Project: KICS (Provisioning / Security & Compliance)
File: a4edb7e1-c0e0-4f7f-9d7c-d1b603e81ad5.md

title: Databricks Cluster or Job With None Or Insecure Permission(s) hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a4edb7e1-c0e0-4f7f-9d7c-d1b603e81ad5 Query name: Databricks Cluster or Job With None Or Insecure Permission(s) Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Databricks Cluster and Job must have restricted permissions<br> ```tf title="Positive test num. 1 - tf file" hl_lines="16" resource "databricks_job" "positive1" { name = "Featurization" maxconcurrentruns = 1 new_cluster { num_workers = 300 sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id } notebook_task { notebook_path = "/Production/MakeFeatures" } } resource "databricksjob" "positive1error" { name = "Featurization" maxconcurrentruns = 1 new_cluster { num_workers = 300 sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id } notebook_task { notebook_path = "/Production/MakeFeatures" } } resource "databricks_permissions" "positive1" { jobid = databricksjob.positive1.id access_control { group_name = "users" permissionlevel = "CANVIEW" } access_control { groupname = databricksgroup.auto.display_name permissionlevel = "CANMANAGE_RUN" } access_control { groupname = databricksgroup.eng.display_name permissionlevel = "CANMANAGE" } access_control { serviceprincipalname = databricksserviceprincipal.awsprincipal.applicationid permissionlevel = "ISOWNER" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="12" resource "databricks_cluster" "positive2" { cluster_name = "Shared Autoscaling" sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id autotermination_minutes = 60 autoscale { min_workers = 1 max_workers = 10 } } resource "databrickscluster" "positive2error" { cluster_name = "Shared Autoscaling" sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id autotermination_minutes = 60 autoscale { min_workers = 1 max_workers = 10 } } resource "databricks_permissions" "positive2" { clusterid = databrickscluster.positive2.id access_control { groupname = databricksgroup.auto.display_name permissionlevel = "CANATTACH_TO" } access_control { groupname = databricksgroup.eng.display_name permissionlevel = "CANRESTART" } access_control { groupname = databricksgroup.ds.display_name permissionlevel = "CANMANAGE" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="16" resource "databricks_job" "positive3" { name = "Featurization" maxconcurrentruns = 1 new_cluster { num_workers = 300 sparkversion = data.databricksspark_version.latest.id nodetypeid =

} notebook_task { notebook_path = "/Production/MakeFeatures" } } resource "databricks_permissions" "positive3" { jobid = databricksjob.positive3.id access_control { group_name = "users" permissionlevel = "CANVIEW" } access_control { groupname = databricksgroup.auto.display_name permissionlevel = "CANMANAGE_RUN" } access_control { groupname = databricksgroup.eng.display_name permissionlevel = "CANMANAGE" } access_control { groupname = databricksgroup.eng.display_name permissionlevel = "ISOWNER" } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="16" resource "databricks_job" "positive4" { name = "Featurization" maxconcurrentruns = 1 new_cluster { num_workers = 300 sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id } notebook_task { notebook_path = "/Production/MakeFeatures" } } resource "databricks_permissions" "positive4" { jobid = databricksjob.positive4.id access_control { groupname = databricksgroup.eng.display_name permissionlevel = "ISOWNER" } } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "databricks_job" "negative1" { name = "Featurization" maxconcurrentruns = 1 new_cluster { num_workers = 300 sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id } notebook_task { notebook_path = "/Production/MakeFeatures" } } resource "databricks_permissions" "negative1" { jobid = databricksjob.negative1.id access_control { group_name = "users" permissionlevel = "CANVIEW" } access_control { groupname = databricksgroup.auto.display_name permissionlevel = "CANMANAGE_RUN" } access_control { groupname = databricksgroup.eng.display_name permissionlevel = "CANMANAGE" } access_control { serviceprincipalname = databricksserviceprincipal.awsprincipal.applicationid permissionlevel = "ISOWNER" } } ``` ```tf title="Negative test num. 2 - tf file" resource "databricks_cluster" "negative2" { cluster_name = "Shared Autoscaling" sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id autotermination_minutes = 60 autoscale { min_workers = 1 max_workers = 10 } } resource "databricks_permissions" "negative2" { clusterid = databrickscluster.negative2.id access_control { groupname = databricksgroup.auto.display_name permissionlevel = "CANATTACH_TO" } access_control { groupname = databricksgroup.eng.display_name permissionlevel = "CANRESTART" } access_control { groupname = databricksgroup.ds.display_name permissionlevel = "CANMANAGE" } } ``` ```tf title="Negative test num. 3 - tf file" resource "databricks_job" "negative3" { name = "Featurization" maxconcurrentruns = 1 new_cluster { num_workers = 300 sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id } notebook_task { notebook_path = "/Production/MakeFeatures" } } resource "databricks_permissions" "negative3" { jobid = databricksjob.negative3.id access_control { serviceprincipalname = databricksserviceprincipal.awsprincipal.applicationid permissionlevel = "ISOWNER" } } ```