CREATE EXTERNAL LOCATION Permission Error Despite Service Principal Having Account & Metastore Admin Roles

[haleyyyblue]

Summary

When attempting to create an External Location using the Databricks Terraform provider, the operation fails with a permission error—even if the Service Principal (SP) has both Account Admin and Metastore Admin roles.

Error Message

│ Error: cannot create external location: User does not have CREATE EXTERNAL LOCATION on Metastore 'haley_metastore'.
│
│ with module.prod_environment.databricks_external_location.uc_external_location,
│ on modules/environment/external_location.tf line 21, in resource "databricks_external_location" "uc_external_location":
│ 21: resource "databricks_external_location" "uc_external_location" {

Expected Behavior

The SP with Account Admin and Metastore Admin roles should be able to create an External Location without needing additional manual permission configuration.

Actual Behavior

The operation fails unless explicit permission (CREATE EXTERNAL LOCATION) is granted to the SP in the Metastore via the Databricks UI.

Steps to Reproduce

1. Assign Account Admin and Metastore Admin roles to a Service Principal.
2. Attempt to create an External Location using Terraform and the databricks_external_location resource.
3. Observe the permission error during apply.
4. Manually grant CREATE EXTERNAL LOCATION on the metastore to the SP through the Databricks UI.
5. Re-run terraform apply – it succeeds.

Workaround

Manually assign CREATE EXTERNAL LOCATION permission to the Service Principal in the Metastore before applying.

Terraform Version

Terraform v1.8.2