1. Packages
  2. Databricks Provider
  3. API Docs
  4. MwsCustomerManagedKeys
Viewing docs for Databricks v0.4.0 (Older version)
published on Monday, Mar 9, 2026 by Pulumi
Go to latest version
Schema (JSON)
pulumi/pulumi-databricks

databricks.MwsCustomerManagedKeys

databricks logo
Viewing docs for Databricks v0.4.0 (Older version)
published on Monday, Mar 9, 2026 by Pulumi
Go to latest version
Schema (JSON)
pulumi/pulumi-databricks

    The following resources are used in the same context:

    • Provisioning Databricks on AWS guide.
    • databricks.MwsCredentials to configure the cross-account role for creation of new workspaces within AWS.
    • databricks.MwsLogDelivery to configure delivery of billable usage logs and audit logs.
    • databricks.MwsNetworks to configure VPC & subnets for new workspaces within AWS.
    • databricks.MwsStorageConfigurations to configure root bucket new workspaces within AWS.
    • databricks.MwsWorkspaces to set up workspaces in E2 architecture on AWS.

    Example Usage

    Customer-managed key for managed services

    using Pulumi;
using Aws = Pulumi.Aws;
using Databricks = Pulumi.Databricks;

class MyStack : Stack
{
    public MyStack()
    {
        var config = new Config();
        var databricksAccountId = config.RequireObject<dynamic>("databricksAccountId");
        var databricksManagedServicesCmk = Output.Create(Aws.Iam.GetPolicyDocument.InvokeAsync(new Aws.Iam.GetPolicyDocumentArgs
        {
            Version = "2012-10-17",
            Statements = 
            {
                new Aws.Iam.Inputs.GetPolicyDocumentStatementArgs
                {
                    Sid = "Enable IAM User Permissions",
                    Effect = "Allow",
                    Principals = 
                    {
                        new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalArgs
                        {
                            Type = "AWS",
                            Identifiers = 
                            {
                                "*",
                            },
                        },
                    },
                    Actions = 
                    {
                        "kms:*",
                    },
                    Resources = 
                    {
                        "*",
                    },
                },
                new Aws.Iam.Inputs.GetPolicyDocumentStatementArgs
                {
                    Sid = "Allow Databricks to use KMS key for control plane managed services",
                    Effect = "Allow",
                    Principals = 
                    {
                        new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalArgs
                        {
                            Type = "AWS",
                            Identifiers = 
                            {
                                "arn:aws:iam::414351767826:root",
                            },
                        },
                    },
                    Actions = 
                    {
                        "kms:Encrypt",
                        "kms:Decrypt",
                    },
                    Resources = 
                    {
                        "*",
                    },
                },
            },
        }));
        var managedServicesCustomerManagedKey = new Aws.Kms.Key("managedServicesCustomerManagedKey", new Aws.Kms.KeyArgs
        {
            Policy = databricksManagedServicesCmk.Apply(databricksManagedServicesCmk => databricksManagedServicesCmk.Json),
        });
        var managedServicesCustomerManagedKeyAlias = new Aws.Kms.Alias("managedServicesCustomerManagedKeyAlias", new Aws.Kms.AliasArgs
        {
            TargetKeyId = managedServicesCustomerManagedKey.KeyId,
        });
        var managedServices = new Databricks.MwsCustomerManagedKeys("managedServices", new Databricks.MwsCustomerManagedKeysArgs
        {
            AccountId = databricksAccountId,
            AwsKeyInfo = new Databricks.Inputs.MwsCustomerManagedKeysAwsKeyInfoArgs
            {
                KeyArn = managedServicesCustomerManagedKey.Arn,
                KeyAlias = managedServicesCustomerManagedKeyAlias.Name,
            },
            UseCases = 
            {
                "MANAGED_SERVICES",
            },
        });
    }

}

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/iam"
	"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/kms"
	"github.com/pulumi/pulumi-databricks/sdk/go/databricks"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		cfg := config.New(ctx, "")
		databricksAccountId := cfg.RequireObject("databricksAccountId")
		databricksManagedServicesCmk, err := iam.GetPolicyDocument(ctx, &iam.GetPolicyDocumentArgs{
			Version: pulumi.StringRef("2012-10-17"),
			Statements: []iam.GetPolicyDocumentStatement{
				iam.GetPolicyDocumentStatement{
					Sid:    pulumi.StringRef("Enable IAM User Permissions"),
					Effect: pulumi.StringRef("Allow"),
					Principals: []iam.GetPolicyDocumentStatementPrincipal{
						iam.GetPolicyDocumentStatementPrincipal{
							Type: "AWS",
							Identifiers: []string{
								"*",
							},
						},
					},
					Actions: []string{
						"kms:*",
					},
					Resources: []string{
						"*",
					},
				},
				iam.GetPolicyDocumentStatement{
					Sid:    pulumi.StringRef("Allow Databricks to use KMS key for control plane managed services"),
					Effect: pulumi.StringRef("Allow"),
					Principals: []iam.GetPolicyDocumentStatementPrincipal{
						iam.GetPolicyDocumentStatementPrincipal{
							Type: "AWS",
							Identifiers: []string{
								"arn:aws:iam::414351767826:root",
							},
						},
					},
					Actions: []string{
						"kms:Encrypt",
						"kms:Decrypt",
					},
					Resources: []string{
						"*",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		managedServicesCustomerManagedKey, err := kms.NewKey(ctx, "managedServicesCustomerManagedKey", &kms.KeyArgs{
			Policy: pulumi.String(databricksManagedServicesCmk.Json),
		})
		if err != nil {
			return err
		}
		managedServicesCustomerManagedKeyAlias, err := kms.NewAlias(ctx, "managedServicesCustomerManagedKeyAlias", &kms.AliasArgs{
			TargetKeyId: managedServicesCustomerManagedKey.KeyId,
		})
		if err != nil {
			return err
		}
		_, err = databricks.NewMwsCustomerManagedKeys(ctx, "managedServices", &databricks.MwsCustomerManagedKeysArgs{
			AccountId: pulumi.Any(databricksAccountId),
			AwsKeyInfo: &MwsCustomerManagedKeysAwsKeyInfoArgs{
				KeyArn:   managedServicesCustomerManagedKey.Arn,
				KeyAlias: managedServicesCustomerManagedKeyAlias.Name,
			},
			UseCases: pulumi.StringArray{
				pulumi.String("MANAGED_SERVICES"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    Example coming soon!

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as databricks from "@pulumi/databricks";

const config = new pulumi.Config();
const databricksAccountId = config.requireObject("databricksAccountId");
const databricksManagedServicesCmk = aws.iam.getPolicyDocument({
    version: "2012-10-17",
    statements: [
        {
            sid: "Enable IAM User Permissions",
            effect: "Allow",
            principals: [{
                type: "AWS",
                identifiers: ["*"],
            }],
            actions: ["kms:*"],
            resources: ["*"],
        },
        {
            sid: "Allow Databricks to use KMS key for control plane managed services",
            effect: "Allow",
            principals: [{
                type: "AWS",
                identifiers: ["arn:aws:iam::414351767826:root"],
            }],
            actions: [
                "kms:Encrypt",
                "kms:Decrypt",
            ],
            resources: ["*"],
        },
    ],
});
const managedServicesCustomerManagedKey = new aws.kms.Key("managedServicesCustomerManagedKey", {policy: databricksManagedServicesCmk.then(databricksManagedServicesCmk => databricksManagedServicesCmk.json)});
const managedServicesCustomerManagedKeyAlias = new aws.kms.Alias("managedServicesCustomerManagedKeyAlias", {targetKeyId: managedServicesCustomerManagedKey.keyId});
const managedServices = new databricks.MwsCustomerManagedKeys("managedServices", {
    accountId: databricksAccountId,
    awsKeyInfo: {
        keyArn: managedServicesCustomerManagedKey.arn,
        keyAlias: managedServicesCustomerManagedKeyAlias.name,
    },
    useCases: ["MANAGED_SERVICES"],
});

    import pulumi
import pulumi_aws as aws
import pulumi_databricks as databricks

config = pulumi.Config()
databricks_account_id = config.require_object("databricksAccountId")
databricks_managed_services_cmk = aws.iam.get_policy_document(version="2012-10-17",
    statements=[
        aws.iam.GetPolicyDocumentStatementArgs(
            sid="Enable IAM User Permissions",
            effect="Allow",
            principals=[aws.iam.GetPolicyDocumentStatementPrincipalArgs(
                type="AWS",
                identifiers=["*"],
            )],
            actions=["kms:*"],
            resources=["*"],
        ),
        aws.iam.GetPolicyDocumentStatementArgs(
            sid="Allow Databricks to use KMS key for control plane managed services",
            effect="Allow",
            principals=[aws.iam.GetPolicyDocumentStatementPrincipalArgs(
                type="AWS",
                identifiers=["arn:aws:iam::414351767826:root"],
            )],
            actions=[
                "kms:Encrypt",
                "kms:Decrypt",
            ],
            resources=["*"],
        ),
    ])
managed_services_customer_managed_key = aws.kms.Key("managedServicesCustomerManagedKey", policy=databricks_managed_services_cmk.json)
managed_services_customer_managed_key_alias = aws.kms.Alias("managedServicesCustomerManagedKeyAlias", target_key_id=managed_services_customer_managed_key.key_id)
managed_services = databricks.MwsCustomerManagedKeys("managedServices",
    account_id=databricks_account_id,
    aws_key_info=databricks.MwsCustomerManagedKeysAwsKeyInfoArgs(
        key_arn=managed_services_customer_managed_key.arn,
        key_alias=managed_services_customer_managed_key_alias.name,
    ),
    use_cases=["MANAGED_SERVICES"])

    Example coming soon!

    Customer-managed key for workspace storage

    using Pulumi;
using Aws = Pulumi.Aws;
using Databricks = Pulumi.Databricks;

class MyStack : Stack
{
    public MyStack()
    {
        var config = new Config();
        var databricksAccountId = config.RequireObject<dynamic>("databricksAccountId");
        var databricksCrossAccountRole = config.RequireObject<dynamic>("databricksCrossAccountRole");
        var databricksStorageCmk = Output.Create(Aws.Iam.GetPolicyDocument.InvokeAsync(new Aws.Iam.GetPolicyDocumentArgs
        {
            Version = "2012-10-17",
            Statements = 
            {
                new Aws.Iam.Inputs.GetPolicyDocumentStatementArgs
                {
                    Sid = "Enable IAM User Permissions",
                    Effect = "Allow",
                    Principals = 
                    {
                        new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalArgs
                        {
                            Type = "AWS",
                            Identifiers = 
                            {
                                "*",
                            },
                        },
                    },
                    Actions = 
                    {
                        "kms:*",
                    },
                    Resources = 
                    {
                        "*",
                    },
                },
                new Aws.Iam.Inputs.GetPolicyDocumentStatementArgs
                {
                    Sid = "Allow Databricks to use KMS key for DBFS",
                    Effect = "Allow",
                    Principals = 
                    {
                        new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalArgs
                        {
                            Type = "AWS",
                            Identifiers = 
                            {
                                "arn:aws:iam::414351767826:root",
                            },
                        },
                    },
                    Actions = 
                    {
                        "kms:Encrypt",
                        "kms:Decrypt",
                        "kms:ReEncrypt*",
                        "kms:GenerateDataKey*",
                        "kms:DescribeKey",
                    },
                    Resources = 
                    {
                        "*",
                    },
                },
                new Aws.Iam.Inputs.GetPolicyDocumentStatementArgs
                {
                    Sid = "Allow Databricks to use KMS key for DBFS (Grants)",
                    Effect = "Allow",
                    Principals = 
                    {
                        new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalArgs
                        {
                            Type = "AWS",
                            Identifiers = 
                            {
                                "arn:aws:iam::414351767826:root",
                            },
                        },
                    },
                    Actions = 
                    {
                        "kms:CreateGrant",
                        "kms:ListGrants",
                        "kms:RevokeGrant",
                    },
                    Resources = 
                    {
                        "*",
                    },
                    Conditions = 
                    {
                        new Aws.Iam.Inputs.GetPolicyDocumentStatementConditionArgs
                        {
                            Test = "Bool",
                            Variable = "kms:GrantIsForAWSResource",
                            Values = 
                            {
                                "true",
                            },
                        },
                    },
                },
                new Aws.Iam.Inputs.GetPolicyDocumentStatementArgs
                {
                    Sid = "Allow Databricks to use KMS key for EBS",
                    Effect = "Allow",
                    Principals = 
                    {
                        new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalArgs
                        {
                            Type = "AWS",
                            Identifiers = 
                            {
                                databricksCrossAccountRole,
                            },
                        },
                    },
                    Actions = 
                    {
                        "kms:Decrypt",
                        "kms:GenerateDataKey*",
                        "kms:CreateGrant",
                        "kms:DescribeKey",
                    },
                    Resources = 
                    {
                        "*",
                    },
                    Conditions = 
                    {
                        new Aws.Iam.Inputs.GetPolicyDocumentStatementConditionArgs
                        {
                            Test = "ForAnyValue:StringLike",
                            Variable = "kms:ViaService",
                            Values = 
                            {
                                "ec2.*.amazonaws.com",
                            },
                        },
                    },
                },
            },
        }));
        var storageCustomerManagedKey = new Aws.Kms.Key("storageCustomerManagedKey", new Aws.Kms.KeyArgs
        {
            Policy = databricksStorageCmk.Apply(databricksStorageCmk => databricksStorageCmk.Json),
        });
        var storageCustomerManagedKeyAlias = new Aws.Kms.Alias("storageCustomerManagedKeyAlias", new Aws.Kms.AliasArgs
        {
            TargetKeyId = storageCustomerManagedKey.KeyId,
        });
        var storage = new Databricks.MwsCustomerManagedKeys("storage", new Databricks.MwsCustomerManagedKeysArgs
        {
            AccountId = databricksAccountId,
            AwsKeyInfo = new Databricks.Inputs.MwsCustomerManagedKeysAwsKeyInfoArgs
            {
                KeyArn = storageCustomerManagedKey.Arn,
                KeyAlias = storageCustomerManagedKeyAlias.Name,
            },
            UseCases = 
            {
                "STORAGE",
            },
        });
    }

}

    Example coming soon!

    Example coming soon!

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as databricks from "@pulumi/databricks";

const config = new pulumi.Config();
const databricksAccountId = config.requireObject("databricksAccountId");
const databricksCrossAccountRole = config.requireObject("databricksCrossAccountRole");
const databricksStorageCmk = aws.iam.getPolicyDocument({
    version: "2012-10-17",
    statements: [
        {
            sid: "Enable IAM User Permissions",
            effect: "Allow",
            principals: [{
                type: "AWS",
                identifiers: ["*"],
            }],
            actions: ["kms:*"],
            resources: ["*"],
        },
        {
            sid: "Allow Databricks to use KMS key for DBFS",
            effect: "Allow",
            principals: [{
                type: "AWS",
                identifiers: ["arn:aws:iam::414351767826:root"],
            }],
            actions: [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey",
            ],
            resources: ["*"],
        },
        {
            sid: "Allow Databricks to use KMS key for DBFS (Grants)",
            effect: "Allow",
            principals: [{
                type: "AWS",
                identifiers: ["arn:aws:iam::414351767826:root"],
            }],
            actions: [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant",
            ],
            resources: ["*"],
            conditions: [{
                test: "Bool",
                variable: "kms:GrantIsForAWSResource",
                values: ["true"],
            }],
        },
        {
            sid: "Allow Databricks to use KMS key for EBS",
            effect: "Allow",
            principals: [{
                type: "AWS",
                identifiers: [databricksCrossAccountRole],
            }],
            actions: [
                "kms:Decrypt",
                "kms:GenerateDataKey*",
                "kms:CreateGrant",
                "kms:DescribeKey",
            ],
            resources: ["*"],
            conditions: [{
                test: "ForAnyValue:StringLike",
                variable: "kms:ViaService",
                values: ["ec2.*.amazonaws.com"],
            }],
        },
    ],
});
const storageCustomerManagedKey = new aws.kms.Key("storageCustomerManagedKey", {policy: databricksStorageCmk.then(databricksStorageCmk => databricksStorageCmk.json)});
const storageCustomerManagedKeyAlias = new aws.kms.Alias("storageCustomerManagedKeyAlias", {targetKeyId: storageCustomerManagedKey.keyId});
const storage = new databricks.MwsCustomerManagedKeys("storage", {
    accountId: databricksAccountId,
    awsKeyInfo: {
        keyArn: storageCustomerManagedKey.arn,
        keyAlias: storageCustomerManagedKeyAlias.name,
    },
    useCases: ["STORAGE"],
});

    import pulumi
import pulumi_aws as aws
import pulumi_databricks as databricks

config = pulumi.Config()
databricks_account_id = config.require_object("databricksAccountId")
databricks_cross_account_role = config.require_object("databricksCrossAccountRole")
databricks_storage_cmk = aws.iam.get_policy_document(version="2012-10-17",
    statements=[
        aws.iam.GetPolicyDocumentStatementArgs(
            sid="Enable IAM User Permissions",
            effect="Allow",
            principals=[aws.iam.GetPolicyDocumentStatementPrincipalArgs(
                type="AWS",
                identifiers=["*"],
            )],
            actions=["kms:*"],
            resources=["*"],
        ),
        aws.iam.GetPolicyDocumentStatementArgs(
            sid="Allow Databricks to use KMS key for DBFS",
            effect="Allow",
            principals=[aws.iam.GetPolicyDocumentStatementPrincipalArgs(
                type="AWS",
                identifiers=["arn:aws:iam::414351767826:root"],
            )],
            actions=[
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey",
            ],
            resources=["*"],
        ),
        aws.iam.GetPolicyDocumentStatementArgs(
            sid="Allow Databricks to use KMS key for DBFS (Grants)",
            effect="Allow",
            principals=[aws.iam.GetPolicyDocumentStatementPrincipalArgs(
                type="AWS",
                identifiers=["arn:aws:iam::414351767826:root"],
            )],
            actions=[
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant",
            ],
            resources=["*"],
            conditions=[aws.iam.GetPolicyDocumentStatementConditionArgs(
                test="Bool",
                variable="kms:GrantIsForAWSResource",
                values=["true"],
            )],
        ),
        aws.iam.GetPolicyDocumentStatementArgs(
            sid="Allow Databricks to use KMS key for EBS",
            effect="Allow",
            principals=[aws.iam.GetPolicyDocumentStatementPrincipalArgs(
                type="AWS",
                identifiers=[databricks_cross_account_role],
            )],
            actions=[
                "kms:Decrypt",
                "kms:GenerateDataKey*",
                "kms:CreateGrant",
                "kms:DescribeKey",
            ],
            resources=["*"],
            conditions=[aws.iam.GetPolicyDocumentStatementConditionArgs(
                test="ForAnyValue:StringLike",
                variable="kms:ViaService",
                values=["ec2.*.amazonaws.com"],
            )],
        ),
    ])
storage_customer_managed_key = aws.kms.Key("storageCustomerManagedKey", policy=databricks_storage_cmk.json)
storage_customer_managed_key_alias = aws.kms.Alias("storageCustomerManagedKeyAlias", target_key_id=storage_customer_managed_key.key_id)
storage = databricks.MwsCustomerManagedKeys("storage",
    account_id=databricks_account_id,
    aws_key_info=databricks.MwsCustomerManagedKeysAwsKeyInfoArgs(
        key_arn=storage_customer_managed_key.arn,
        key_alias=storage_customer_managed_key_alias.name,
    ),
    use_cases=["STORAGE"])

    Example coming soon!

    Create MwsCustomerManagedKeys Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new MwsCustomerManagedKeys(name: string, args: MwsCustomerManagedKeysArgs, opts?: CustomResourceOptions);
    @overload
def MwsCustomerManagedKeys(resource_name: str,
                           args: MwsCustomerManagedKeysArgs,
                           opts: Optional[ResourceOptions] = None)

@overload
def MwsCustomerManagedKeys(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           account_id: Optional[str] = None,
                           aws_key_info: Optional[MwsCustomerManagedKeysAwsKeyInfoArgs] = None,
                           use_cases: Optional[Sequence[str]] = None,
                           creation_time: Optional[int] = None,
                           customer_managed_key_id: Optional[str] = None)
    func NewMwsCustomerManagedKeys(ctx *Context, name string, args MwsCustomerManagedKeysArgs, opts ...ResourceOption) (*MwsCustomerManagedKeys, error)
    public MwsCustomerManagedKeys(string name, MwsCustomerManagedKeysArgs args, CustomResourceOptions? opts = null)
    public MwsCustomerManagedKeys(String name, MwsCustomerManagedKeysArgs args)
public MwsCustomerManagedKeys(String name, MwsCustomerManagedKeysArgs args, CustomResourceOptions options)

    type: databricks:MwsCustomerManagedKeys
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args MwsCustomerManagedKeysArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args MwsCustomerManagedKeysArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args MwsCustomerManagedKeysArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args MwsCustomerManagedKeysArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args MwsCustomerManagedKeysArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var mwsCustomerManagedKeysResource = new Databricks.MwsCustomerManagedKeys("mwsCustomerManagedKeysResource", new()
{
    AccountId = "string",
    AwsKeyInfo = new Databricks.Inputs.MwsCustomerManagedKeysAwsKeyInfoArgs
    {
        KeyAlias = "string",
        KeyArn = "string",
        KeyRegion = "string",
    },
    UseCases = new[]
    {
        "string",
    },
    CreationTime = 0,
    CustomerManagedKeyId = "string",
});

    example, err := databricks.NewMwsCustomerManagedKeys(ctx, "mwsCustomerManagedKeysResource", &databricks.MwsCustomerManagedKeysArgs{
	AccountId: pulumi.String("string"),
	AwsKeyInfo: &databricks.MwsCustomerManagedKeysAwsKeyInfoArgs{
		KeyAlias:  pulumi.String("string"),
		KeyArn:    pulumi.String("string"),
		KeyRegion: pulumi.String("string"),
	},
	UseCases: pulumi.StringArray{
		pulumi.String("string"),
	},
	CreationTime:         pulumi.Int(0),
	CustomerManagedKeyId: pulumi.String("string"),
})

    var mwsCustomerManagedKeysResource = new MwsCustomerManagedKeys("mwsCustomerManagedKeysResource", MwsCustomerManagedKeysArgs.builder()
    .accountId("string")
    .awsKeyInfo(MwsCustomerManagedKeysAwsKeyInfoArgs.builder()
        .keyAlias("string")
        .keyArn("string")
        .keyRegion("string")
        .build())
    .useCases("string")
    .creationTime(0)
    .customerManagedKeyId("string")
    .build());

    mws_customer_managed_keys_resource = databricks.MwsCustomerManagedKeys("mwsCustomerManagedKeysResource",
    account_id="string",
    aws_key_info={
        "key_alias": "string",
        "key_arn": "string",
        "key_region": "string",
    },
    use_cases=["string"],
    creation_time=0,
    customer_managed_key_id="string")

    const mwsCustomerManagedKeysResource = new databricks.MwsCustomerManagedKeys("mwsCustomerManagedKeysResource", {
    accountId: "string",
    awsKeyInfo: {
        keyAlias: "string",
        keyArn: "string",
        keyRegion: "string",
    },
    useCases: ["string"],
    creationTime: 0,
    customerManagedKeyId: "string",
});

    type: databricks:MwsCustomerManagedKeys
properties:
    accountId: string
    awsKeyInfo:
        keyAlias: string
        keyArn: string
        keyRegion: string
    creationTime: 0
    customerManagedKeyId: string
    useCases:
        - string

    MwsCustomerManagedKeys Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The MwsCustomerManagedKeys resource accepts the following input properties:

    AccountId string
    Account Id that could be found in the bottom left corner of Accounts Console
    AwsKeyInfo MwsCustomerManagedKeysAwsKeyInfo
    This field is a block and is documented below.
    UseCases List<string>
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    CreationTime int
    (Integer) Time in epoch milliseconds when the customer key was created.
    CustomerManagedKeyId string
    (String) ID of the encryption key configuration object.
    AccountId string
    Account Id that could be found in the bottom left corner of Accounts Console
    AwsKeyInfo MwsCustomerManagedKeysAwsKeyInfoArgs
    This field is a block and is documented below.
    UseCases []string
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    CreationTime int
    (Integer) Time in epoch milliseconds when the customer key was created.
    CustomerManagedKeyId string
    (String) ID of the encryption key configuration object.
    accountId String
    Account Id that could be found in the bottom left corner of Accounts Console
    awsKeyInfo MwsCustomerManagedKeysAwsKeyInfo
    This field is a block and is documented below.
    useCases List<String>
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    creationTime Integer
    (Integer) Time in epoch milliseconds when the customer key was created.
    customerManagedKeyId String
    (String) ID of the encryption key configuration object.
    accountId string
    Account Id that could be found in the bottom left corner of Accounts Console
    awsKeyInfo MwsCustomerManagedKeysAwsKeyInfo
    This field is a block and is documented below.
    useCases string[]
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    creationTime number
    (Integer) Time in epoch milliseconds when the customer key was created.
    customerManagedKeyId string
    (String) ID of the encryption key configuration object.
    account_id str
    Account Id that could be found in the bottom left corner of Accounts Console
    aws_key_info MwsCustomerManagedKeysAwsKeyInfoArgs
    This field is a block and is documented below.
    use_cases Sequence[str]
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    creation_time int
    (Integer) Time in epoch milliseconds when the customer key was created.
    customer_managed_key_id str
    (String) ID of the encryption key configuration object.
    accountId String
    Account Id that could be found in the bottom left corner of Accounts Console
    awsKeyInfo Property Map
    This field is a block and is documented below.
    useCases List<String>
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    creationTime Number
    (Integer) Time in epoch milliseconds when the customer key was created.
    customerManagedKeyId String
    (String) ID of the encryption key configuration object.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the MwsCustomerManagedKeys resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing MwsCustomerManagedKeys Resource

    Get an existing MwsCustomerManagedKeys resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: MwsCustomerManagedKeysState, opts?: CustomResourceOptions): MwsCustomerManagedKeys
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_id: Optional[str] = None,
        aws_key_info: Optional[MwsCustomerManagedKeysAwsKeyInfoArgs] = None,
        creation_time: Optional[int] = None,
        customer_managed_key_id: Optional[str] = None,
        use_cases: Optional[Sequence[str]] = None) -> MwsCustomerManagedKeys
    func GetMwsCustomerManagedKeys(ctx *Context, name string, id IDInput, state *MwsCustomerManagedKeysState, opts ...ResourceOption) (*MwsCustomerManagedKeys, error)
    public static MwsCustomerManagedKeys Get(string name, Input<string> id, MwsCustomerManagedKeysState? state, CustomResourceOptions? opts = null)
    public static MwsCustomerManagedKeys get(String name, Output<String> id, MwsCustomerManagedKeysState state, CustomResourceOptions options)
    resources:  _:    type: databricks:MwsCustomerManagedKeys    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountId string
    Account Id that could be found in the bottom left corner of Accounts Console
    AwsKeyInfo MwsCustomerManagedKeysAwsKeyInfo
    This field is a block and is documented below.
    CreationTime int
    (Integer) Time in epoch milliseconds when the customer key was created.
    CustomerManagedKeyId string
    (String) ID of the encryption key configuration object.
    UseCases List<string>
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    AccountId string
    Account Id that could be found in the bottom left corner of Accounts Console
    AwsKeyInfo MwsCustomerManagedKeysAwsKeyInfoArgs
    This field is a block and is documented below.
    CreationTime int
    (Integer) Time in epoch milliseconds when the customer key was created.
    CustomerManagedKeyId string
    (String) ID of the encryption key configuration object.
    UseCases []string
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    accountId String
    Account Id that could be found in the bottom left corner of Accounts Console
    awsKeyInfo MwsCustomerManagedKeysAwsKeyInfo
    This field is a block and is documented below.
    creationTime Integer
    (Integer) Time in epoch milliseconds when the customer key was created.
    customerManagedKeyId String
    (String) ID of the encryption key configuration object.
    useCases List<String>
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    accountId string
    Account Id that could be found in the bottom left corner of Accounts Console
    awsKeyInfo MwsCustomerManagedKeysAwsKeyInfo
    This field is a block and is documented below.
    creationTime number
    (Integer) Time in epoch milliseconds when the customer key was created.
    customerManagedKeyId string
    (String) ID of the encryption key configuration object.
    useCases string[]
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    account_id str
    Account Id that could be found in the bottom left corner of Accounts Console
    aws_key_info MwsCustomerManagedKeysAwsKeyInfoArgs
    This field is a block and is documented below.
    creation_time int
    (Integer) Time in epoch milliseconds when the customer key was created.
    customer_managed_key_id str
    (String) ID of the encryption key configuration object.
    use_cases Sequence[str]
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:
    accountId String
    Account Id that could be found in the bottom left corner of Accounts Console
    awsKeyInfo Property Map
    This field is a block and is documented below.
    creationTime Number
    (Integer) Time in epoch milliseconds when the customer key was created.
    customerManagedKeyId String
    (String) ID of the encryption key configuration object.
    useCases List<String>
    (since v0.3.4) List of use cases for which this key will be used. If you've used the resource before, please add use_cases = ["MANAGED_SERVICES"] to keep the previous behaviour. Possible values are:

    Supporting Types

    MwsCustomerManagedKeysAwsKeyInfo, MwsCustomerManagedKeysAwsKeyInfoArgs

    KeyAlias string
    The AWS KMS key alias.
    KeyArn string
    The AWS KMS key's Amazon Resource Name (ARN).
    KeyRegion string
    (Computed) The AWS region in which KMS key is deployed to. This is not required.
    KeyAlias string
    The AWS KMS key alias.
    KeyArn string
    The AWS KMS key's Amazon Resource Name (ARN).
    KeyRegion string
    (Computed) The AWS region in which KMS key is deployed to. This is not required.
    keyAlias String
    The AWS KMS key alias.
    keyArn String
    The AWS KMS key's Amazon Resource Name (ARN).
    keyRegion String
    (Computed) The AWS region in which KMS key is deployed to. This is not required.
    keyAlias string
    The AWS KMS key alias.
    keyArn string
    The AWS KMS key's Amazon Resource Name (ARN).
    keyRegion string
    (Computed) The AWS region in which KMS key is deployed to. This is not required.
    key_alias str
    The AWS KMS key alias.
    key_arn str
    The AWS KMS key's Amazon Resource Name (ARN).
    key_region str
    (Computed) The AWS region in which KMS key is deployed to. This is not required.
    keyAlias String
    The AWS KMS key alias.
    keyArn String
    The AWS KMS key's Amazon Resource Name (ARN).
    keyRegion String
    (Computed) The AWS region in which KMS key is deployed to. This is not required.

    Import

    -> Note Importing this resource is not currently supported.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    databricks pulumi/pulumi-databricks
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the databricks Terraform Provider.
    databricks logo
    Viewing docs for Databricks v0.4.0 (Older version)
    published on Monday, Mar 9, 2026 by Pulumi
    Go to latest version
    Schema (JSON)
    pulumi/pulumi-databricks
      Try Pulumi Cloud free. Your team will thank you.