Handle UC Resource Grants with Spaces

catalog/permissions/permissions.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"log"
+	"strings"
 	"time"
 
 	"github.com/databricks/databricks-sdk-go"
@@ -144,3 +145,13 @@ func SliceWithoutString(in []string, without string) (out []string) {
 	}
 	return
 }
+
+// If a privilege/permission only differs with underscores replacing spaces
+// then we can suppress the change
+func PrivilegesSuppressWhitespaceChange(k, old, new string, _ *schema.ResourceData) bool {
+	if (new == strings.ReplaceAll(old, " ", "_")) || (old == strings.ReplaceAll(new, " ", "_")) {
+		log.Printf("[DEBUG] Ignoring configuration drift from %s to %s", old, new)
+		return true
+	}
+	return false
+}

catalog/resource_grant.go

@@ -15,13 +15,24 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
 
+// normalizePrivileges return an array of catalog.Privilege with privilege values normalized to match API behavior
+func normalizePrivileges(privileges []catalog.Privilege) []catalog.Privilege {
+	normalizedPrivileges := []catalog.Privilege{}
+	for _, p := range privileges {
+		normalizedPriv := strings.ReplaceAll(p.String(), " ", "_")
+		normalizedPrivileges = append(normalizedPrivileges, catalog.Privilege(normalizedPriv))
+	}
+	return normalizedPrivileges
+}
+
 // diffPermissionsForPrincipal returns an array of catalog.PermissionsChange of this permissions list with `diff` privileges removed
 func diffPermissionsForPrincipal(principal string, desired catalog.PermissionsList, existing catalog.PermissionsList) (diff []catalog.PermissionsChange) {
 	// diffs change sets for principal
 	configured := map[string]*schema.Set{}
 	for _, v := range desired.PrivilegeAssignments {
 		if v.Principal == principal {
-			configured[v.Principal] = permissions.SliceToSet(v.Privileges)
+			normalizedPrivileges := normalizePrivileges(v.Privileges)
+			configured[v.Principal] = permissions.SliceToSet(normalizedPrivileges)
 		}
 	}
 	// existing permissions that needs removal for principal
@@ -122,7 +133,6 @@ func parseSecurableId(d *schema.ResourceData) (string, string, string, error) {
 func ResourceGrant() common.Resource {
 	s := common.StructToSchema(permissions.UnityCatalogPrivilegeAssignment{},
 		func(m map[string]*schema.Schema) map[string]*schema.Schema {
-
 			m["principal"].ForceNew = true
 
 			allFields := []string{}
@@ -138,6 +148,9 @@ func ResourceGrant() common.Resource {
 					ConflictsWith: permissions.SliceWithoutString(allFields, field),
 				}
 			}
+
+			m["privileges"].DiffSuppressFunc = permissions.PrivilegesSuppressWhitespaceChange
+
 			return m
 		})
 

catalog/resource_grant_test.go

@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/databricks/terraform-provider-databricks/catalog/permissions"
 	"github.com/databricks/terraform-provider-databricks/qa"
 	"github.com/stretchr/testify/assert"
 )
@@ -585,6 +586,29 @@ func TestResourceGrantPermissionsList_Diff_LocalRemoteDiff(t *testing.T) {
 	assert.Equal(t, catalog.Privilege("c"), diff[0].Remove[0])
 }
 
+func TestResourceGrantPermissionsList_Diff_Spaces(t *testing.T) {
+	diff := diffPermissionsForPrincipal(
+		"a",
+		catalog.PermissionsList{ // config
+			PrivilegeAssignments: []catalog.PrivilegeAssignment{
+				{
+					Principal:  "a",
+					Privileges: []catalog.Privilege{"a b"},
+				},
+			},
+		},
+		catalog.PermissionsList{
+			PrivilegeAssignments: []catalog.PrivilegeAssignment{ // platform
+				{
+					Principal:  "a",
+					Privileges: []catalog.Privilege{"a_b"},
+				},
+			},
+		},
+	)
+	assert.Len(t, diff, 0)
+}
+
 func TestResourceGrantShareGrantCreate(t *testing.T) {
 	qa.ResourceFixture{
 		Fixtures: []qa.HTTPFixture{
@@ -834,3 +858,10 @@ func TestResourceGrantModelGrantCreate(t *testing.T) {
 		`,
 	}.ApplyNoError(t)
 }
+
+func TestPrivilegesSuppressWhitespaceChange(t *testing.T) {
+	assert.True(t, permissions.PrivilegesSuppressWhitespaceChange("", "a", "a", nil))
+	assert.True(t, permissions.PrivilegesSuppressWhitespaceChange("", "a_b", "a b", nil))
+	assert.True(t, permissions.PrivilegesSuppressWhitespaceChange("", "a b", "a_b", nil))
+	assert.False(t, permissions.PrivilegesSuppressWhitespaceChange("", "a", "b", nil))
+}

catalog/resource_grants.go

@@ -30,8 +30,14 @@ type PermissionsList struct {
 func diffPermissions(pl catalog.PermissionsList, existing catalog.PermissionsList) (diff []catalog.PermissionsChange) {
 	// diffs change sets
 	configured := map[string]*schema.Set{}
+	// normalize the configured privileges to match API behavior by treating spaces as underscores
 	for _, v := range pl.PrivilegeAssignments {
-		configured[v.Principal] = permissions.SliceToSet(v.Privileges)
+		normalizedPrivileges := []catalog.Privilege{}
+		for _, p := range v.Privileges {
+			normalizedPriv := strings.ReplaceAll(p.String(), " ", "_")
+			normalizedPrivileges = append(normalizedPrivileges, catalog.Privilege(normalizedPriv))
+		}
+		configured[v.Principal] = permissions.SliceToSet(normalizedPrivileges)
 	}
 	// existing permissions that needs removal
 	remote := map[string]*schema.Set{}
@@ -80,6 +86,7 @@ func replaceAllPermissions(a permissions.UnityCatalogPermissionsAPI, securable s
 	if err != nil {
 		return err
 	}
+
 	err = a.UpdatePermissions(securableType, name, diffPermissions(list, *existing))
 	if err != nil {
 		return err
@@ -128,6 +135,9 @@ func parseId(d *schema.ResourceData) (string, string, error) {
 func ResourceGrants() common.Resource {
 	s := common.StructToSchema(PermissionsList{},
 		func(s map[string]*schema.Schema) map[string]*schema.Schema {
+
+			common.CustomizeSchemaPath(s, "grant", "privileges").SetCustomSuppressDiff(permissions.PrivilegesSuppressWhitespaceChange)
+
 			alof := []string{}
 			for field := range permissions.Mappings {
 				s[field] = &schema.Schema{
@@ -137,6 +147,7 @@ func ResourceGrants() common.Resource {
 				}
 				alof = append(alof, field)
 			}
+
 			for field := range permissions.Mappings {
 				s[field].AtLeastOneOf = alof
 			}

catalog/resource_grants_test.go

@@ -444,6 +444,28 @@ func TestPermissionsList_Diff_LocalRemoteDiff(t *testing.T) {
 	assert.Equal(t, catalog.Privilege("c"), diff[0].Remove[0])
 }
 
+func TestPermissionsList_Diff_Spaces(t *testing.T) {
+	diff := diffPermissions(
+		catalog.PermissionsList{ // config
+			PrivilegeAssignments: []catalog.PrivilegeAssignment{
+				{
+					Principal:  "a",
+					Privileges: []catalog.Privilege{"a b"},
+				},
+			},
+		},
+		catalog.PermissionsList{
+			PrivilegeAssignments: []catalog.PrivilegeAssignment{ // platform
+				{
+					Principal:  "a",
+					Privileges: []catalog.Privilege{"a_b"},
+				},
+			},
+		},
+	)
+	assert.Len(t, diff, 0)
+}
+
 func TestShareGrantCreate(t *testing.T) {
 	qa.ResourceFixture{
 		Fixtures: []qa.HTTPFixture{

common/resource.go

@@ -442,7 +442,6 @@ var NoAuth string = "default auth: cannot configure default credentials, " +
 func AddAccountIdField(s map[string]*schema.Schema) map[string]*schema.Schema {
 	s["account_id"] = &schema.Schema{
 		Type:       schema.TypeString,
-		Computed:   true,
 		Optional:   true,
 		Deprecated: "Configuring `account_id` at the resource-level is deprecated; please specify it in the `provider {}` configuration block instead",
 	}

internal/acceptance/grant_test.go

@@ -134,3 +134,27 @@ func TestUcAccGrantForIdChange(t *testing.T) {
 		ExpectError: regexp.MustCompile(`cannot create grant: Privilege abc is not applicable to this entity`),
 	})
 }
+
+func grantTemplateForUnderscoreChange(permission string) string {
+	return fmt.Sprintf(`
+	resource "databricks_storage_credential" "external" {
+		name = "cred-{var.STICKY_RANDOM}-hyphens"
+		aws_iam_role {
+			role_arn = "{env.TEST_METASTORE_DATA_ACCESS_ARN}"
+		}
+		comment = "Managed by TF"
+	}
+
+	resource "databricks_grant" "cred" {
+		storage_credential = databricks_storage_credential.external.id
+		principal  = "{env.TEST_DATA_ENG_GROUP}"
+		privileges = ["%s"]
+	}
+	`, permission)
+}
+
+func TestUcAccGrantForUnderscoreChange(t *testing.T) {
+	unityWorkspaceLevel(t, step{
+		Template: grantTemplateForUnderscoreChange("ALL PRIVILEGES"),
+	})
+}

internal/acceptance/grants_test.go

@@ -142,3 +142,29 @@ func TestUcAccGrantsForIdChange(t *testing.T) {
 		ExpectError: regexp.MustCompile(`Error: cannot create grants: Privilege abc is not applicable to this entity`),
 	})
 }
+
+func grantsTemplateForUnderscoreChange(permission string) string {
+	return fmt.Sprintf(`
+	resource "databricks_storage_credential" "external" {
+		name = "cred-{var.STICKY_RANDOM}-underscores"
+		aws_iam_role {
+			role_arn = "{env.TEST_METASTORE_DATA_ACCESS_ARN}"
+		}
+		comment = "Managed by TF"
+	}
+
+	resource "databricks_grants" "cred" {
+		storage_credential = databricks_storage_credential.external.id
+		grant {
+			principal  = "{env.TEST_DATA_ENG_GROUP}"
+			privileges = ["%s"]
+		}
+	}
+	`, permission)
+}
+
+func TestUcAccGrantsForUnderscoreChange(t *testing.T) {
+	unityWorkspaceLevel(t, step{
+		Template: grantsTemplateForUnderscoreChange("ALL PRIVILEGES"),
+	})
+}