Databricksの資格情報を作成してみた

## 前提
・利用環境：Databricks、AWS
・カスタムAWS構成（顧客管理VPC）を使用

https://www.databricks.com/jp/try-databricks?scid=7018Y000001Fi15QAC&utm_medium=paid+search&utm_source=google&utm_campaign=17377047998&utm_adgroup=138148229998&utm_content=trial&utm_offer=try-databricks&utm_ad=732035937815&utm_term=databricks%20%E3%83%88%E3%83%A9%E3%82%A4%E3%82%A2%E3%83%AB&gad_source=1&gclid=CjwKCAiA8Lu9BhA8EiwAag16b8b3zbkIb3V7gp-8VUwKukXnhtVZRQ-1RY8SbETmGVgNT4bQramYmRoCX5wQAvD_BwE#account

https://aws.amazon.com/jp/free/?gclid=CjwKCAiA8Lu9BhA8EiwAag16bz9ymovIOJzlwFFMfg75NQxxY8FJPB4Hslg7RheD7ipZ5gbvOWCd1RoCyP0QAvD_BwE&trk=8a8e7906-914d-4577-93a2-d09e75ae5941&sc_channel=ps&ef_id=CjwKCAiA8Lu9BhA8EiwAag16bz9ymovIOJzlwFFMfg75NQxxY8FJPB4Hslg7RheD7ipZ5gbvOWCd1RoCyP0QAvD_BwE:G:s&s_kwcid=AL!4422!3!487544183224!e!!g!!aws%20%E7%84%A1%E6%96%99%E5%88%A9%E7%94%A8%E6%9E%A0!11772965715!117413644991&all-free-tier.sort-by=item.additionalFields.SortRank&all-free-tier.sort-order=asc&awsf.Free%20Tier%20Types=*all&awsf.Free%20Tier%20Categories=*all

## 参考ヘルプ
https://docs.databricks.com/ja/admin/account-settings-e2/credentials.html#step-1
## 手順
### 1.AWSでIAMロールを設定
###### 1)AWS上で、IAMロールをクリック
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/562390/3be572cf-aa3a-4444-930e-d7b356c2c8e3.png)
###### 2)「ロール」→「ロールを作成」をクリック
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/562390/d5c4cb65-dc87-48de-93f7-aaa9b735e065.png)
###### 3)以下の内容を設定し、「次へ」→「次へ」をクリック
- 設定内容：
    - 信頼されたエンティティを選択：AWSアカウント
    - AWSアカウント：別のAWSアカウント
        - アカウントID：414351767826
    - ☑︎外部IDを要求する
        - 外部ID：DatabricksアカウントコンソールからコピーしたDatabricksアカウントID
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/562390/4eca6d33-ea15-4598-a08a-5df8307d2637.png)
###### 4)ロール名を入力し、「ロールを作成」をクリック
- 例：
    -ロール名： ho-iam-cross
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/562390/cde1c17d-7392-4ae1-9058-dfaa1a40b742.png)
###### 5)作成したロールを開き、「許可を追加」→「インラインポリシーを作成」をクリック
参考：

https://docs.databricks.com/ja/admin/account-settings-e2/credentials.html#option-2-customer-managed-vpc-with-default-restrictions-policy

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/562390/10adf884-a832-48a7-be2d-1951c6b24a15.png)
###### 6)JSONタブを選択し、以下のポリシーを貼り付ける(オプション 2: 顧客管理VPC with デフォルト restrictions ポリシー)
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1403287045000",
      "Effect": "Allow",
      "Action": [
        "ec2:AssociateIamInstanceProfile",
        "ec2:AttachVolume",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:CancelSpotInstanceRequests",
        "ec2:CreateTags",
        "ec2:CreateVolume",
        "ec2:DeleteTags",
        "ec2:DeleteVolume",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeIamInstanceProfileAssociations",
        "ec2:DescribeInstanceStatus",
        "ec2:DescribeInstances",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeNatGateways",
        "ec2:DescribeNetworkAcls",
        "ec2:DescribePrefixLists",
        "ec2:DescribeReservedInstancesOfferings",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSpotInstanceRequests",
        "ec2:DescribeSpotPriceHistory",
        "ec2:DescribeSubnets",
        "ec2:DescribeVolumes",
        "ec2:DescribeVpcAttribute",
        "ec2:DescribeVpcs",
        "ec2:DetachVolume",
        "ec2:DisassociateIamInstanceProfile",
        "ec2:ReplaceIamInstanceProfileAssociation",
        "ec2:RequestSpotInstances",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:RevokeSecurityGroupIngress",
        "ec2:RunInstances",
        "ec2:TerminateInstances",
        "ec2:DescribeFleetHistory",
        "ec2:ModifyFleet",
        "ec2:DeleteFleets",
        "ec2:DescribeFleetInstances",
        "ec2:DescribeFleets",
        "ec2:CreateFleet",
        "ec2:DeleteLaunchTemplate",
        "ec2:GetLaunchTemplateData",
        "ec2:CreateLaunchTemplate",
        "ec2:DescribeLaunchTemplates",
        "ec2:DescribeLaunchTemplateVersions",
        "ec2:ModifyLaunchTemplate",
        "ec2:DeleteLaunchTemplateVersions",
        "ec2:CreateLaunchTemplateVersion",
        "ec2:AssignPrivateIpAddresses",
        "ec2:GetSpotPlacementScores"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:CreateServiceLinkedRole",
        "iam:PutRolePolicy"
      ],
      "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "spot.amazonaws.com"
        }
      }
    }
  ]
}
```
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/562390/e49ab23b-464e-4b29-b80a-94032e2521a1.png)
###### 7)「次へ」をクリック
###### 8)ポリシー名を入力し、「ポリシーの作成」をクリック
- 例：
    - ポリシー名：ho-db-policy-cross
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/562390/2f3b5d50-892f-4c2a-bafe-da5271c499f8.png)
###### 9)上記のIAMロールのARNをコピー
### 2.Databricksで資格情報を作成
###### 1)Databricksの管理画面にサインインする
https://accounts.cloud.databricks.com/
###### 2)「クラウドリソース」→「資格情報の設定」タブ→「資格情報の設定を追加」をクリック
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/562390/0bf5c916-8f6f-42e8-863c-c6e65c114081.png)
###### 3)コピーしたARNをDatabricksの「ロールARN」欄に貼り付ける
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/562390/8ad5d14c-a5f3-4030-ba65-59ace6f90dc4.png)
###### 4)資格情報の設定名を入力し、「追加」をクリック
- 例：
    - 資格情報の設定名：ho-db-cred

以上