRole.Arn,
		}, pulumi.Provider(databricks.Mws))
		if err != nil {
			return err
		}
		rootStorageBucketBucketV2, err := s3.NewBucketV2(ctx, "rootStorageBucketBucketV2", &s3.BucketV2Args{
			Acl:          pulumi.String("private"),
			ForceDestroy: pulumi.Bool(true),
			Tags:         pulumi.Any(_var.Tags),
		})
		if err != nil {
			return err
		}
		_, err = s3.NewBucketVersioningV2(ctx, "rootVersioning", &s3.BucketVersioningV2Args{
			Bucket: rootStorageBucketBucketV2.ID(),
			VersioningConfiguration: &s3.BucketVersioningV2VersioningConfigurationArgs{
				Status: pulumi.String("Disabled"),
			},
		})
		if err != nil {
			return err
		}
		_, err = s3.NewBucketServerSideEncryptionConfigurationV2(ctx, "rootStorageBucketBucketServerSideEncryptionConfigurationV2", &s3.BucketServerSideEncryptionConfigurationV2Args{
			Bucket: rootStorageBucketBucketV2.Bucket,
			Rules: s3.BucketServerSideEncryptionConfigurationV2RuleArray{
				&s3.BucketServerSideEncryptionConfigurationV2RuleArgs{
					ApplyServerSideEncryptionByDefault: &s3.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs{
						SseAlgorithm: pulumi.String("AES256"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		rootStorageBucketBucketPublicAccessBlock, err := s3.NewBucketPublicAccessBlock(ctx, "rootStorageBucketBucketPublicAccessBlock", &s3.BucketPublicAccessBlockArgs{
			Bucket:                rootStorageBucketBucketV2.ID(),
			BlockPublicAcls:       pulumi.Bool(true),
			BlockPublicPolicy:     pulumi.Bool(true),
			IgnorePublicAcls:      pulumi.Bool(true),
			RestrictPublicBuckets: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			rootStorageBucketBucketV2,
		}))
		if err != nil {
			return err
		}
		thisAwsBucketPolicy := databricks.GetAwsBucketPolicyOutput(ctx, databricks.GetAwsBucketPolicyOutputArgs{
			Bucket: rootStorageBucketBucketV2.Bucket,
		}, nil)
		_, err = s3.NewBucketPolicy(ctx, "rootBucketPolicy", &s3.BucketPolicyArgs{
			Bucket: rootStorageBucketBucketV2.ID(),
			Policy: thisAwsBucketPolicy.ApplyT(func(thisAwsBucketPolicy databricks.GetAwsBucketPolicyResult) (*string, error) {
				return &thisAwsBucketPolicy.Json, nil
			}).(pulumi.StringPtrOutput),
		}, pulumi.DependsOn([]pulumi.Resource{
			rootStorageBucketBucketPublicAccessBlock,
		}))
		if err != nil {
			return err
		}
		thisMwsStorageConfigurations, err := databricks.NewMwsStorageConfigurations(ctx, "thisMwsStorageConfigurations", &databricks.MwsStorageConfigurationsArgs{
			AccountId:                pulumi.Any(databricksAccountId),
			StorageConfigurationName: pulumi.String(fmt.Sprintf("%v-storage", prefix)),
			BucketName:               rootStorageBucketBucketV2.Bucket,
		}, pulumi.Provider(databricks.Mws))
		if err != nil {
			return err
		}
		thisMwsWorkspaces, err := databricks.NewMwsWorkspaces(ctx, "thisMwsWorkspaces", &databricks.MwsWorkspacesArgs{
			AccountId:              pulumi.Any(databricksAccountId),
			WorkspaceName:          pulumi.String(prefix),
			AwsRegion:              pulumi.String("us-east-1"),
			CredentialsId:          thisMwsCredentials.CredentialsId,
			StorageConfigurationId: thisMwsStorageConfigurations.StorageConfigurationId,
			Token:                  nil,
			CustomTags: pulumi.Map{
				"SoldToCode": pulumi.Any("1234"),
			},
		}, pulumi.Provider(databricks.Mws))
		if err != nil {
			return err
		}
		ctx.Export("databricksToken", thisMwsWorkspaces.Token.ApplyT(func(token databricks.MwsWorkspacesToken) (*string, error) {
			return &token.TokenValue, nil
		}).(pulumi.StringPtrOutput))
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
using Databricks = Pulumi.Databricks;
using Random = Pulumi.Random;

return await Deployment.RunAsync(() => 
{
    var config = new Config();
    var databricksAccountId = config.RequireObject<dynamic>("databricksAccountId");
    var naming = new Random.RandomString("naming", new()
    {
        Special = false,
        Upper = false,
        Length = 6,
    });

    var prefix = naming.Result.Apply(result => $"dltp{result}");

    var thisAwsAssumeRolePolicy = Databricks.GetAwsAssumeRolePolicy.Invoke(new()
    {
        ExternalId = databricksAccountId,
    });

    var crossAccountRole = new Aws.Iam.Role("crossAccountRole", new()
    {
        AssumeRolePolicy = thisAwsAssumeRolePolicy.Apply(getAwsAssumeRolePolicyResult => getAwsAssumeRolePolicyResult.Json),
        Tags = @var.Tags,
    });

    var thisAwsCrossAccountPolicy = Databricks.GetAwsCrossAccountPolicy.Invoke();

    var thisRolePolicy = new Aws.Iam.RolePolicy("thisRolePolicy", new()
    {
        Role = crossAccountRole.Id,
        Policy = thisAwsCrossAccountPolicy.Apply(getAwsCrossAccountPolicyResult => getAwsCrossAccountPolicyResult.Json),
    });

    var thisMwsCredentials = new Databricks.MwsCredentials("thisMwsCredentials", new()
    {
        AccountId = databricksAccountId,
        CredentialsName = $"{prefix}-creds",
        RoleArn = crossAccountRole.Arn,
    }, new CustomResourceOptions
    {
        Provider = databricks.Mws,
    });

    var rootStorageBucketBucketV2 = new Aws.S3.BucketV2("rootStorageBucketBucketV2", new()
    {
        Acl = "private",
        ForceDestroy = true,
        Tags = @var.Tags,
    });

    var rootVersioning = new Aws.S3.BucketVersioningV2("rootVersioning", new()
    {
        Bucket = rootStorageBucketBucketV2.Id,
        VersioningConfiguration = new Aws.S3.Inputs.BucketVersioningV2VersioningConfigurationArgs
        {
            Status = "Disabled",
        },
    });

    var rootStorageBucketBucketServerSideEncryptionConfigurationV2 = new Aws.S3.BucketServerSideEncryptionConfigurationV2("rootStorageBucketBucketServerSideEncryptionConfigurationV2", new()
    {
        Bucket = rootStorageBucketBucketV2.Bucket,
        Rules = new[]
        {
            new Aws.S3.Inputs.BucketServerSideEncryptionConfigurationV2RuleArgs
            {
                ApplyServerSideEncryptionByDefault = new Aws.S3.Inputs.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs
                {
                    SseAlgorithm = "AES256",
                },
            },
        },
    });

    var rootStorageBucketBucketPublicAccessBlock = new Aws.S3.BucketPublicAccessBlock("rootStorageBucketBucketPublicAccessBlock", new()
    {
        Bucket = rootStorageBucketBucketV2.Id,
        BlockPublicAcls = true,
        BlockPublicPolicy = true,
        IgnorePublicAcls = true,
        RestrictPublicBuckets = true,
    }, new CustomResourceOptions
    {
        DependsOn = new[]
        {
            rootStorageBucketBucketV2,
        },
    });

    var thisAwsBucketPolicy = Databricks.GetAwsBucketPolicy.Invoke(new()
    {
        Bucket = rootStorageBucketBucketV2.Bucket,
    });

    var rootBucketPolicy = new Aws.S3.BucketPolicy("rootBucketPolicy", new()
    {
        Bucket = rootStorageBucketBucketV2.Id,
        Policy = thisAwsBucketPolicy.Apply(getAwsBucketPolicyResult => getAwsBucketPolicyResult.Json),
    }, new CustomResourceOptions
    {
        DependsOn = new[]
        {
            rootStorageBucketBucketPublicAccessBlock,
        },
    });

    var thisMwsStorageConfigurations = new Databricks.MwsStorageConfigurations("thisMwsStorageConfigurations", new()
    {
        AccountId = databricksAccountId,
        StorageConfigurationName = $"{prefix}-storage",
        BucketName = rootStorageBucketBucketV2.Bucket,
    }, new CustomResourceOptions
    {
        Provider = databricks.Mws,
    });

    var thisMwsWorkspaces = new Databricks.MwsWorkspaces("thisMwsWorkspaces", new()
    {
        AccountId = databricksAccountId,
        WorkspaceName = prefix,
        AwsRegion = "us-east-1",
        CredentialsId = thisMwsCredentials.CredentialsId,
        StorageConfigurationId = thisMwsStorageConfigurations.StorageConfigurationId,
        Token = null,
        CustomTags = 
        {
            { "SoldToCode", "1234" },
        },
    }, new CustomResourceOptions
    {
        Provider = databricks.Mws,
    });

    return new Dictionary<string, object?>
    {
        ["databricksToken"] = thisMwsWorkspaces.Token.Apply(token => token?.TokenValue),
    };
});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.random.RandomString;
import com.pulumi.random.RandomStringArgs;
import com.pulumi.databricks.DatabricksFunctions;
import com.pulumi.databricks.inputs.GetAwsAssumeRolePolicyArgs;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.databricks.inputs.GetAwsCrossAccountPolicyArgs;
import com.pulumi.aws.iam.RolePolicy;
import com.pulumi.aws.iam.RolePolicyArgs;
import com.pulumi.databricks.MwsCredentials;
import com.pulumi.databricks.MwsCredentialsArgs;
import com.pulumi.aws.s3.BucketV2;
import com.pulumi.aws.s3.BucketV2Args;
import com.pulumi.aws.s3.BucketVersioningV2;
import com.pulumi.aws.s3.BucketVersioningV2Args;
import com.pulumi.aws.s3.inputs.BucketVersioningV2VersioningConfigurationArgs;
import com.pulumi.aws.s3.BucketServerSideEncryptionConfigurationV2;
import com.pulumi.aws.s3.BucketServerSideEncryptionConfigurationV2Args;
import com.pulumi.aws.s3.inputs.BucketServerSideEncryptionConfigurationV2RuleArgs;
import com.pulumi.aws.s3.inputs.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs;
import com.pulumi.aws.s3.BucketPublicAccessBlock;
import com.pulumi.aws.s3.BucketPublicAccessBlockArgs;
import com.pulumi.databricks.inputs.GetAwsBucketPolicyArgs;
import com.pulumi.aws.s3.BucketPolicy;
import com.pulumi.aws.s3.BucketPolicyArgs;
import com.pulumi.databricks.MwsStorageConfigurations;
import com.pulumi.databricks.MwsStorageConfigurationsArgs;
import com.pulumi.databricks.MwsWorkspaces;
import com.pulumi.databricks.MwsWorkspacesArgs;
import com.pulumi.databricks.inputs.MwsWorkspacesTokenArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var config = ctx.config();
        final var databricksAccountId = config.get("databricksAccountId");
        var naming = new RandomString("naming", RandomStringArgs.builder()        
            .special(false)
            .upper(false)
            .length(6)
            .build());

        final var prefix = naming.result().applyValue(result -> String.format("dltp%s", result));

        final var thisAwsAssumeRolePolicy = DatabricksFunctions.getAwsAssumeRolePolicy(GetAwsAssumeRolePolicyArgs.builder()
            .externalId(databricksAccountId)
            .build());

        var crossAccountRole = new Role("crossAccountRole", RoleArgs.builder()        
            .assumeRolePolicy(thisAwsAssumeRolePolicy.applyValue(getAwsAssumeRolePolicyResult -> getAwsAssumeRolePolicyResult.json()))
            .tags(var_.tags())
            .build());

        final var thisAwsCrossAccountPolicy = DatabricksFunctions.getAwsCrossAccountPolicy();

        var thisRolePolicy = new RolePolicy("thisRolePolicy", RolePolicyArgs.builder()        
            .role(crossAccountRole.id())
            .policy(thisAwsCrossAccountPolicy.applyValue(getAwsCrossAccountPolicyResult -> getAwsCrossAccountPolicyResult.json()))
            .build());

        var thisMwsCredentials = new MwsCredentials("thisMwsCredentials", MwsCredentialsArgs.builder()        
            .accountId(databricksAccountId)
            .credentialsName(String.format("%s-creds", prefix))
            .roleArn(crossAccountRole.arn())
            .build(), CustomResourceOptions.builder()
                .provider(databricks.mws())
                .build());

        var rootStorageBucketBucketV2 = new BucketV2("rootStorageBucketBucketV2", BucketV2Args.builder()        
            .acl("private")
            .forceDestroy(true)
            .tags(var_.tags())
            .build());

        var rootVersioning = new BucketVersioningV2("rootVersioning", BucketVersioningV2Args.builder()        
            .bucket(rootStorageBucketBucketV2.id())
            .versioningConfiguration(BucketVersioningV2VersioningConfigurationArgs.builder()
                .status("Disabled")
                .build())
            .build());

        var rootStorageBucketBucketServerSideEncryptionConfigurationV2 = new BucketServerSideEncryptionConfigurationV2("rootStorageBucketBucketServerSideEncryptionConfigurationV2", BucketServerSideEncryptionConfigurationV2Args.builder()        
            .bucket(rootStorageBucketBucketV2.bucket())
            .rules(BucketServerSideEncryptionConfigurationV2RuleArgs.builder()
                .applyServerSideEncryptionByDefault(BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs.builder()
                    .sseAlgorithm("AES256")
                    .build())
                .build())
            .build());

        var rootStorageBucketBucketPublicAccessBlock = new BucketPublicAccessBlock("rootStorageBucketBucketPublicAccessBlock", BucketPublicAccessBlockArgs.builder()        
            .bucket(rootStorageBucketBucketV2.id())
            .blockPublicAcls(true)
            .blockPublicPolicy(true)
            .ignorePublicAcls(true)
            .restrictPublicBuckets(true)
            .build(), CustomResourceOptions.builder()
                .dependsOn(rootStorageBucketBucketV2)
                .build());

        final var thisAwsBucketPolicy = DatabricksFunctions.getAwsBucketPolicy(GetAwsBucketPolicyArgs.builder()
            .bucket(rootStorageBucketBucketV2.bucket())
            .build());

        var rootBucketPolicy = new BucketPolicy("rootBucketPolicy", BucketPolicyArgs.builder()        
            .bucket(rootStorageBucketBucketV2.id())
            .policy(thisAwsBucketPolicy.applyValue(getAwsBucketPolicyResult -> getAwsBucketPolicyResult).applyValue(thisAwsBucketPolicy -> thisAwsBucketPolicy.applyValue(getAwsBucketPolicyResult -> getAwsBucketPolicyResult.json())))
            .build(), CustomResourceOptions.builder()
                .dependsOn(rootStorageBucketBucketPublicAccessBlock)
                .build());

        var thisMwsStorageConfigurations = new MwsStorageConfigurations("thisMwsStorageConfigurations", MwsStorageConfigurationsArgs.builder()        
            .accountId(databricksAccountId)
            .storageConfigurationName(String.format("%s-storage", prefix))
            .bucketName(rootStorageBucketBucketV2.bucket())
            .build(), CustomResourceOptions.builder()
                .provider(databricks.mws())
                .build());

        var thisMwsWorkspaces = new MwsWorkspaces("thisMwsWorkspaces", MwsWorkspacesArgs.builder()        
            .accountId(databricksAccountId)
            .workspaceName(prefix)
            .awsRegion("us-east-1")
            .credentialsId(thisMwsCredentials.credentialsId())
            .storageConfigurationId(thisMwsStorageConfigurations.storageConfigurationId())
            .token()
            .customTags(Map.of("SoldToCode", "1234"))
            .build(), CustomResourceOptions.builder()
                .provider(databricks.mws())
                .build());

        ctx.export("databricksToken", thisMwsWorkspaces.token().applyValue(token -> token.tokenValue()));
    }
}

configuration:
  databricksAccountId:
    type: dynamic
resources:
  naming:
    type: random:RandomString
    properties:
      special: false
      upper: false
      length: 6
  crossAccountRole:
    type: aws:iam:Role
    properties:
      assumeRolePolicy: ${thisAwsAssumeRolePolicy.json}
      tags: ${var.tags}
  thisRolePolicy:
    type: aws:iam:RolePolicy
    properties:
      role: ${crossAccountRole.id}
      policy: ${thisAwsCrossAccountPolicy.json}
  thisMwsCredentials:
    type: databricks:MwsCredentials
    properties:
      accountId: ${databricksAccountId}
      credentialsName: ${prefix}-creds
      roleArn: ${crossAccountRole.arn}
    options:
      provider: ${databricks.mws}
  rootStorageBucketBucketV2:
    type: aws:s3:BucketV2
    properties:
      acl: private
      forceDestroy: true
      tags: ${var.tags}
  rootVersioning:
    type: aws:s3:BucketVersioningV2
    properties:
      bucket: ${rootStorageBucketBucketV2.id}
      versioningConfiguration:
        status: Disabled
  rootStorageBucketBucketServerSideEncryptionConfigurationV2:
    type: aws:s3:BucketServerSideEncryptionConfigurationV2
    properties:
      bucket: ${rootStorageBucketBucketV2.bucket}
      rules:
        - applyServerSideEncryptionByDefault:
            sseAlgorithm: AES256
  rootStorageBucketBucketPublicAccessBlock:
    type: aws:s3:BucketPublicAccessBlock
    properties:
      bucket: ${rootStorageBucketBucketV2.id}
      blockPublicAcls: true
      blockPublicPolicy: true
      ignorePublicAcls: true
      restrictPublicBuckets: true
    options:
      dependson:
        - ${rootStorageBucketBucketV2}
  rootBucketPolicy:
    type: aws:s3:BucketPolicy
    properties:
      bucket: ${rootStorageBucketBucketV2.id}
      policy: ${thisAwsBucketPolicy.json}
    options:
      dependson:
        - ${rootStorageBucketBucketPublicAccessBlock}
  thisMwsStorageConfigurations:
    type: databricks:MwsStorageConfigurations
    properties:
      accountId: ${databricksAccountId}
      storageConfigurationName: ${prefix}-storage
      bucketName: ${rootStorageBucketBucketV2.bucket}
    options:
      provider: ${databricks.mws}
  thisMwsWorkspaces:
    type: databricks:MwsWorkspaces
    properties:
      accountId: ${databricksAccountId}
      workspaceName: ${prefix}
      awsRegion: us-east-1
      credentialsId: ${thisMwsCredentials.credentialsId}
      storageConfigurationId: ${thisMwsStorageConfigurations.storageConfigurationId}
      token: {}
      # Optional Custom Tags
      customTags:
        SoldToCode: '1234'
    options:
      provider: ${databricks.mws}
variables:
  prefix: dltp${naming.result}
  thisAwsAssumeRolePolicy:
    fn::invoke:
      Function: databricks:getAwsAssumeRolePolicy
      Arguments:
        externalId: ${databricksAccountId}
  thisAwsCrossAccountPolicy:
    fn::invoke:
      Function: databricks:getAwsCrossAccountPolicy
      Arguments: {}
  thisAwsBucketPolicy:
    fn::invoke:
      Function: databricks:getAwsBucketPolicy
      Arguments:
        bucket: ${rootStorageBucketBucketV2.bucket}
outputs:
  databricksToken: ${thisMwsWorkspaces.token.tokenValue}

import * as pulumi from "@pulumi/pulumi";
import * as databricks from "@pulumi/databricks";

const config = new pulumi.Config();
const databricksAccountId = config.requireObject("databricksAccountId");
const databricksGoogleServiceAccount = config.requireObject("databricksGoogleServiceAccount");
const googleProject = config.requireObject("googleProject");
const mws = new databricks.Provider("mws", {host: "https://accounts.gcp.databricks.com"});
// register VPC
const thisMwsNetworks = new databricks.MwsNetworks("thisMwsNetworks", {
    accountId: databricksAccountId,
    networkName: `${_var.prefix}-network`,
    gcpNetworkInfo: {
        networkProjectId: googleProject,
        vpcId: _var.vpc_id,
        subnetId: _var.subnet_id,
        subnetRegion: _var.subnet_region,
        podIpRangeName: "pods",
        serviceIpRangeName: "svc",
    },
});
// create workspace in given VPC
const thisMwsWorkspaces = new databricks.MwsWorkspaces("thisMwsWorkspaces", {
    accountId: databricksAccountId,
    workspaceName: _var.prefix,
    location: _var.subnet_region,
    cloudResourceContainer: {
        gcp: {
            projectId: googleProject,
        },
    },
    networkId: thisMwsNetworks.networkId,
    gkeConfig: {
        connectivityType: "PRIVATE_NODE_PUBLIC_MASTER",
        masterIpRange: "10.3.0.0/28",
    },
    token: {},
});
export const databricksToken = thisMwsWorkspaces.token.apply(token => token?.tokenValue);