[Databricks on AWS #2] RBAC on Databricks: Function-Role Groups, Workspace Assignment, and Why USER/ADMIN Isn't the Whole Story

Short summary

Design Databricks RBAC by creating function-role groups to abstract permissions, assigning each to workspaces (ADMIN/USER), and keeping user membership outside IaC to avoid redeployment churn. Databricks provides four permission primitives; you design the subjects—the groups. Apply group definitions before workspace assignments or risk silent dependency failures.

• •Create function-role groups (ai_admin, ai_engineer, ai_analyst) as the single layer you control; Databricks provides four other permission layers built-in
• •Assign groups to workspaces (ADMIN/USER) in IaC; manage user membership separately via console/SCIM to avoid constant pull requests
• •Apply group definitions before workspace assignment stack or dependencies silently resolve to empty assignments

Generated with AI, which can make mistakes.