Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Databricks Provider
  4. API Docs
  5. PolicyInfo
Viewing docs for Databricks v1.109.0
published on Tuesday, Sep 8, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-databricks

databricks.PolicyInfo

databricks logo databricks logo
Viewing docs for Databricks v1.109.0
published on Tuesday, Sep 8, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-databricks

    GA

    API Documentation

    Attribute-Based Access Control (ABAC) policies in Unity Catalog provide high leverage governance for enforcing compliance policies. With ABAC policies, access is controlled in a hierarchical and scalable manner, based on data attributes rather than specific resources, enabling more flexible and comprehensive access control.

    ABAC policies in Unity Catalog support conditions on governance tags and the user identity. Callers must have the MANAGE privilege on a securable to view, create, update, or delete ABAC policies.

    Example Usage

    Row Filter Policy

    import * as pulumi from "@pulumi/pulumi";
import * as databricks from "@pulumi/databricks";

const piiRowFilter = new databricks.PolicyInfo("pii_row_filter", {
    onSecurableType: "CATALOG",
    onSecurableFullname: "main",
    name: "pii_data_policy",
    policyType: "POLICY_TYPE_ROW_FILTER",
    forSecurableType: "TABLE",
    toPrincipals: ["account users"],
    whenCondition: "hasTag('pii')",
    matchColumns: [{
        condition: "hasTag('pii')",
        alias: "pii_col",
    }],
    rowFilter: {
        functionName: "main.filters.mask_pii_rows",
        usings: [{
            alias: "pii_col",
        }],
    },
});

    import pulumi
import pulumi_databricks as databricks

pii_row_filter = databricks.PolicyInfo("pii_row_filter",
    on_securable_type="CATALOG",
    on_securable_fullname="main",
    name="pii_data_policy",
    policy_type="POLICY_TYPE_ROW_FILTER",
    for_securable_type="TABLE",
    to_principals=["account users"],
    when_condition="hasTag('pii')",
    match_columns=[{
        "condition": "hasTag('pii')",
        "alias": "pii_col",
    }],
    row_filter={
        "function_name": "main.filters.mask_pii_rows",
        "usings": [{
            "alias": "pii_col",
        }],
    })

    package main

import (
	"github.com/pulumi/pulumi-databricks/sdk/go/databricks"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := databricks.NewPolicyInfo(ctx, "pii_row_filter", &databricks.PolicyInfoArgs{
			OnSecurableType:     pulumi.String("CATALOG"),
			OnSecurableFullname: pulumi.String("main"),
			Name:                pulumi.String("pii_data_policy"),
			PolicyType:          pulumi.String("POLICY_TYPE_ROW_FILTER"),
			ForSecurableType:    pulumi.String("TABLE"),
			ToPrincipals: pulumi.StringArray{
				pulumi.String("account users"),
			},
			WhenCondition: pulumi.String("hasTag('pii')"),
			MatchColumns: databricks.PolicyInfoMatchColumnArray{
				&databricks.PolicyInfoMatchColumnArgs{
					Condition: pulumi.String("hasTag('pii')"),
					Alias:     pulumi.String("pii_col"),
				},
			},
			RowFilter: &databricks.PolicyInfoRowFilterArgs{
				FunctionName: pulumi.String("main.filters.mask_pii_rows"),
				Usings: databricks.PolicyInfoRowFilterUsingArray{
					&databricks.PolicyInfoRowFilterUsingArgs{
						Alias: pulumi.String("pii_col"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Databricks = Pulumi.Databricks;

return await Deployment.RunAsync(() => 
{
    var piiRowFilter = new Databricks.PolicyInfo("pii_row_filter", new()
    {
        OnSecurableType = "CATALOG",
        OnSecurableFullname = "main",
        Name = "pii_data_policy",
        PolicyType = "POLICY_TYPE_ROW_FILTER",
        ForSecurableType = "TABLE",
        ToPrincipals = new[]
        {
            "account users",
        },
        WhenCondition = "hasTag('pii')",
        MatchColumns = new[]
        {
            new Databricks.Inputs.PolicyInfoMatchColumnArgs
            {
                Condition = "hasTag('pii')",
                Alias = "pii_col",
            },
        },
        RowFilter = new Databricks.Inputs.PolicyInfoRowFilterArgs
        {
            FunctionName = "main.filters.mask_pii_rows",
            Usings = new[]
            {
                new Databricks.Inputs.PolicyInfoRowFilterUsingArgs
                {
                    Alias = "pii_col",
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.databricks.PolicyInfo;
import com.pulumi.databricks.PolicyInfoArgs;
import com.pulumi.databricks.inputs.PolicyInfoMatchColumnArgs;
import com.pulumi.databricks.inputs.PolicyInfoRowFilterArgs;
import com.pulumi.databricks.inputs.PolicyInfoRowFilterUsingArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var piiRowFilter = new PolicyInfo("piiRowFilter", PolicyInfoArgs.builder()
            .onSecurableType("CATALOG")
            .onSecurableFullname("main")
            .name("pii_data_policy")
            .policyType("POLICY_TYPE_ROW_FILTER")
            .forSecurableType("TABLE")
            .toPrincipals("account users")
            .whenCondition("hasTag('pii')")
            .matchColumns(PolicyInfoMatchColumnArgs.builder()
                .condition("hasTag('pii')")
                .alias("pii_col")
                .build())
            .rowFilter(PolicyInfoRowFilterArgs.builder()
                .functionName("main.filters.mask_pii_rows")
                .usings(PolicyInfoRowFilterUsingArgs.builder()
                    .alias("pii_col")
                    .build())
                .build())
            .build());

    }
}

    resources:
  piiRowFilter:
    type: databricks:PolicyInfo
    name: pii_row_filter
    properties:
      onSecurableType: CATALOG
      onSecurableFullname: main
      name: pii_data_policy
      policyType: POLICY_TYPE_ROW_FILTER
      forSecurableType: TABLE
      toPrincipals:
        - account users
      whenCondition: hasTag('pii')
      matchColumns:
        - condition: hasTag('pii')
          alias: pii_col
      rowFilter:
        functionName: main.filters.mask_pii_rows
        usings:
          - alias: pii_col

    pulumi {
  required_providers {
    databricks = {
      source = "pulumi/databricks"
    }
  }
}

resource "databricks_policyinfo" "pii_row_filter" {
  on_securable_type     = "CATALOG"
  on_securable_fullname = "main"
  name                  = "pii_data_policy"
  policy_type           = "POLICY_TYPE_ROW_FILTER"
  for_securable_type    = "TABLE"
  to_principals         = ["account users"]
  when_condition        = "hasTag('pii')"
  match_columns {
    condition = "hasTag('pii')"
    alias     = "pii_col"
  }
  row_filter = {
    function_name = "main.filters.mask_pii_rows"
    usings = [{
      "alias" = "pii_col"
    }]
  }
}

    Column Mask Policy

    import * as pulumi from "@pulumi/pulumi";
import * as databricks from "@pulumi/databricks";

const sensitiveColumnMask = new databricks.PolicyInfo("sensitive_column_mask", {
    onSecurableType: "SCHEMA",
    onSecurableFullname: "main.finance",
    name: "sensitive_data_mask",
    policyType: "POLICY_TYPE_COLUMN_MASK",
    forSecurableType: "TABLE",
    toPrincipals: ["account users"],
    exceptPrincipals: ["finance_admins"],
    whenCondition: "hasTag('pii')",
    matchColumns: [{
        condition: "hasTag('pii')",
        alias: "sensitive_col",
    }],
    columnMask: {
        functionName: "main.masks.redact_sensitive",
        onColumn: "sensitive_col",
        usings: [{
            constant: "4",
        }],
    },
});

    import pulumi
import pulumi_databricks as databricks

sensitive_column_mask = databricks.PolicyInfo("sensitive_column_mask",
    on_securable_type="SCHEMA",
    on_securable_fullname="main.finance",
    name="sensitive_data_mask",
    policy_type="POLICY_TYPE_COLUMN_MASK",
    for_securable_type="TABLE",
    to_principals=["account users"],
    except_principals=["finance_admins"],
    when_condition="hasTag('pii')",
    match_columns=[{
        "condition": "hasTag('pii')",
        "alias": "sensitive_col",
    }],
    column_mask={
        "function_name": "main.masks.redact_sensitive",
        "on_column": "sensitive_col",
        "usings": [{
            "constant": "4",
        }],
    })

    package main

import (
	"github.com/pulumi/pulumi-databricks/sdk/go/databricks"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := databricks.NewPolicyInfo(ctx, "sensitive_column_mask", &databricks.PolicyInfoArgs{
			OnSecurableType:     pulumi.String("SCHEMA"),
			OnSecurableFullname: pulumi.String("main.finance"),
			Name:                pulumi.String("sensitive_data_mask"),
			PolicyType:          pulumi.String("POLICY_TYPE_COLUMN_MASK"),
			ForSecurableType:    pulumi.String("TABLE"),
			ToPrincipals: pulumi.StringArray{
				pulumi.String("account users"),
			},
			ExceptPrincipals: pulumi.StringArray{
				pulumi.String("finance_admins"),
			},
			WhenCondition: pulumi.String("hasTag('pii')"),
			MatchColumns: databricks.PolicyInfoMatchColumnArray{
				&databricks.PolicyInfoMatchColumnArgs{
					Condition: pulumi.String("hasTag('pii')"),
					Alias:     pulumi.String("sensitive_col"),
				},
			},
			ColumnMask: &databricks.PolicyInfoColumnMaskArgs{
				FunctionName: pulumi.String("main.masks.redact_sensitive"),
				OnColumn:     pulumi.String("sensitive_col"),
				Usings: databricks.PolicyInfoColumnMaskUsingArray{
					&databricks.PolicyInfoColumnMaskUsingArgs{
						Constant: pulumi.String("4"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Databricks = Pulumi.Databricks;

return await Deployment.RunAsync(() => 
{
    var sensitiveColumnMask = new Databricks.PolicyInfo("sensitive_column_mask", new()
    {
        OnSecurableType = "SCHEMA",
        OnSecurableFullname = "main.finance",
        Name = "sensitive_data_mask",
        PolicyType = "POLICY_TYPE_COLUMN_MASK",
        ForSecurableType = "TABLE",
        ToPrincipals = new[]
        {
            "account users",
        },
        ExceptPrincipals = new[]
        {
            "finance_admins",
        },
        WhenCondition = "hasTag('pii')",
        MatchColumns = new[]
        {
            new Databricks.Inputs.PolicyInfoMatchColumnArgs
            {
                Condition = "hasTag('pii')",
                Alias = "sensitive_col",
            },
        },
        ColumnMask = new Databricks.Inputs.PolicyInfoColumnMaskArgs
        {
            FunctionName = "main.masks.redact_sensitive",
            OnColumn = "sensitive_col",
            Usings = new[]
            {
                new Databricks.Inputs.PolicyInfoColumnMaskUsingArgs
                {
                    Constant = "4",
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.databricks.PolicyInfo;
import com.pulumi.databricks.PolicyInfoArgs;
import com.pulumi.databricks.inputs.PolicyInfoMatchColumnArgs;
import com.pulumi.databricks.inputs.PolicyInfoColumnMaskArgs;
import com.pulumi.databricks.inputs.PolicyInfoColumnMaskUsingArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var sensitiveColumnMask = new PolicyInfo("sensitiveColumnMask", PolicyInfoArgs.builder()
            .onSecurableType("SCHEMA")
            .onSecurableFullname("main.finance")
            .name("sensitive_data_mask")
            .policyType("POLICY_TYPE_COLUMN_MASK")
            .forSecurableType("TABLE")
            .toPrincipals("account users")
            .exceptPrincipals("finance_admins")
            .whenCondition("hasTag('pii')")
            .matchColumns(PolicyInfoMatchColumnArgs.builder()
                .condition("hasTag('pii')")
                .alias("sensitive_col")
                .build())
            .columnMask(PolicyInfoColumnMaskArgs.builder()
                .functionName("main.masks.redact_sensitive")
                .onColumn("sensitive_col")
                .usings(PolicyInfoColumnMaskUsingArgs.builder()
                    .constant("4")
                    .build())
                .build())
            .build());

    }
}

    resources:
  sensitiveColumnMask:
    type: databricks:PolicyInfo
    name: sensitive_column_mask
    properties:
      onSecurableType: SCHEMA
      onSecurableFullname: main.finance
      name: sensitive_data_mask
      policyType: POLICY_TYPE_COLUMN_MASK
      forSecurableType: TABLE
      toPrincipals:
        - account users
      exceptPrincipals:
        - finance_admins
      whenCondition: hasTag('pii')
      matchColumns:
        - condition: hasTag('pii')
          alias: sensitive_col
      columnMask:
        functionName: main.masks.redact_sensitive
        onColumn: sensitive_col
        usings:
          - constant: '4'

    pulumi {
  required_providers {
    databricks = {
      source = "pulumi/databricks"
    }
  }
}

resource "databricks_policyinfo" "sensitive_column_mask" {
  on_securable_type     = "SCHEMA"
  on_securable_fullname = "main.finance"
  name                  = "sensitive_data_mask"
  policy_type           = "POLICY_TYPE_COLUMN_MASK"
  for_securable_type    = "TABLE"
  to_principals         = ["account users"]
  except_principals     = ["finance_admins"]
  when_condition        = "hasTag('pii')"
  match_columns {
    condition = "hasTag('pii')"
    alias     = "sensitive_col"
  }
  column_mask = {
    function_name = "main.masks.redact_sensitive"
    on_column     = "sensitive_col"
    usings = [{
      "constant" = "4"
    }]
  }
}

    Create PolicyInfo Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new PolicyInfo(name: string, args: PolicyInfoArgs, opts?: CustomResourceOptions);
    @overload
def PolicyInfo(resource_name: str,
               args: PolicyInfoArgs,
               opts: Optional[ResourceOptions] = None)

@overload
def PolicyInfo(resource_name: str,
               opts: Optional[ResourceOptions] = None,
               policy_type: Optional[str] = None,
               for_securable_type: Optional[str] = None,
               to_principals: Optional[Sequence[str]] = None,
               grant: Optional[PolicyInfoGrantArgs] = None,
               name: Optional[str] = None,
               match_columns: Optional[Sequence[PolicyInfoMatchColumnArgs]] = None,
               on_securable_type: Optional[str] = None,
               except_principals: Optional[Sequence[str]] = None,
               comment: Optional[str] = None,
               column_mask: Optional[PolicyInfoColumnMaskArgs] = None,
               provider_config: Optional[PolicyInfoProviderConfigArgs] = None,
               row_filter: Optional[PolicyInfoRowFilterArgs] = None,
               on_securable_fullname: Optional[str] = None,
               when_condition: Optional[str] = None)
    func NewPolicyInfo(ctx *Context, name string, args PolicyInfoArgs, opts ...ResourceOption) (*PolicyInfo, error)
    public PolicyInfo(string name, PolicyInfoArgs args, CustomResourceOptions? opts = null)
    public PolicyInfo(String name, PolicyInfoArgs args)
public PolicyInfo(String name, PolicyInfoArgs args, CustomResourceOptions options)

    type: databricks:PolicyInfo
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "databricks_policy_info" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args PolicyInfoArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args PolicyInfoArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args PolicyInfoArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args PolicyInfoArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args PolicyInfoArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var policyInfoResource = new Databricks.PolicyInfo("policyInfoResource", new()
{
    PolicyType = "string",
    ForSecurableType = "string",
    ToPrincipals = new[]
    {
        "string",
    },
    Grant = new Databricks.Inputs.PolicyInfoGrantArgs
    {
        Privileges = new[]
        {
            "string",
        },
    },
    Name = "string",
    MatchColumns = new[]
    {
        new Databricks.Inputs.PolicyInfoMatchColumnArgs
        {
            Alias = "string",
            Condition = "string",
        },
    },
    OnSecurableType = "string",
    ExceptPrincipals = new[]
    {
        "string",
    },
    Comment = "string",
    ColumnMask = new Databricks.Inputs.PolicyInfoColumnMaskArgs
    {
        FunctionName = "string",
        OnColumn = "string",
        Usings = new[]
        {
            new Databricks.Inputs.PolicyInfoColumnMaskUsingArgs
            {
                Alias = "string",
                Constant = "string",
                FunctionArgExpression = new Databricks.Inputs.PolicyInfoColumnMaskUsingFunctionArgExpressionArgs
                {
                    TagIntrospection = new Databricks.Inputs.PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionArgs
                    {
                        ColumnTagValue = new Databricks.Inputs.PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionColumnTagValueArgs
                        {
                            ColumnAlias = "string",
                            TagKey = "string",
                        },
                        TagValue = new Databricks.Inputs.PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionTagValueArgs
                        {
                            TagKey = "string",
                        },
                    },
                },
            },
        },
    },
    ProviderConfig = new Databricks.Inputs.PolicyInfoProviderConfigArgs
    {
        WorkspaceId = "string",
    },
    RowFilter = new Databricks.Inputs.PolicyInfoRowFilterArgs
    {
        FunctionName = "string",
        Usings = new[]
        {
            new Databricks.Inputs.PolicyInfoRowFilterUsingArgs
            {
                Alias = "string",
                Constant = "string",
                FunctionArgExpression = new Databricks.Inputs.PolicyInfoRowFilterUsingFunctionArgExpressionArgs
                {
                    TagIntrospection = new Databricks.Inputs.PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionArgs
                    {
                        ColumnTagValue = new Databricks.Inputs.PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionColumnTagValueArgs
                        {
                            ColumnAlias = "string",
                            TagKey = "string",
                        },
                        TagValue = new Databricks.Inputs.PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionTagValueArgs
                        {
                            TagKey = "string",
                        },
                    },
                },
            },
        },
    },
    OnSecurableFullname = "string",
    WhenCondition = "string",
});

    example, err := databricks.NewPolicyInfo(ctx, "policyInfoResource", &databricks.PolicyInfoArgs{
	PolicyType:       pulumi.String("string"),
	ForSecurableType: pulumi.String("string"),
	ToPrincipals: pulumi.StringArray{
		pulumi.String("string"),
	},
	Grant: &databricks.PolicyInfoGrantArgs{
		Privileges: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	Name: pulumi.String("string"),
	MatchColumns: databricks.PolicyInfoMatchColumnArray{
		&databricks.PolicyInfoMatchColumnArgs{
			Alias:     pulumi.String("string"),
			Condition: pulumi.String("string"),
		},
	},
	OnSecurableType: pulumi.String("string"),
	ExceptPrincipals: pulumi.StringArray{
		pulumi.String("string"),
	},
	Comment: pulumi.String("string"),
	ColumnMask: &databricks.PolicyInfoColumnMaskArgs{
		FunctionName: pulumi.String("string"),
		OnColumn:     pulumi.String("string"),
		Usings: databricks.PolicyInfoColumnMaskUsingArray{
			&databricks.PolicyInfoColumnMaskUsingArgs{
				Alias:    pulumi.String("string"),
				Constant: pulumi.String("string"),
				FunctionArgExpression: &databricks.PolicyInfoColumnMaskUsingFunctionArgExpressionArgs{
					TagIntrospection: &databricks.PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionArgs{
						ColumnTagValue: &databricks.PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionColumnTagValueArgs{
							ColumnAlias: pulumi.String("string"),
							TagKey:      pulumi.String("string"),
						},
						TagValue: &databricks.PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionTagValueArgs{
							TagKey: pulumi.String("string"),
						},
					},
				},
			},
		},
	},
	ProviderConfig: &databricks.PolicyInfoProviderConfigArgs{
		WorkspaceId: pulumi.String("string"),
	},
	RowFilter: &databricks.PolicyInfoRowFilterArgs{
		FunctionName: pulumi.String("string"),
		Usings: databricks.PolicyInfoRowFilterUsingArray{
			&databricks.PolicyInfoRowFilterUsingArgs{
				Alias:    pulumi.String("string"),
				Constant: pulumi.String("string"),
				FunctionArgExpression: &databricks.PolicyInfoRowFilterUsingFunctionArgExpressionArgs{
					TagIntrospection: &databricks.PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionArgs{
						ColumnTagValue: &databricks.PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionColumnTagValueArgs{
							ColumnAlias: pulumi.String("string"),
							TagKey:      pulumi.String("string"),
						},
						TagValue: &databricks.PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionTagValueArgs{
							TagKey: pulumi.String("string"),
						},
					},
				},
			},
		},
	},
	OnSecurableFullname: pulumi.String("string"),
	WhenCondition:       pulumi.String("string"),
})

    resource "databricks_policy_info" "policyInfoResource" {
  lifecycle {
    create_before_destroy = true
  }
  policy_type        = "string"
  for_securable_type = "string"
  to_principals      = ["string"]
  grant = {
    privileges = ["string"]
  }
  name = "string"
  match_columns {
    alias     = "string"
    condition = "string"
  }
  on_securable_type = "string"
  except_principals = ["string"]
  comment           = "string"
  column_mask = {
    function_name = "string"
    on_column     = "string"
    usings = [{
      alias    = "string"
      constant = "string"
      function_arg_expression = {
        tag_introspection = {
          column_tag_value = {
            column_alias = "string"
            tag_key      = "string"
          }
          tag_value = {
            tag_key = "string"
          }
        }
      }
    }]
  }
  provider_config = {
    workspace_id = "string"
  }
  row_filter = {
    function_name = "string"
    usings = [{
      alias    = "string"
      constant = "string"
      function_arg_expression = {
        tag_introspection = {
          column_tag_value = {
            column_alias = "string"
            tag_key      = "string"
          }
          tag_value = {
            tag_key = "string"
          }
        }
      }
    }]
  }
  on_securable_fullname = "string"
  when_condition        = "string"
}

    var policyInfoResource = new PolicyInfo("policyInfoResource", PolicyInfoArgs.builder()
    .policyType("string")
    .forSecurableType("string")
    .toPrincipals("string")
    .grant(PolicyInfoGrantArgs.builder()
        .privileges("string")
        .build())
    .name("string")
    .matchColumns(PolicyInfoMatchColumnArgs.builder()
        .alias("string")
        .condition("string")
        .build())
    .onSecurableType("string")
    .exceptPrincipals("string")
    .comment("string")
    .columnMask(PolicyInfoColumnMaskArgs.builder()
        .functionName("string")
        .onColumn("string")
        .usings(PolicyInfoColumnMaskUsingArgs.builder()
            .alias("string")
            .constant("string")
            .functionArgExpression(PolicyInfoColumnMaskUsingFunctionArgExpressionArgs.builder()
                .tagIntrospection(PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionArgs.builder()
                    .columnTagValue(PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionColumnTagValueArgs.builder()
                        .columnAlias("string")
                        .tagKey("string")
                        .build())
                    .tagValue(PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionTagValueArgs.builder()
                        .tagKey("string")
                        .build())
                    .build())
                .build())
            .build())
        .build())
    .providerConfig(PolicyInfoProviderConfigArgs.builder()
        .workspaceId("string")
        .build())
    .rowFilter(PolicyInfoRowFilterArgs.builder()
        .functionName("string")
        .usings(PolicyInfoRowFilterUsingArgs.builder()
            .alias("string")
            .constant("string")
            .functionArgExpression(PolicyInfoRowFilterUsingFunctionArgExpressionArgs.builder()
                .tagIntrospection(PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionArgs.builder()
                    .columnTagValue(PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionColumnTagValueArgs.builder()
                        .columnAlias("string")
                        .tagKey("string")
                        .build())
                    .tagValue(PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionTagValueArgs.builder()
                        .tagKey("string")
                        .build())
                    .build())
                .build())
            .build())
        .build())
    .onSecurableFullname("string")
    .whenCondition("string")
    .build());

    policy_info_resource = databricks.PolicyInfo("policyInfoResource",
    policy_type="string",
    for_securable_type="string",
    to_principals=["string"],
    grant={
        "privileges": ["string"],
    },
    name="string",
    match_columns=[{
        "alias": "string",
        "condition": "string",
    }],
    on_securable_type="string",
    except_principals=["string"],
    comment="string",
    column_mask={
        "function_name": "string",
        "on_column": "string",
        "usings": [{
            "alias": "string",
            "constant": "string",
            "function_arg_expression": {
                "tag_introspection": {
                    "column_tag_value": {
                        "column_alias": "string",
                        "tag_key": "string",
                    },
                    "tag_value": {
                        "tag_key": "string",
                    },
                },
            },
        }],
    },
    provider_config={
        "workspace_id": "string",
    },
    row_filter={
        "function_name": "string",
        "usings": [{
            "alias": "string",
            "constant": "string",
            "function_arg_expression": {
                "tag_introspection": {
                    "column_tag_value": {
                        "column_alias": "string",
                        "tag_key": "string",
                    },
                    "tag_value": {
                        "tag_key": "string",
                    },
                },
            },
        }],
    },
    on_securable_fullname="string",
    when_condition="string")

    const policyInfoResource = new databricks.PolicyInfo("policyInfoResource", {
    policyType: "string",
    forSecurableType: "string",
    toPrincipals: ["string"],
    grant: {
        privileges: ["string"],
    },
    name: "string",
    matchColumns: [{
        alias: "string",
        condition: "string",
    }],
    onSecurableType: "string",
    exceptPrincipals: ["string"],
    comment: "string",
    columnMask: {
        functionName: "string",
        onColumn: "string",
        usings: [{
            alias: "string",
            constant: "string",
            functionArgExpression: {
                tagIntrospection: {
                    columnTagValue: {
                        columnAlias: "string",
                        tagKey: "string",
                    },
                    tagValue: {
                        tagKey: "string",
                    },
                },
            },
        }],
    },
    providerConfig: {
        workspaceId: "string",
    },
    rowFilter: {
        functionName: "string",
        usings: [{
            alias: "string",
            constant: "string",
            functionArgExpression: {
                tagIntrospection: {
                    columnTagValue: {
                        columnAlias: "string",
                        tagKey: "string",
                    },
                    tagValue: {
                        tagKey: "string",
                    },
                },
            },
        }],
    },
    onSecurableFullname: "string",
    whenCondition: "string",
});

    type: databricks:PolicyInfo
properties:
    columnMask:
        functionName: string
        onColumn: string
        usings:
            - alias: string
              constant: string
              functionArgExpression:
                tagIntrospection:
                    columnTagValue:
                        columnAlias: string
                        tagKey: string
                    tagValue:
                        tagKey: string
    comment: string
    exceptPrincipals:
        - string
    forSecurableType: string
    grant:
        privileges:
            - string
    matchColumns:
        - alias: string
          condition: string
    name: string
    onSecurableFullname: string
    onSecurableType: string
    policyType: string
    providerConfig:
        workspaceId: string
    rowFilter:
        functionName: string
        usings:
            - alias: string
              constant: string
              functionArgExpression:
                tagIntrospection:
                    columnTagValue:
                        columnAlias: string
                        tagKey: string
                    tagValue:
                        tagKey: string
    toPrincipals:
        - string
    whenCondition: string

    PolicyInfo Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The PolicyInfo resource accepts the following input properties:

    ForSecurableType string
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    PolicyType string
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    ToPrincipals List<string>
    List of user or group names that the policy applies to. Required on create and optional on update
    ColumnMask PolicyInfoColumnMask
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    Comment string
    Optional description of the policy
    ExceptPrincipals List<string>
    Optional list of user or group names that should be excluded from the policy
    Grant PolicyInfoGrant
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    MatchColumns List<PolicyInfoMatchColumn>
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    Name string
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    OnSecurableFullname string
    Full name of the securable on which the policy is defined. Required on create
    OnSecurableType string
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    ProviderConfig PolicyInfoProviderConfig
    Configure the provider for management through account provider.
    RowFilter PolicyInfoRowFilter
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    WhenCondition string
    Optional condition when the policy should take effect
    ForSecurableType string
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    PolicyType string
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    ToPrincipals []string
    List of user or group names that the policy applies to. Required on create and optional on update
    ColumnMask PolicyInfoColumnMaskArgs
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    Comment string
    Optional description of the policy
    ExceptPrincipals []string
    Optional list of user or group names that should be excluded from the policy
    Grant PolicyInfoGrantArgs
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    MatchColumns []PolicyInfoMatchColumnArgs
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    Name string
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    OnSecurableFullname string
    Full name of the securable on which the policy is defined. Required on create
    OnSecurableType string
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    ProviderConfig PolicyInfoProviderConfigArgs
    Configure the provider for management through account provider.
    RowFilter PolicyInfoRowFilterArgs
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    WhenCondition string
    Optional condition when the policy should take effect
    for_securable_type string
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    policy_type string
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    to_principals list(string)
    List of user or group names that the policy applies to. Required on create and optional on update
    column_mask object
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    comment string
    Optional description of the policy
    except_principals list(string)
    Optional list of user or group names that should be excluded from the policy
    grant object
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    match_columns list(object)
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    name string
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    on_securable_fullname string
    Full name of the securable on which the policy is defined. Required on create
    on_securable_type string
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    provider_config object
    Configure the provider for management through account provider.
    row_filter object
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    when_condition string
    Optional condition when the policy should take effect
    forSecurableType String
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    policyType String
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    toPrincipals List<String>
    List of user or group names that the policy applies to. Required on create and optional on update
    columnMask PolicyInfoColumnMask
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    comment String
    Optional description of the policy
    exceptPrincipals List<String>
    Optional list of user or group names that should be excluded from the policy
    grant PolicyInfoGrant
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    matchColumns List<PolicyInfoMatchColumn>
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    name String
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    onSecurableFullname String
    Full name of the securable on which the policy is defined. Required on create
    onSecurableType String
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    providerConfig PolicyInfoProviderConfig
    Configure the provider for management through account provider.
    rowFilter PolicyInfoRowFilter
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    whenCondition String
    Optional condition when the policy should take effect
    forSecurableType string
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    policyType string
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    toPrincipals string[]
    List of user or group names that the policy applies to. Required on create and optional on update
    columnMask PolicyInfoColumnMask
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    comment string
    Optional description of the policy
    exceptPrincipals string[]
    Optional list of user or group names that should be excluded from the policy
    grant PolicyInfoGrant
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    matchColumns PolicyInfoMatchColumn[]
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    name string
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    onSecurableFullname string
    Full name of the securable on which the policy is defined. Required on create
    onSecurableType string
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    providerConfig PolicyInfoProviderConfig
    Configure the provider for management through account provider.
    rowFilter PolicyInfoRowFilter
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    whenCondition string
    Optional condition when the policy should take effect
    for_securable_type str
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    policy_type str
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    to_principals Sequence[str]
    List of user or group names that the policy applies to. Required on create and optional on update
    column_mask PolicyInfoColumnMaskArgs
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    comment str
    Optional description of the policy
    except_principals Sequence[str]
    Optional list of user or group names that should be excluded from the policy
    grant PolicyInfoGrantArgs
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    match_columns Sequence[PolicyInfoMatchColumnArgs]
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    name str
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    on_securable_fullname str
    Full name of the securable on which the policy is defined. Required on create
    on_securable_type str
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    provider_config PolicyInfoProviderConfigArgs
    Configure the provider for management through account provider.
    row_filter PolicyInfoRowFilterArgs
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    when_condition str
    Optional condition when the policy should take effect
    forSecurableType String
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    policyType String
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    toPrincipals List<String>
    List of user or group names that the policy applies to. Required on create and optional on update
    columnMask Property Map
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    comment String
    Optional description of the policy
    exceptPrincipals List<String>
    Optional list of user or group names that should be excluded from the policy
    grant Property Map
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    matchColumns List<Property Map>
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    name String
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    onSecurableFullname String
    Full name of the securable on which the policy is defined. Required on create
    onSecurableType String
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    providerConfig Property Map
    Configure the provider for management through account provider.
    rowFilter Property Map
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    whenCondition String
    Optional condition when the policy should take effect

    Outputs

    All input properties are implicitly available as output properties. Additionally, the PolicyInfo resource produces the following output properties:

    CreatedAt int
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    CreatedBy string
    (string) - Username of the user who created the policy. Output only
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdatedAt int
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    UpdatedBy string
    (string) - Username of the user who last modified the policy. Output only
    CreatedAt int
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    CreatedBy string
    (string) - Username of the user who created the policy. Output only
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdatedAt int
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    UpdatedBy string
    (string) - Username of the user who last modified the policy. Output only
    created_at number
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    created_by string
    (string) - Username of the user who created the policy. Output only
    id string
    The provider-assigned unique ID for this managed resource.
    updated_at number
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    updated_by string
    (string) - Username of the user who last modified the policy. Output only
    createdAt Integer
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    createdBy String
    (string) - Username of the user who created the policy. Output only
    id String
    The provider-assigned unique ID for this managed resource.
    updatedAt Integer
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    updatedBy String
    (string) - Username of the user who last modified the policy. Output only
    createdAt number
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    createdBy string
    (string) - Username of the user who created the policy. Output only
    id string
    The provider-assigned unique ID for this managed resource.
    updatedAt number
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    updatedBy string
    (string) - Username of the user who last modified the policy. Output only
    created_at int
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    created_by str
    (string) - Username of the user who created the policy. Output only
    id str
    The provider-assigned unique ID for this managed resource.
    updated_at int
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    updated_by str
    (string) - Username of the user who last modified the policy. Output only
    createdAt Number
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    createdBy String
    (string) - Username of the user who created the policy. Output only
    id String
    The provider-assigned unique ID for this managed resource.
    updatedAt Number
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    updatedBy String
    (string) - Username of the user who last modified the policy. Output only

    Look up Existing PolicyInfo Resource

    Get an existing PolicyInfo resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: PolicyInfoState, opts?: CustomResourceOptions): PolicyInfo
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        column_mask: Optional[PolicyInfoColumnMaskArgs] = None,
        comment: Optional[str] = None,
        created_at: Optional[int] = None,
        created_by: Optional[str] = None,
        except_principals: Optional[Sequence[str]] = None,
        for_securable_type: Optional[str] = None,
        grant: Optional[PolicyInfoGrantArgs] = None,
        match_columns: Optional[Sequence[PolicyInfoMatchColumnArgs]] = None,
        name: Optional[str] = None,
        on_securable_fullname: Optional[str] = None,
        on_securable_type: Optional[str] = None,
        policy_type: Optional[str] = None,
        provider_config: Optional[PolicyInfoProviderConfigArgs] = None,
        row_filter: Optional[PolicyInfoRowFilterArgs] = None,
        to_principals: Optional[Sequence[str]] = None,
        updated_at: Optional[int] = None,
        updated_by: Optional[str] = None,
        when_condition: Optional[str] = None) -> PolicyInfo
    func GetPolicyInfo(ctx *Context, name string, id IDInput, state *PolicyInfoState, opts ...ResourceOption) (*PolicyInfo, error)
    public static PolicyInfo Get(string name, Input<string> id, PolicyInfoState? state, CustomResourceOptions? opts = null)
    public static PolicyInfo get(String name, Output<String> id, PolicyInfoState state, CustomResourceOptions options)
    resources:  _:    type: databricks:PolicyInfo    get:      id: ${id}
    import {
  to = databricks_policy_info.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ColumnMask PolicyInfoColumnMask
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    Comment string
    Optional description of the policy
    CreatedAt int
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    CreatedBy string
    (string) - Username of the user who created the policy. Output only
    ExceptPrincipals List<string>
    Optional list of user or group names that should be excluded from the policy
    ForSecurableType string
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    Grant PolicyInfoGrant
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    MatchColumns List<PolicyInfoMatchColumn>
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    Name string
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    OnSecurableFullname string
    Full name of the securable on which the policy is defined. Required on create
    OnSecurableType string
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    PolicyType string
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    ProviderConfig PolicyInfoProviderConfig
    Configure the provider for management through account provider.
    RowFilter PolicyInfoRowFilter
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    ToPrincipals List<string>
    List of user or group names that the policy applies to. Required on create and optional on update
    UpdatedAt int
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    UpdatedBy string
    (string) - Username of the user who last modified the policy. Output only
    WhenCondition string
    Optional condition when the policy should take effect
    ColumnMask PolicyInfoColumnMaskArgs
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    Comment string
    Optional description of the policy
    CreatedAt int
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    CreatedBy string
    (string) - Username of the user who created the policy. Output only
    ExceptPrincipals []string
    Optional list of user or group names that should be excluded from the policy
    ForSecurableType string
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    Grant PolicyInfoGrantArgs
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    MatchColumns []PolicyInfoMatchColumnArgs
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    Name string
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    OnSecurableFullname string
    Full name of the securable on which the policy is defined. Required on create
    OnSecurableType string
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    PolicyType string
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    ProviderConfig PolicyInfoProviderConfigArgs
    Configure the provider for management through account provider.
    RowFilter PolicyInfoRowFilterArgs
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    ToPrincipals []string
    List of user or group names that the policy applies to. Required on create and optional on update
    UpdatedAt int
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    UpdatedBy string
    (string) - Username of the user who last modified the policy. Output only
    WhenCondition string
    Optional condition when the policy should take effect
    column_mask object
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    comment string
    Optional description of the policy
    created_at number
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    created_by string
    (string) - Username of the user who created the policy. Output only
    except_principals list(string)
    Optional list of user or group names that should be excluded from the policy
    for_securable_type string
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    grant object
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    match_columns list(object)
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    name string
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    on_securable_fullname string
    Full name of the securable on which the policy is defined. Required on create
    on_securable_type string
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    policy_type string
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    provider_config object
    Configure the provider for management through account provider.
    row_filter object
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    to_principals list(string)
    List of user or group names that the policy applies to. Required on create and optional on update
    updated_at number
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    updated_by string
    (string) - Username of the user who last modified the policy. Output only
    when_condition string
    Optional condition when the policy should take effect
    columnMask PolicyInfoColumnMask
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    comment String
    Optional description of the policy
    createdAt Integer
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    createdBy String
    (string) - Username of the user who created the policy. Output only
    exceptPrincipals List<String>
    Optional list of user or group names that should be excluded from the policy
    forSecurableType String
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    grant PolicyInfoGrant
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    matchColumns List<PolicyInfoMatchColumn>
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    name String
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    onSecurableFullname String
    Full name of the securable on which the policy is defined. Required on create
    onSecurableType String
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    policyType String
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    providerConfig PolicyInfoProviderConfig
    Configure the provider for management through account provider.
    rowFilter PolicyInfoRowFilter
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    toPrincipals List<String>
    List of user or group names that the policy applies to. Required on create and optional on update
    updatedAt Integer
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    updatedBy String
    (string) - Username of the user who last modified the policy. Output only
    whenCondition String
    Optional condition when the policy should take effect
    columnMask PolicyInfoColumnMask
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    comment string
    Optional description of the policy
    createdAt number
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    createdBy string
    (string) - Username of the user who created the policy. Output only
    exceptPrincipals string[]
    Optional list of user or group names that should be excluded from the policy
    forSecurableType string
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    grant PolicyInfoGrant
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    matchColumns PolicyInfoMatchColumn[]
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    name string
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    onSecurableFullname string
    Full name of the securable on which the policy is defined. Required on create
    onSecurableType string
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    policyType string
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    providerConfig PolicyInfoProviderConfig
    Configure the provider for management through account provider.
    rowFilter PolicyInfoRowFilter
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    toPrincipals string[]
    List of user or group names that the policy applies to. Required on create and optional on update
    updatedAt number
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    updatedBy string
    (string) - Username of the user who last modified the policy. Output only
    whenCondition string
    Optional condition when the policy should take effect
    column_mask PolicyInfoColumnMaskArgs
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    comment str
    Optional description of the policy
    created_at int
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    created_by str
    (string) - Username of the user who created the policy. Output only
    except_principals Sequence[str]
    Optional list of user or group names that should be excluded from the policy
    for_securable_type str
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    grant PolicyInfoGrantArgs
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    match_columns Sequence[PolicyInfoMatchColumnArgs]
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    name str
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    on_securable_fullname str
    Full name of the securable on which the policy is defined. Required on create
    on_securable_type str
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    policy_type str
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    provider_config PolicyInfoProviderConfigArgs
    Configure the provider for management through account provider.
    row_filter PolicyInfoRowFilterArgs
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    to_principals Sequence[str]
    List of user or group names that the policy applies to. Required on create and optional on update
    updated_at int
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    updated_by str
    (string) - Username of the user who last modified the policy. Output only
    when_condition str
    Optional condition when the policy should take effect
    columnMask Property Map
    Options for column mask policies. Valid only if policyType is POLICY_TYPE_COLUMN_MASK. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    comment String
    Optional description of the policy
    createdAt Number
    (integer) - Time at which the policy was created, in epoch milliseconds. Output only
    createdBy String
    (string) - Username of the user who created the policy. Output only
    exceptPrincipals List<String>
    Optional list of user or group names that should be excluded from the policy
    forSecurableType String
    Type of securables that the policy should take effect on. Required on create and optional on update. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    grant Property Map
    Options for grant policies. Valid only if policyType is POLICY_TYPE_GRANT. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    matchColumns List<Property Map>
    Optional list of condition expressions used to match table columns. Only valid when forSecurableType is TABLE. When specified, the policy only applies to tables whose columns satisfy all match conditions
    name String
    Name of the policy. Required on create and optional on update. To rename the policy, set name to a different value on update
    onSecurableFullname String
    Full name of the securable on which the policy is defined. Required on create
    onSecurableType String
    Type of the securable on which the policy is defined. Only CATALOG, SCHEMA and TABLE are supported at this moment. Required on create. Possible values are: CATALOG, CLEAN_ROOM, CONNECTION, CREDENTIAL, EXTERNAL_LOCATION, EXTERNAL_METADATA, FUNCTION, MCP_SERVICE, METASTORE, MODEL, MODEL_PROVIDER_SERVICE, MODEL_SERVICE, PIPELINE, PROVIDER, RECIPIENT, SCHEMA, SHARE, STAGING_TABLE, STORAGE_CREDENTIAL, TABLE, VOLUME
    policyType String
    Type of the policy. Required on create. Possible values are: POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER
    providerConfig Property Map
    Configure the provider for management through account provider.
    rowFilter Property Map
    Options for row filter policies. Valid only if policyType is POLICY_TYPE_ROW_FILTER. Required on create and optional on update. When specified on update, the new options will replace the existing options as a whole
    toPrincipals List<String>
    List of user or group names that the policy applies to. Required on create and optional on update
    updatedAt Number
    (integer) - Time at which the policy was last modified, in epoch milliseconds. Output only
    updatedBy String
    (string) - Username of the user who last modified the policy. Output only
    whenCondition String
    Optional condition when the policy should take effect

    Supporting Types

    PolicyInfoColumnMask, PolicyInfoColumnMaskArgs

    FunctionName string
    OnColumn string
    The alias of the column to be masked. The alias must refer to one of matched columns. The values of the column is passed to the column mask function as the first argument. Required on create and update
    Usings List<PolicyInfoColumnMaskUsing>
    FunctionName string
    OnColumn string
    The alias of the column to be masked. The alias must refer to one of matched columns. The values of the column is passed to the column mask function as the first argument. Required on create and update
    Usings []PolicyInfoColumnMaskUsing
    function_name string
    on_column string
    The alias of the column to be masked. The alias must refer to one of matched columns. The values of the column is passed to the column mask function as the first argument. Required on create and update
    usings list(object)
    functionName String
    onColumn String
    The alias of the column to be masked. The alias must refer to one of matched columns. The values of the column is passed to the column mask function as the first argument. Required on create and update
    usings List<PolicyInfoColumnMaskUsing>
    functionName string
    onColumn string
    The alias of the column to be masked. The alias must refer to one of matched columns. The values of the column is passed to the column mask function as the first argument. Required on create and update
    usings PolicyInfoColumnMaskUsing[]
    function_name str
    on_column str
    The alias of the column to be masked. The alias must refer to one of matched columns. The values of the column is passed to the column mask function as the first argument. Required on create and update
    usings Sequence[PolicyInfoColumnMaskUsing]
    functionName String
    onColumn String
    The alias of the column to be masked. The alias must refer to one of matched columns. The values of the column is passed to the column mask function as the first argument. Required on create and update
    usings List<Property Map>

    PolicyInfoColumnMaskUsing, PolicyInfoColumnMaskUsingArgs

    Alias string
    Constant string
    A constant literal
    FunctionArgExpression PolicyInfoColumnMaskUsingFunctionArgExpression
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    Alias string
    Constant string
    A constant literal
    FunctionArgExpression PolicyInfoColumnMaskUsingFunctionArgExpression
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    alias string
    constant string
    A constant literal
    function_arg_expression object
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    alias String
    constant String
    A constant literal
    functionArgExpression PolicyInfoColumnMaskUsingFunctionArgExpression
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    alias string
    constant string
    A constant literal
    functionArgExpression PolicyInfoColumnMaskUsingFunctionArgExpression
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    alias str
    constant str
    A constant literal
    function_arg_expression PolicyInfoColumnMaskUsingFunctionArgExpression
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    alias String
    constant String
    A constant literal
    functionArgExpression Property Map
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof

    PolicyInfoColumnMaskUsingFunctionArgExpression, PolicyInfoColumnMaskUsingFunctionArgExpressionArgs

    tag_introspection object
    An expression that introspects tags at query time
    tagIntrospection Property Map
    An expression that introspects tags at query time

    PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospection, PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionArgs

    column_tag_value object
    Extracts the value of a column-level tag
    tag_value object
    Extracts the value of a securable-level tag
    columnTagValue Property Map
    Extracts the value of a column-level tag
    tagValue Property Map
    Extracts the value of a securable-level tag

    PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionColumnTagValue, PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionColumnTagValueArgs

    ColumnAlias string
    The alias from MATCH COLUMNS that identifies the column
    TagKey string
    ColumnAlias string
    The alias from MATCH COLUMNS that identifies the column
    TagKey string
    column_alias string
    The alias from MATCH COLUMNS that identifies the column
    tag_key string
    columnAlias String
    The alias from MATCH COLUMNS that identifies the column
    tagKey String
    columnAlias string
    The alias from MATCH COLUMNS that identifies the column
    tagKey string
    column_alias str
    The alias from MATCH COLUMNS that identifies the column
    tag_key str
    columnAlias String
    The alias from MATCH COLUMNS that identifies the column
    tagKey String

    PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionTagValue, PolicyInfoColumnMaskUsingFunctionArgExpressionTagIntrospectionTagValueArgs

    TagKey string
    TagKey string
    tag_key string
    tagKey String
    tagKey string
    tagKey String

    PolicyInfoGrant, PolicyInfoGrantArgs

    Privileges List<string>
    List of privileges to grant. When any of these privileges are requested, the policy will grant access if the principal and condition match. Required on create and update
    Privileges []string
    List of privileges to grant. When any of these privileges are requested, the policy will grant access if the principal and condition match. Required on create and update
    privileges list(string)
    List of privileges to grant. When any of these privileges are requested, the policy will grant access if the principal and condition match. Required on create and update
    privileges List<String>
    List of privileges to grant. When any of these privileges are requested, the policy will grant access if the principal and condition match. Required on create and update
    privileges string[]
    List of privileges to grant. When any of these privileges are requested, the policy will grant access if the principal and condition match. Required on create and update
    privileges Sequence[str]
    List of privileges to grant. When any of these privileges are requested, the policy will grant access if the principal and condition match. Required on create and update
    privileges List<String>
    List of privileges to grant. When any of these privileges are requested, the policy will grant access if the principal and condition match. Required on create and update

    PolicyInfoMatchColumn, PolicyInfoMatchColumnArgs

    Alias string
    Condition string
    The condition expression used to match a table column
    Alias string
    Condition string
    The condition expression used to match a table column
    alias string
    condition string
    The condition expression used to match a table column
    alias String
    condition String
    The condition expression used to match a table column
    alias string
    condition string
    The condition expression used to match a table column
    alias str
    condition str
    The condition expression used to match a table column
    alias String
    condition String
    The condition expression used to match a table column

    PolicyInfoProviderConfig, PolicyInfoProviderConfigArgs

    WorkspaceId string
    Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
    WorkspaceId string
    Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
    workspace_id string
    Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
    workspaceId String
    Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
    workspaceId string
    Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
    workspace_id str
    Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
    workspaceId String
    Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.

    PolicyInfoRowFilter, PolicyInfoRowFilterArgs

    PolicyInfoRowFilterUsing, PolicyInfoRowFilterUsingArgs

    Alias string
    Constant string
    A constant literal
    FunctionArgExpression PolicyInfoRowFilterUsingFunctionArgExpression
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    Alias string
    Constant string
    A constant literal
    FunctionArgExpression PolicyInfoRowFilterUsingFunctionArgExpression
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    alias string
    constant string
    A constant literal
    function_arg_expression object
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    alias String
    constant String
    A constant literal
    functionArgExpression PolicyInfoRowFilterUsingFunctionArgExpression
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    alias string
    constant string
    A constant literal
    functionArgExpression PolicyInfoRowFilterUsingFunctionArgExpression
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    alias str
    constant str
    A constant literal
    function_arg_expression PolicyInfoRowFilterUsingFunctionArgExpression
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof
    alias String
    constant String
    A constant literal
    functionArgExpression Property Map
    An expression evaluated at query time. Wraps per-request expression variants (e.g., tag introspection) so new variants can be added without extending the FunctionArgument oneof

    PolicyInfoRowFilterUsingFunctionArgExpression, PolicyInfoRowFilterUsingFunctionArgExpressionArgs

    tag_introspection object
    An expression that introspects tags at query time
    tagIntrospection Property Map
    An expression that introspects tags at query time

    PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospection, PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionArgs

    column_tag_value object
    Extracts the value of a column-level tag
    tag_value object
    Extracts the value of a securable-level tag
    columnTagValue Property Map
    Extracts the value of a column-level tag
    tagValue Property Map
    Extracts the value of a securable-level tag

    PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionColumnTagValue, PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionColumnTagValueArgs

    ColumnAlias string
    The alias from MATCH COLUMNS that identifies the column
    TagKey string
    ColumnAlias string
    The alias from MATCH COLUMNS that identifies the column
    TagKey string
    column_alias string
    The alias from MATCH COLUMNS that identifies the column
    tag_key string
    columnAlias String
    The alias from MATCH COLUMNS that identifies the column
    tagKey String
    columnAlias string
    The alias from MATCH COLUMNS that identifies the column
    tagKey string
    column_alias str
    The alias from MATCH COLUMNS that identifies the column
    tag_key str
    columnAlias String
    The alias from MATCH COLUMNS that identifies the column
    tagKey String

    PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionTagValue, PolicyInfoRowFilterUsingFunctionArgExpressionTagIntrospectionTagValueArgs

    TagKey string
    TagKey string
    tag_key string
    tagKey String
    tagKey string
    tagKey String

    Package Details

    Repository
    databricks pulumi/pulumi-databricks
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the databricks Terraform Provider.
    databricks logo databricks logo
    Viewing docs for Databricks v1.109.0
    published on Tuesday, Sep 8, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-databricks

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial