github.com/databricks/terraform-provider-databricks

New Features and Improvements

• Add resource and data sources for databricks_account_iam_direct_group_member_v2.
• Add resource and data sources for databricks_account_iam_group_v2.
• Add resource and data sources for databricks_account_iam_service_principal_v2.
• Add resource and data sources for databricks_account_iam_user_v2.
• Add resource and data sources for databricks_account_iam_workspace_assignment_v2.
• Add resource and data sources for databricks_workspace_iam_direct_group_member_v2.
• Add resource and data sources for databricks_workspace_iam_group_v2.
• Add resource and data sources for databricks_workspace_iam_service_principal_v2.
• Add resource and data sources for databricks_workspace_iam_user_v2.
• Add resource and data sources for databricks_workspace_iam_workspace_assignment_v2.
• Add resource and data source for databricks_workspace_iam_workspace_identity_detail_v2.

Documentation

• Document Genie budgets on databricks_budget with shared vs per-user examples, and blocking usage (#5946)

Exporter

• Automatically skip interactive mode when -services or -listing options is specified (#5900).

New Features and Improvements

• Add resource and data sources for databricks_account_iam_direct_group_member_v2.
• Add resource and data sources for databricks_account_iam_group_v2.
• Add resource and data sources for databricks_account_iam_service_principal_v2.
• Add resource and data sources for databricks_account_iam_user_v2.
• Add resource and data sources for databricks_account_iam_workspace_assignment_v2.
• Add resource and data sources for databricks_workspace_iam_direct_group_member_v2.
• Add resource and data sources for databricks_workspace_iam_group_v2.
• Add resource and data sources for databricks_workspace_iam_service_principal_v2.
• Add resource and data sources for databricks_workspace_iam_user_v2.
• Add resource and data sources for databricks_workspace_iam_workspace_assignment_v2.
• Add resource and data source for databricks_workspace_iam_workspace_identity_detail_v2.

Documentation

• Document Genie budgets on databricks_budget with shared vs per-user examples, and blocking usage (#5946)

Exporter

• Automatically skip interactive mode when -services or -listing options is specified (#5900).

New Features and Improvements

• Add support for model_service, mcp_service, and model_provider_service securables in databricks_grant and databricks_grants (#5941).

Bug Fixes

• Fixed databricks_share failing with produced an unexpected new value: .comment when a share's comment is set or removed outside of Terraform (e.g. in the UI). The comment attribute is now Optional+Computed, so an out-of-band value is adopted into state instead of erroring, while comment = "" still explicitly clears the description.

Documentation

• Document the roles/group.assumer role for group rule sets in databricks_access_control_rule_set (#5924).

New Features and Improvements

• Add support for model_service, mcp_service, and model_provider_service securables in databricks_grant and databricks_grants (#5941).

Bug Fixes

• Fixed databricks_share failing with produced an unexpected new value: .comment when a share's comment is set or removed outside of Terraform (e.g. in the UI). The comment attribute is now Optional+Computed, so an out-of-band value is adopted into state instead of erroring, while comment = "" still explicitly clears the description.

Documentation

• Document the roles/group.assumer role for group rule sets in databricks_access_control_rule_set (#5924).

Bug Fixes

• Honor config.DefaultHostMetadataResolverFactory during provider configuration (#5940).
• Fix perpetual databricks_share plan diff and null id by restoring the resource id on read and update (#5934).

Bug Fixes

• Honor config.DefaultHostMetadataResolverFactory during provider configuration (#5940).
• Fix perpetual databricks_share plan diff and null id by restoring the resource id on read and update (#5934).

New Features and Improvements

• Add optional git_credential_id attribute to databricks_repo resource to allow explicit credential selection (#5877).

• For workspace-level hosts, resolve and validate the provider's workspace_id from the host's /.well-known/databricks-config discovery metadata instead of a SCIM /Me call (#5922).

  This removes the authenticated /Me request on workspace hosts (avoiding false failures for service principals that can manage resources but cannot call /Me), and makes a workspace_id that disagrees with the host fail at plan time instead of at apply. Hosts whose metadata does not advertise a workspace_id fall back to the previous /Me behavior.

New Features and Improvements

• Add optional git_credential_id attribute to databricks_repo resource to allow explicit credential selection (#5877).

• For workspace-level hosts, resolve and validate the provider's workspace_id from the host's /.well-known/databricks-config discovery metadata instead of a SCIM /Me call (#5922).

  This removes the authenticated /Me request on workspace hosts (avoiding false failures for service principals that can manage resources but cannot call /Me), and makes a workspace_id that disagrees with the host fail at plan time instead of at apply. Hosts whose metadata does not advertise a workspace_id fall back to the previous /Me behavior.

New Features and Improvements

• Add resource and data sources for databricks_ai_gateway_model_service.
• Add resource and data sources for databricks_ai_gateway_model_provider_service.
• Add resource and data sources for databricks_ai_gateway_mcp_service.

New Features and Improvements

• Add resource and data sources for databricks_ai_gateway_model_service.
• Add resource and data sources for databricks_ai_gateway_model_provider_service.
• Add resource and data sources for databricks_ai_gateway_mcp_service.

Important Changes

• Removed plan-time workspace_id reachability validation for unified-provider
  resources (#5887).

  workspace_id reachability and mismatch errors (e.g. workspace_id mismatch,
  managing workspace-level resources requires a workspace_id) are now reported
  when the resource is applied instead of during terraform plan. Plans no longer
  make workspace-resolution API calls for these checks. This fixes false-positive
  plan failures for principals that can manage a resource but cannot call the
  workspace /Me endpoint, and for provider_config.workspace_id values that are
  only known after apply (for example a workspace_id sourced from another
  resource that is created in the same run). For newly-created workspace-level
  resources this removes plan-time workspace API calls entirely; existing
  resources still refresh at plan (an unavoidable read), which validates the
  workspace they already live in.

New Features and Improvements

• Add databricks_recipients data source to list Delta Sharing recipient names.
• Add trace_location to databricks_mlflow_experiment for storing experiment traces in a Unity Catalog schema (#5869). The block is immutable (ForceNew); table_prefix is optional and, when omitted, server-defaulted, with the resolved value exposed on the read-only effective_table_prefix.

Bug Fixes

• Fix updating a column comment on a VIEW in databricks_sql_table (#5855). The provider emitted ALTER VIEW ... ALTER COLUMN ... COMMENT, which Databricks rejects with a PARSE_SYNTAX_ERROR, leaving the change stuck as a perpetual, un-appliable diff. Column comment changes on views are now applied in place via COMMENT ON COLUMN, matching how column comments on tables are updated.
• Fix databricks_access_control_rule_set drift detection when all grant_rules are removed outside Terraform (#5589).

Internal Changes

• A provider-level workspace_id is now consistently validated when a
  workspace-level resource acquires its client, regardless of whether the value
  came from the resource's provider_config block or the provider configuration
  (#5887).

  Previously a workspace-level provider silently ignored a mismatched
  provider-level workspace_id when a resource omitted provider_config. It now
  surfaces a workspace_id mismatch error at apply, matching the behavior when
  provider_config.workspace_id is set explicitly. For the common case where the
  provider-level workspace_id matches the configured workspace (including when
  it is auto-resolved from host metadata) there is no change.

Important Changes

• Removed plan-time workspace_id reachability validation for unified-provider resources (#5887).

  workspace_id reachability and mismatch errors (e.g. workspace_id mismatch, managing workspace-level resources requires a workspace_id) are now reported when the resource is applied instead of during terraform plan. Plans no longer make workspace-resolution API calls for these checks. This fixes false-positive plan failures for principals that can manage a resource but cannot call the workspace /Me endpoint, and for provider_config.workspace_id values that are only known after apply (for example a workspace_id sourced from another resource that is created in the same run). For newly-created workspace-level resources this removes plan-time workspace API calls entirely; existing resources still refresh at plan (an unavoidable read), which validates the workspace they already live in.

New Features and Improvements

• Add databricks_recipients data source to list Delta Sharing recipient names.
• Add trace_location to databricks_mlflow_experiment for storing experiment traces in a Unity Catalog schema (#5869). The block is immutable (ForceNew); table_prefix is optional and, when omitted, server-defaulted, with the resolved value exposed on the read-only effective_table_prefix.

Bug Fixes

• Fix updating a column comment on a VIEW in databricks_sql_table (#5855). The provider emitted ALTER VIEW ... ALTER COLUMN ... COMMENT, which Databricks rejects with a PARSE_SYNTAX_ERROR, leaving the change stuck as a perpetual, un-appliable diff. Column comment changes on views are now applied in place via COMMENT ON COLUMN, matching how column comments on tables are updated.
• Fix databricks_access_control_rule_set drift detection when all grant_rules are removed outside Terraform (#5589).

Internal Changes

• A provider-level workspace_id is now consistently validated when a workspace-level resource acquires its client, regardless of whether the value came from the resource's provider_config block or the provider configuration (#5887).

  Previously a workspace-level provider silently ignored a mismatched provider-level workspace_id when a resource omitted provider_config. It now surfaces a workspace_id mismatch error at apply, matching the behavior when provider_config.workspace_id is set explicitly. For the common case where the provider-level workspace_id matches the configured workspace (including when it is auto-resolved from host metadata) there is no change.

New Features and Improvements

• Add resource and data sources for databricks_postgres_cdf_config.
• Add data sources for databricks_postgres_cdf_status.

Bug Fixes

• Fix updating a column comment on a VIEW in databricks_sql_table (#5855). The provider emitted ALTER VIEW ... ALTER COLUMN ... COMMENT, which Databricks rejects with a PARSE_SYNTAX_ERROR, leaving the change stuck as a perpetual, un-appliable diff. Column comment changes on views are now applied in place via COMMENT ON COLUMN, matching how column comments on tables are updated.

New Features and Improvements

• Add resource and data sources for databricks_postgres_cdf_config.
• Add data sources for databricks_postgres_cdf_status.

Bug Fixes

• Fix updating a column comment on a VIEW in databricks_sql_table (#5855). The provider emitted ALTER VIEW ... ALTER COLUMN ... COMMENT, which Databricks rejects with a PARSE_SYNTAX_ERROR, leaving the change stuck as a perpetual, un-appliable diff. Column comment changes on views are now applied in place via COMMENT ON COLUMN, matching how column comments on tables are updated.

Important Changes

• [Backward Incompatible] Resource databricks_mws_ncc_private_endpoint_rule has been refactored in this version to fix multiple bugs in its implementation and behavior. Server-populated attributes are now strictly read-only (writes that previously produced perpetual plan drift now error at plan time), plan churn on previously-Optional output fields is eliminated, and the new Plugin Framework implementation (behind DATABRICKS_TF_ENABLED_PF_RESOURCES) polls the rule's connection_state during Create so a failed or unusable provisioning state surfaces at apply time instead of on the next plan. See Breaking Changes and New Features and Improvements below for specifics.

Breaking Changes

• Tighten read-only attributes on databricks_mws_ncc_private_endpoint_rule (#5819). The attributes rule_id, account_id, endpoint_name, vpc_endpoint_id, connection_state, creation_time, updated_time, deactivated, deactivated_at, error_message, and gcp_endpoint.psc_endpoint_uri are now computed-only and can no longer be set in HCL. They are populated by the server in every API response (and psc_endpoint_uri is unconditionally overwritten from the cloud-platform truth on every read), and previous releases accepted writes to these attributes silently while the API ignored or overwrote the values, producing perpetual drift on every plan. Configurations that explicitly assigned any of these attributes must remove the assignment; the value is still available in state after apply.

New Features and Improvements

• A Plugin Framework implementation of databricks_mws_ncc_private_endpoint_rule is now available behind DATABRICKS_TF_ENABLED_PF_RESOURCES=databricks_mws_ncc_private_endpoint_rule (#5819). Once opted in, terraform apply waits for the rule to leave CREATING before returning: PENDING and ESTABLISHED succeed, while a CREATE_FAILED, REJECTED, DISCONNECTED, or EXPIRED connection state surfaces as an apply-time error instead of on the next plan. This differs from the SDKv2 implementation, which returns immediately without polling. The Plugin Framework implementation will replace the SDKv2 implementation in a follow-up version.
• Deprecate the SDKv2 fallback implementations of databricks_library, databricks_quality_monitor, and databricks_share resources, and the databricks_share, databricks_shares, and databricks_volumes data sources. These resources have been served by the Plugin Framework by default since their migration; the SDKv2 implementations remain only as opt-in fallbacks via the USE_SDK_V2_RESOURCES / USE_SDK_V2_DATA_SOURCES environment variables. Setting either environment variable for any of these names now emits a runtime warning (visible with TF_LOG=WARN or higher), and the SDKv2 implementations will be removed in the next major release of the provider.
• Add resource and data sources for databricks_ai_search_endpoint.
• Add resource and data sources for databricks_ai_search_index.
• Add clear_cloud_attributes_on_remove to databricks_cluster (#5812). When set to true, removing a cloud attributes block (aws_attributes, azure_attributes, gcp_attributes) from the configuration clears it instead of the removal being silently suppressed. The flag defaults to false, preserving the existing diff-suppression behavior that prevents perpetual drift from platform-returned cloud attribute defaults. Keeping a block, even partially specified, is unaffected; only removing the whole block clears.

Bug Fixes

• Fix import for jobs with >100 tasks (#5417).

Documentation

• Added an example to databricks_budget for creating budgets to control Genie usage costs (#5817).

Exporter

• Generate code in import.sh more safely (#5848).

Internal Changes

• Deprecate instance_profiles attribute, and replace it with roles in databricks_group data source (#5086)

Important Changes

• [Backward Incompatible] Resource databricks_mws_ncc_private_endpoint_rule has been refactored in this version to fix multiple bugs in its implementation and behavior. Server-populated attributes are now strictly read-only (writes that previously produced perpetual plan drift now error at plan time), plan churn on previously-Optional output fields is eliminated, and the new Plugin Framework implementation (behind DATABRICKS_TF_ENABLED_PF_RESOURCES) polls the rule's connection_state during Create so a failed or unusable provisioning state surfaces at apply time instead of on the next plan. See Breaking Changes and New Features and Improvements below for specifics.

Breaking Changes

• Tighten read-only attributes on databricks_mws_ncc_private_endpoint_rule (#5819). The attributes rule_id, account_id, endpoint_name, vpc_endpoint_id, connection_state, creation_time, updated_time, deactivated, deactivated_at, error_message, and gcp_endpoint.psc_endpoint_uri are now computed-only and can no longer be set in HCL. They are populated by the server in every API response (and psc_endpoint_uri is unconditionally overwritten from the cloud-platform truth on every read), and previous releases accepted writes to these attributes silently while the API ignored or overwrote the values, producing perpetual drift on every plan. Configurations that explicitly assigned any of these attributes must remove the assignment; the value is still available in state after apply.

New Features and Improvements

• A Plugin Framework implementation of databricks_mws_ncc_private_endpoint_rule is now available behind DATABRICKS_TF_ENABLED_PF_RESOURCES=databricks_mws_ncc_private_endpoint_rule (#5819). Once opted in, terraform apply waits for the rule to leave CREATING before returning: PENDING and ESTABLISHED succeed, while a CREATE_FAILED, REJECTED, DISCONNECTED, or EXPIRED connection state surfaces as an apply-time error instead of on the next plan. This differs from the SDKv2 implementation, which returns immediately without polling. The Plugin Framework implementation will replace the SDKv2 implementation in a follow-up version.
• Deprecate the SDKv2 fallback implementations of databricks_library, databricks_quality_monitor, and databricks_share resources, and the databricks_share, databricks_shares, and databricks_volumes data sources. These resources have been served by the Plugin Framework by default since their migration; the SDKv2 implementations remain only as opt-in fallbacks via the USE_SDK_V2_RESOURCES / USE_SDK_V2_DATA_SOURCES environment variables. Setting either environment variable for any of these names now emits a runtime warning (visible with TF_LOG=WARN or higher), and the SDKv2 implementations will be removed in the next major release of the provider.
• Add resource and data sources for databricks_ai_search_endpoint.
• Add resource and data sources for databricks_ai_search_index.
• Add clear_cloud_attributes_on_remove to databricks_cluster (#5812). When set to true, removing a cloud attributes block (aws_attributes, azure_attributes, gcp_attributes) from the configuration clears it instead of the removal being silently suppressed. The flag defaults to false, preserving the existing diff-suppression behavior that prevents perpetual drift from platform-returned cloud attribute defaults. Keeping a block, even partially specified, is unaffected; only removing the whole block clears.

Bug Fixes

• Fix import for jobs with >100 tasks (#5417).

Documentation

• Added an example to databricks_budget for creating budgets to control Genie usage costs (#5817).

Exporter

• Generate code in import.sh more safely (#5848).

Internal Changes

• Deprecate instance_profiles attribute, and replace it with roles in databricks_group data source (#5086)

New Features and Improvements

• Add resource and data source for databricks_postgres_data_api.

• Deprecate the SDKv2 fallback implementations of databricks_library, databricks_quality_monitor, and databricks_share resources, and the databricks_share, databricks_shares, and databricks_volumes data sources. These resources have been served by the Plugin Framework by default since their migration; the SDKv2 implementations remain only as opt-in fallbacks via the USE_SDK_V2_RESOURCES / USE_SDK_V2_DATA_SOURCES environment variables. Setting either environment variable for any of these names now emits a runtime warning (visible with TF_LOG=WARN or higher), and the SDKv2 implementations will be removed in the next major release of the provider.

Bug Fixes

• Fix permanent permissions drift when user_name casing in databricks_permissions access_control blocks differs from the API response (#5757).

• Allow setting user_api_scopes = [] on databricks_app to disable OBO (On-Behalf-Of) user authorization (#5834).

  The Apps API omits user_api_scopes from its response when OBO is inactive, so a configured empty list previously failed with Provider produced inconsistent result after apply. The provider now preserves a configured empty list in state, mirroring the reconciliation used by databricks_app_space.

Internal Changes

• Make notification destination acceptance tests robust to the eventual consistency of the notification destinations list API.

New Features and Improvements

• Add resource and data source for databricks_postgres_data_api.

• Deprecate the SDKv2 fallback implementations of databricks_library, databricks_quality_monitor, and databricks_share resources, and the databricks_share, databricks_shares, and databricks_volumes data sources. These resources have been served by the Plugin Framework by default since their migration; the SDKv2 implementations remain only as opt-in fallbacks via the USE_SDK_V2_RESOURCES / USE_SDK_V2_DATA_SOURCES environment variables. Setting either environment variable for any of these names now emits a runtime warning (visible with TF_LOG=WARN or higher), and the SDKv2 implementations will be removed in the next major release of the provider.

Bug Fixes

• Fix permanent permissions drift when user_name casing in databricks_permissions access_control blocks differs from the API response (#5757).

• Allow setting user_api_scopes = [] on databricks_app to disable OBO (On-Behalf-Of) user authorization (#5834).

  The Apps API omits user_api_scopes from its response when OBO is inactive, so a configured empty list previously failed with Provider produced inconsistent result after apply. The provider now preserves a configured empty list in state, mirroring the reconciliation used by databricks_app_space.

Internal Changes

• Make notification destination acceptance tests robust to the eventual consistency of the notification destinations list API.

Documentation

• Document that read-only workspace bindings aren't applicable for non-catalog objects (#5611)

Internal Changes

• Run unit tests offline from a pre-warmed Go module cache for PRs that cannot authenticate to the internal Go module proxy (fork and Dependabot PRs), populated by the new "Warm Go Cache" workflow.

New Features and Improvements

• Add resource and data sources for databricks_ai_search_endpoint.
• Add resource and data sources for databricks_ai_search_index.

Bug Fixes

• Fixed databricks_instance_pool ignoring enable_elastic_disk = false due to omitempty JSON tag, which caused an infinite plan/replace cycle (#5802).

• Fix databricks_entitlements to honor provider_config { workspace_id } when used with an account-level provider (#5680).

• Fix spurious account_id drift on databricks_mws_ncc_private_endpoint_rule (#5347). The backend echoes account_id on read; the schema previously marked it as a plain Optional attribute, so once it landed in state (for example via terraform import) the next plan reported account_id = "..." -> null and a subsequent apply failed with cannot update mws ncc private endpoint rule: Update mask must be specified.. Marking account_id as Computed (matching the sibling databricks_mws_network_connectivity_config resource) preserves the server-provided value across refreshes and eliminates the spurious in-place update.

• Fixed databricks_mws_workspaces failing to update private_access_settings_id and other fields on GCP workspaces (#5430).

Documentation

• Added disabled field to task block in databricks_job resource, allowing individual tasks to be disabled (#5767).

Exporter

• Rewrote Exporter logging so it works with Databricks Go SDK logging (#5805).

Bug Fixes

• Fix databricks_external_location so that creating a resource with enable_file_events = false is sent in the POST request. Previously the field was silently dropped (Go SDK marshals the bool with omitempty), so the server applied its true default and effective_enable_file_events came back true.

New Features and Improvements

• Added principal_id argument to databricks_git_credential resource, enabling management of Git credentials on behalf of service principals.
• Add support for managing permissions of Agent Bricks resources (#5708). Reverts #5582.

Bug Fixes

• Fix databricks_metastore so that updating external_access_enabled from true to false is sent in the PATCH request. Previously the field was silently dropped from the request body, so the change never reached the API.
• Fixed destroying of UC objects when workspace binding removed before actual destroy (#5581).
• Fixed handling of the case when library is removed outside of Terraform (#5678).
• Fix databricks_vector_search_index hardcoded 15-minute creation timeout: increased default to 75 minutes (consistent with databricks_vector_search_endpoint) and made it user-overridable via the timeouts block.
• Fixed child groups collection in databricks_group data source (#5679).

Documentation

• Document that some databricks_mws_* resources on GCP require Google-issued OIDC tokens (not Databricks OAuth) (#5654).
• Remove non-existent field from the databricks_vector_search_index doc (#5605).
• Documented principal_id argument for databricks_git_credential resource.

Exporter

• Support alert_task when exporting databricks_job (#5629).
• Add support for exporting Agent Bricks resources (#5704).

Internal Changes

• Add internal/retrier package for unified retry and backoff handling (#5746).

• Pass excludedAttributes=entitlements on SCIM /Me requests (#5725).

• workspace_id (provider attribute and provider_config.workspace_id block) now accepts workspace connection IDs in addition to classic numeric workspace IDs. On unified Databricks hosts, the platform gateway disambiguates the value server-side via the X-Databricks-Workspace-Id request header. The previous positive-integer validator has been relaxed to require only a non-empty string.

  Numeric workspace IDs continue to behave exactly as before, including the account-API workspace-deployment lookup. Connection IDs skip that lookup and route directly via the configured host. When the provider is configured at the workspace level (host + token), connection IDs surface a clear error directing the user to reconfigure with account-level credentials, since a workspace-level provider can only operate on a single workspace.

Bug Fixes

• Fix databricks_library, databricks_share, and databricks_quality_monitor failing to decode prior state with Error decoding ... from prior state: missing expected { after upgrading from v1.113.0 to v1.114.0 (#5669). Reverts #5582.

  Note for users upgrading from v1.114.0: any state written by v1.114.0 for databricks_library, databricks_share, or databricks_quality_monitor encodes provider_config as a single object instead of a list, and terraform plan against the upgraded provider will fail to decode it. Mitigate with a one-time edit of each affected resource instance in your state file: change the provider_config value from the object form to either the list form or null.

  • If you set provider_config explicitly in HCL: change "provider_config": {"workspace_id": "X"} to "provider_config": [{"workspace_id": "X"}] (wrap the existing object in a single-element list).
  • If you did NOT set provider_config in HCL: change "provider_config": {"workspace_id": "X"} to "provider_config": null. This avoids a one-time replacement plan on databricks_library (where the block-level plan modifier forces replacement on any provider_config diff).

  Users on v1.113.0 are unaffected — their state already matches the restored schema.

• Fix databricks_service_principal data source failing on account-level provider with cannot populate provider_config for service principal: failed to resolve workspace_id (#5664). The data source now supports the api field and skips workspace-tracking when used at account level.

• Fix databricks_service_principals data source failing on account-level provider with the same cannot populate provider_config for service principals: failed to resolve workspace_id regression (#5664). The data source now supports the api field and skips workspace-tracking when used at account level.

• Fix databricks_mws_workspaces and databricks_mws_credentials data sources failing on account-level provider with cannot populate provider_config for mws workspaces: failed to resolve workspace_id (#5672). These account-only data sources are now exempted from the post-Read workspace-tracking hook, and provider_config (which had no effect on them) is now deprecated and will be removed in a future major release.

• Fix databricks_disable_legacy_features_setting failing on account-level provider with cannot populate provider_config for disable legacy features setting: failed to resolve workspace_id: ... Unable to load OAuth Config. This account-only setting is now exempted from the post-Read workspace-tracking hook, and the auto-injected provider_config block is deprecated. The fix is applied at the generic-setting builder level (makeSettingResource in settings/generic_setting.go), so any future accountSetting-based resource inherits the opt-out automatically.

New Features and Improvements

• Add resource and data sources for databricks_disaster_recovery_failover_group.
• Add resource and data sources for databricks_disaster_recovery_stable_url.
• Add resource and data sources for databricks_supervisor_agent.
• Add resource and data sources for databricks_supervisor_agent_tool.
• Add resource and data sources for databricks_secret_uc.
• Support adopting pre-existing databricks_postgres_branch and databricks_postgres_endpoint resources via replace_existing = true argument.

Internal Changes

• Update Go SDK to v0.128.0.
• Bump minimum Go toolchain from 1.24.0 to 1.25.7 to pick up the crypto/tls TLS 1.3 session-resumption fix.
• Fail at plan time with "please set api to account or workspace" for dual workspace/account resources when the provider is configured against a unified host and the resource's api field is not set.

New Features and Improvements

• Add resource and data source for databricks_postgres_catalog.

• Add resource and data source for databricks_postgres_synced_table.

• Add resource and data sources for databricks_environments_workspace_base_environment.

• Add resource and data source for databricks_environments_default_workspace_base_environment.

• Added optional cloud argument to databricks_current_config data source to explicitly set the cloud type (aws, azure, gcp) instead of relying on host-based detection.

• Added api field to dual account/workspace resources (databricks_user, databricks_service_principal, databricks_group, databricks_group_role, databricks_group_member, databricks_user_role, databricks_service_principal_role, databricks_user_instance_profile, databricks_group_instance_profile, databricks_metastore, databricks_metastore_assignment, databricks_metastore_data_access, databricks_storage_credential, databricks_service_principal_secret, databricks_access_control_rule_set) to explicitly control whether account-level or workspace-level APIs are used. This enables support for unified hosts like api.databricks.com where the API level cannot be inferred from the host (#5483).

Bug Fixes

• Fixed import inconsistency for force_destroy and other schema-only fields causing "Provider produced inconsistent final plan" errors (#5487).

• Fixed databricks_grant and databricks_grants to honor provider_config when using account-level providers (#5557).

  Fixes #5530.

Internal Changes

• Update Go SDK to v0.127.0.
• Use account host check instead of account ID check in databricks_access_control_rule_set to determine client type (#5484).

New Features and Improvements

• Add resource and data sources for databricks_postgres_role.

New Features and Improvements

• Added databricks_postgres_database resource and data source.
• Renamed databricks_apps_space to databricks_app_space.
• Added databricks_data_classification_catalog_config resource and data source.
• Added databricks_knowledge_assistant resource and data source.
• Added databricks_knowledge_assistant_knowledge_source resource and data source.

Documentation

• Added documentation note about whitespace handling in MAP column types for databricks_sql_table.

Internal Changes

• Host-agnostic cloud detection via node type patterns, replacing host-URL-based IsAws()/IsAzure()/IsGcp() checks.
• Use workspace GetStatus API to check parent folder existence before creating Lakeview dashboards, replacing fragile error string matching.
• Use workspace GetStatus API to check parent folder existence before uploading workspace files, replacing fragile error string matching.
• Skip TestMwsAccNetworkConnectivityConfig test to unblock merging PRs in the repository
• Use workspace GetStatus API to check parent folder existence before importing notebooks, replacing fragile error string matching.

New Features and Improvements

• Changed default AWS availability for auto-created utility clusters from SPOT to SPOT_WITH_FALLBACK (API default). SPOT_WITH_FALLBACK improves reliability by falling back to on-demand instances when spot capacity is unavailable. Affects internal clusters created by databricks_aws_s3_mount, databricks_mount, databricks_sql_permissions, databricks_sql_table, and the exporter.

Bug Fixes

• Mark plaintext credential fields in databricks_model_serving as sensitive to prevent them from being displayed in plan/apply output (#5409).
• Mark personal_access_token as sensitive in databricks_git_credential to prevent the value from being displayed in plan and apply output (#5395).

Internal Changes

• Add support for host agnostic SQL global config resource.
• Update Go SDK to v0.113.

Bug Fixes

• Mark effective_enable_file_events as read-only in databricks_external_location to prevent Terraform drift.

New Features and Improvements

• Added database_project_name to databricks_permissions for managing Lakebase database project permissions.
• Added node_type_flexibility block to databricks_instance_pool resource (#5381).

Bug Fixes

• Handle error during WorkspaceClient() creation in databricks_grant and databricks_grants resources (#5403)

Documentation

• Added note to databricks_mws_ncc_binding that a workspace can only have one NCC binding at a time.

Internal Changes

• Update Go SDK to v0.110.

New Features and Improvements

• Added resources and data sources for databricks_app_space and databricks_endpoint (#5397).

Internal Changes

• Update Go SDK to v0.108.0.

New Features and Improvements

• Support for payload bigger than 10Mb in databricks_workspace_file (#5293)
• Add role_arn field to databricks_mws_storage_configurations resource to support sharing S3 buckets between root storage and Unity Catalog (#5222)

Bug Fixes

• Fix the databricks_mws_ncc_private_endpoint_rule resource to support updates for non-S3 endpoint rules (#5326)
• Prevent users from locking themselves out of managing a secret scope in databricks_secret_acl (#5373).
• [Fix] databricks_app resource fail to read app when deleted outside terraform (#5365)
• Fixed databricks_users data source extra_attributes parameter issues (#5308): (1) Single-attribute inputs (e.g., extra_attributes = "active") were silently ignored at account level due to incorrect value quoting. (2) Complex multi-valued attributes like emails and roles returned null at account level even when explicitly requested in extra_attributes. (3) extra_attributes were not forwarded to the SCIM API at workspace level.
• Fix databricks_app resource fail to read app when deleted outside terraform (#5365)

Documentation

• Add run_as configuration block documentation to databricks_pipeline resource (#5342)
• Document driver_node_type_flexibility and worker_node_type_flexibility in databricks_cluster (#5379)

Internal Changes

• Change default value for delta_sharing_recipient_token_lifetime_in_seconds from 0 to 31536000 (1 year) (#5296)
• Update Go SDK to v0.106.0.

Breaking Changes

• Return empty string for data_source_id in databricks_sql_warehouse and databricks_sql_endpoint if data source API call fails (#5312)

New Features and Improvements

• Allow the cluster_size argument to be specified as "5X-Large" in databricks_sql_warehouse
• Update the maximum allowed value for max_num_clusters argument in databricks_sql_warehouse to 40 (see API docs for details).

Bug Fixes

• Dashboard File Content Change Detection When Using file_path ([#5359])(https://github.com/databricks/terraform-provider-databricks/pull/5359)
• Fix permanent drift in databricks_model_serving when using *_plaintext credential fields for external models (#5125)

Documentation

• Mark data_source_id as deprecated in databricks_sql_warehouse and databricks_sql_endpoint (#5312)

Exporter

• Add exporting for RFA destinations and Delta Sharing providers (#5337)

Internal Changes

• Update Go SDK to v0.104.0.

New Features and Improvements

• Added resources and data sources for databricks_account_user_setting_v2 and databricks_default_warehouse_override (#5329).

Bug Fixes

• Fix importing of the databricks_share (#5311)
• Fix databricks_dashboard resource to include dataset_catalog and dataset_schema when retrying creation after parent folder creation (#5327)

Exporter

• Rewrite cloud-specific attributes and node types in cluster policy definitions when using -targetCloud flag (#5297).
• Added support for databricks_account_network_policy and databricks_workspace_network_option resources (#5238).
• Rewrite exporting of databricks_share to plugin framework (#5328)

Internal Changes

• Add support for unified host, migrate IsAccountClient to HostType

Bug Fixes

• Fixed databricks_dashboard resource to detect content changes when using the file_path attribute. Previously, only changes to the path string itself triggered updates, not changes to the file content.

New Features and Improvements

• Added resources and data sources for databricks_postgres_project, databricks_postgres_endpoint and databricks_postgres_branch (#5305).

Bug Fixes

• [Fix] Allow Updating Share Objects With shared_as Defined (#5287)

Internal Changes

• Switch to use Go SDK struct in databricks_metastore resource (#5088)

New Features and Improvements

• Handle new fields in databricks_pipeline resource (#5249)
• Recreate databricks_credential on the name change (#5248).
• Allow to specify default catalog and schema for databricks_dashboard (#5259).

Bug Fixes

• Fix retrieving of latest DBR versions in databricks_spark_version (#5255)
• Reset PO flag for non-managed UC Catalogs (#5260).

Documentation

• Add missing GCP IAM permission topics.detachSubscription for Databricks file events (#5269)

Exporter

• Added -targetCloud and -nodeTypeMappingFile flags for cross-cloud attribute and node-type conversion (#5236).

Internal Changes

• Update Go SDK to v0.94.0.

New Features and Improvements

• Added databricks_workspace_entity_tag_assignment resource and data source (#5252)

Internal Changes

• Update Go SDK to v0.93.0 (#5252)
• Bump github.com/hashicorp/terraform-plugin-testing from 1.13.3 to 1.14.0 (#5254)
• Bump google.golang.org/api from 0.256.0 to 0.257.0 (#5253)

New Features and Improvements

• Relaxed force_new constraint on catalog attribute in databricks_pipeline resource to allow changing the default catalog for existing pipelines (#5180).
• Add databricks_users data source (#4028)
• Improve databricks_service_principals data source (#5164)
• Add feature_engineering_kafka_config resource and data source (#5240)

Bug Fixes

• Fix spurious plan diffs in databricks_model_serving and databricks_model_serving_provisioned_throughput resources due to tag reordering (#5120)
• Move Spark Version selector defaults to Terraform (#5219).

Documentation

• Document tag policies in databricks_access_control_rule_set (#5209).
• Document missing aws_attributes.ebs_* properties in databricks_cluster (#5196).
• Document support for serverless workspaces on GCP (#5124)
• Document data object types for share resource (#5244)

Exporter

• Added support for databricks_data_quality_monitor resource (#5193).
• Added support for databricks_account_federation_policy, databricks_custom_app_integration, databricks_quality_monitor_v2, databricks_service_principal_federation_policy resources (#5237).
• Added support for databricks_budget_policy resource (#5217).
• Fix typo in the name of environment variable (#5158).
• Export permission assignments on workspace level (#5169).
• Added support for UC Tag policies (#5213).
• Added support for Databricks Apps resources (#5208).
• Added support for Database Instance resource (aka Lakebase) (#5212).
• Added support for workspace and account settings v2 (#5230).

Internal Changes

• Update Go SDK to v0.92.0 (#5240)
• Bump github.com/hashicorp/terraform-plugin-framework from 1.16.1 to 1.17.0 (#5247)

Bug Fixes

• Fixed spurious diffs in databricks_model_serving and databricks_model_serving_provisioned_throughput resources when the API returns served_models or served_entities in a different order than specified in the configuration (#5188).

Documentation

• Explain that special characters in URLs should be percent-encoded (#5178).
• Improve documentation about preloaded_docker_images.basic_auth in databricks_cluster and databricks_instance_pool (#5154).

Exporter

• Support exporting of databricks_mws_ncc_binding (#5184).
• Initial support for resources implemented with plugin framework (#5176).

Internal Changes

• Add client support in CustomizeDiff for SDKv2 resources and data sources (#5171).

New Features and Improvements

• Add provider_config support for manual plugin framework resources and data sources(#5127)

• Added support for custom instance profiles on instance pools on AWS (#5144)

• Add feature_engineering_materialized_feature resource and data sources(#5166)

Bug Fixes

• Remove unnecessary SetSuppressDiff() for workload_size in databricks_model_serving (#5152).

Documentation

• Fix missing GCP IAM permissions for workspace creation in GCP guides (#5123).

Internal Changes

• Caching group membership in databricks_group_member to improve performance (#4581).

Breaking Changes

• Remove recipient_federation_policy resource and datasources (#5126)

New Features and Improvements

• Add provider_config support for SDKv2 compatible plugin framework resources and data sources(#5115)
• Optimize databricks_grant and databricks_grants to not call the Update API if the requested permissions are already granted (#5095)
• Added expected_workspace_status to databricks_mws_workspaces to support creating workspaces in provisioning status (#5019)

Bug Fixes

• Mark workload_size as not computed in databricks_model_serving (#5111)
• Fix Inconsistent Plan Errors in Permissions Resource (#5091)

Documentation

• Add documentation on the service_principal_client_id attribute of databricks_app and related #5134

Exporter

• Remove METRIC_VIEW from sql_table resource (#5135)

Internal Changes

• Fix custom_app_integration_test (#5129)