aws-databricks-base-infra

AWS Databricks Workspace

This Terraform module creates the necessary AWS resources for setting up a Databricks workspace.

Architecture Overview

Include:

1. An IAM cross-account role for Databricks to assume
2. An S3 bucket to serve as the root storage for Databricks
3. Necessary IAM policies and S3 bucket policies
4. VPC resources (implied by the outputs, but not directly created in the provided resource list)

How to use

Note
You can customize this module by adding, deleting or updating the AWS resources to adapt the module to your requirements. A deployment example using this module can be found in examples/aws-workspace-basic

How to use

1. Reference this module using one of the different module source types
2. Add terraform.tfvars with the information about the required input variables.

Requirements

Name	Version
aws	>=4.57.0
databricks	>=1.24.1

Providers

Name	Version
aws	>=4.57.0
databricks	>=1.24.1
databricks.mws	>=1.24.1

Modules

Name	Source	Version
vpc	terraform-aws-modules/vpc/aws	5.7.0
vpc_endpoints	terraform-aws-modules/vpc/aws//modules/vpc-endpoints	5.7.0

Resources

Name	Type
aws_iam_role.cross_account_role	resource
aws_iam_role_policy.this	resource
aws_s3_bucket.root_storage_bucket	resource
aws_s3_bucket_policy.root_bucket_policy	resource
aws_s3_bucket_public_access_block.root_storage_bucket	resource
aws_s3_bucket_server_side_encryption_configuration.root_storage_bucket	resource
aws_s3_bucket_versioning.versioning_example	resource
aws_availability_zones.available	data source
aws_iam_policy_document.this	data source
databricks_aws_assume_role_policy.this	data source
databricks_aws_bucket_policy.this	data source
databricks_aws_crossaccount_policy.this	data source

Inputs

Name	Description	Type	Default	Required
cidr_block	(Required) CIDR block for the VPC that will be used to create the Databricks workspace	string	n/a	yes
databricks_account_id	(Required) Databricks Account ID	string	n/a	yes
prefix	(Required) Prefix for the resources deployed by this module	string	n/a	yes
region	(Required) AWS region where the resources will be deployed	string	n/a	yes
roles_to_assume	(Optional) List of AWS roles that the cross account role can pass to the clusters (important when creating instance profiles)	list(string)	n/a	yes
tags	(Required) Map of tags to be applied to the kinesis stream	map(string)	n/a	yes

Outputs

Name	Description
cross_account_role_arn	AWS Cross account role arn
private_route_table_ids	IDs for the private route tables associated with this VPC
root_bucket	root bucket
security_group_ids	Security group ID for DB Compliant VPC
subnets	private subnets for workspace creation
vpc_id	VPC ID
vpc_main_route_table_id	ID for the main route table associated with this VPC