Add grants support for AI Gateway securables (model_service, mcp_service, model_provider_service)

.nextchanges/bundles/ai-gateway-grants.md

@@ -0,0 +1 @@
+* Add grants support for the AI Gateway `model_service`, `mcp_service`, and `model_provider_service` resources (direct engine). ([#6635](https://github.com/databricks/cli/pull/6635))

acceptance/bundle/invariant/configs/mcp_service.yml.tmpl

@@ -7,3 +7,7 @@ resources:
       parent: schemas/main.default
       mcp_service_id: test-mcp-service-$UNIQUE_NAME
       comment: test mcp service
+      grants:
+        - principal: account users
+          privileges:
+            - APPLY_TAG

acceptance/bundle/invariant/configs/model_provider_service.yml.tmpl

@@ -7,6 +7,10 @@ resources:
       parent: schemas/main.default
       model_provider_service_id: test-model-provider-service-$UNIQUE_NAME
       comment: test model provider service
+      grants:
+        - principal: account users
+          privileges:
+            - APPLY_TAG
       config:
         provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM
         targets:

acceptance/bundle/invariant/configs/model_service.yml.tmpl

@@ -7,3 +7,7 @@ resources:
       parent: schemas/main.default
       model_service_id: test-model-service-$UNIQUE_NAME
       comment: test model service
+      grants:
+        - principal: account users
+          privileges:
+            - APPLY_TAG

acceptance/bundle/refschema/out.fields.txt

@@ -2103,6 +2103,12 @@ resources.mcp_services.*.mcp_service_id	string	ALL
 resources.mcp_services.*.modified_status	string	INPUT
 resources.mcp_services.*.parent	string	ALL
 resources.mcp_services.*.url	string	INPUT
+resources.mcp_services.*.grants.full_name	string	ALL
+resources.mcp_services.*.grants.securable_type	string	ALL
+resources.mcp_services.*.grants[*]	catalog.PrivilegeAssignment	ALL
+resources.mcp_services.*.grants[*].principal	string	ALL
+resources.mcp_services.*.grants[*].privileges	[]catalog.Privilege	ALL
+resources.mcp_services.*.grants[*].privileges[*]	catalog.Privilege	ALL
 resources.model_provider_services.*.comment	string	ALL
 resources.model_provider_services.*.config	*catalog.ModelProviderServiceConfig	ALL
 resources.model_provider_services.*.config.allow_all_targets	bool	ALL
@@ -2193,6 +2199,12 @@ resources.model_provider_services.*.model_provider_service_id	string	ALL
 resources.model_provider_services.*.modified_status	string	INPUT
 resources.model_provider_services.*.parent	string	ALL
 resources.model_provider_services.*.url	string	INPUT
+resources.model_provider_services.*.grants.full_name	string	ALL
+resources.model_provider_services.*.grants.securable_type	string	ALL
+resources.model_provider_services.*.grants[*]	catalog.PrivilegeAssignment	ALL
+resources.model_provider_services.*.grants[*].principal	string	ALL
+resources.model_provider_services.*.grants[*].privileges	[]catalog.Privilege	ALL
+resources.model_provider_services.*.grants[*].privileges[*]	catalog.Privilege	ALL
 resources.model_services.*.comment	string	ALL
 resources.model_services.*.config	*catalog.ModelServiceConfig	ALL
 resources.model_services.*.config.inference_table	*catalog.InferenceTableConfig	ALL
@@ -2255,6 +2267,12 @@ resources.model_services.*.model_service_id	string	ALL
 resources.model_services.*.modified_status	string	INPUT
 resources.model_services.*.parent	string	ALL
 resources.model_services.*.url	string	INPUT
+resources.model_services.*.grants.full_name	string	ALL
+resources.model_services.*.grants.securable_type	string	ALL
+resources.model_services.*.grants[*]	catalog.PrivilegeAssignment	ALL
+resources.model_services.*.grants[*].principal	string	ALL
+resources.model_services.*.grants[*].privileges	[]catalog.Privilege	ALL
+resources.model_services.*.grants[*].privileges[*]	catalog.Privilege	ALL
 resources.model_serving_endpoints.*.ai_gateway	*serving.AiGatewayConfig	ALL
 resources.model_serving_endpoints.*.ai_gateway.fallback_config	*serving.FallbackConfig	ALL
 resources.model_serving_endpoints.*.ai_gateway.fallback_config.enabled	bool	ALL

acceptance/bundle/resources/grants/mcp_services/databricks.yml.tmpl

@@ -0,0 +1,12 @@
+bundle:
+  name: deploy-mcp-service-grants-$UNIQUE_NAME
+
+resources:
+  mcp_services:
+    my_mcp_service:
+      parent: schemas/main.myschema
+      mcp_service_id: myservice
+      comment: mycomment
+      grants:
+        - principal: deco-test-user@databricks.com
+          privileges: ["APPLY_TAG"]

acceptance/bundle/resources/grants/mcp_services/out.deploy1.requests.direct.json

@@ -0,0 +1,17 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/mcp_service/main.myschema.myservice",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "APPLY_TAG"
+        ],
+        "principal": "deco-test-user@databricks.com",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      }
+    ]
+  }
+}

acceptance/bundle/resources/grants/mcp_services/out.plan1.direct.json

@@ -0,0 +1,42 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.mcp_services.my_mcp_service": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "comment": "mycomment",
+          "mcp_service_id": "myservice",
+          "parent": "schemas/main.myschema"
+        }
+      }
+    },
+    "resources.mcp_services.my_mcp_service.grants": {
+      "depends_on": [
+        {
+          "node": "resources.mcp_services.my_mcp_service",
+          "label": "${resources.mcp_services.my_mcp_service.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "mcp_service",
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "APPLY_TAG"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.mcp_services.my_mcp_service.id}"
+        }
+      }
+    }
+  }
+}

acceptance/bundle/resources/grants/mcp_services/output.txt

@@ -0,0 +1,35 @@
+
+>>> [CLI] bundle plan -o json
+
+>>> print_requests.py --get //permissions
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-mcp-service-grants-[UNIQUE_NAME]/default/files...
+Created mcp_services.my_mcp_service
+Created mcp_services.my_mcp_service.grants
+Files: 7 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //permissions
+
+>>> [CLI] grants get mcp_service main.myschema.myservice
+{
+  "privilege_assignments": [
+    {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+        "APPLY_TAG"
+      ]
+    }
+  ]
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.mcp_services.my_mcp_service
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-mcp-service-grants-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //permissions

acceptance/bundle/resources/grants/mcp_services/script

@@ -0,0 +1,12 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle plan -o json | jq 'del(.features)' > out.plan1.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --get //permissions
+trace $CLI bundle deploy
+trace print_requests.py //permissions > out.deploy1.requests.$DATABRICKS_BUNDLE_ENGINE.json
+
+# Assert the end result: the grant is applied on the MCP service securable.
+trace $CLI grants get mcp_service main.myschema.myservice | jq --sort-keys
+
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //permissions > out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json

acceptance/bundle/resources/grants/mcp_services/test.toml

@@ -0,0 +1,5 @@
+# AI Gateway securables are direct-engine only (no Terraform provider path), so
+# there is no direct-vs-terraform request divergence to reconcile on cloud;
+# compare the recorded requests locally instead.
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]

acceptance/bundle/resources/grants/model_provider_services/databricks.yml.tmpl

@@ -0,0 +1,23 @@
+bundle:
+  name: deploy-model-provider-service-grants-$UNIQUE_NAME
+
+resources:
+  model_provider_services:
+    my_model_provider_service:
+      parent: schemas/main.myschema
+      model_provider_service_id: myservice
+      comment: mycomment
+      config:
+        provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM
+        targets:
+          - model: gpt-4o
+            native_api_types:
+              - openai/v1/chat/completions
+        custom:
+          direct:
+            base_url: https://api.example.com/v1
+            api_key:
+              plaintext: dummy-api-key
+      grants:
+        - principal: deco-test-user@databricks.com
+          privileges: ["APPLY_TAG"]

acceptance/bundle/resources/grants/model_provider_services/out.deploy1.requests.direct.json

@@ -0,0 +1,17 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/model_provider_service/main.myschema.myservice",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "APPLY_TAG"
+        ],
+        "principal": "deco-test-user@databricks.com",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      }
+    ]
+  }
+}

acceptance/bundle/resources/grants/model_provider_services/out.plan1.direct.json

@@ -0,0 +1,61 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.model_provider_services.my_model_provider_service": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "comment": "mycomment",
+          "config": {
+            "custom": {
+              "direct": {
+                "api_key": {
+                  "plaintext": "dummy-api-key"
+                },
+                "base_url": "https://api.example.com/v1"
+              }
+            },
+            "provider_type": "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM",
+            "targets": [
+              {
+                "model": "gpt-4o",
+                "native_api_types": [
+                  "openai/v1/chat/completions"
+                ]
+              }
+            ]
+          },
+          "model_provider_service_id": "myservice",
+          "parent": "schemas/main.myschema"
+        }
+      }
+    },
+    "resources.model_provider_services.my_model_provider_service.grants": {
+      "depends_on": [
+        {
+          "node": "resources.model_provider_services.my_model_provider_service",
+          "label": "${resources.model_provider_services.my_model_provider_service.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "model_provider_service",
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "APPLY_TAG"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.model_provider_services.my_model_provider_service.id}"
+        }
+      }
+    }
+  }
+}

acceptance/bundle/resources/grants/model_provider_services/output.txt

@@ -0,0 +1,35 @@
+
+>>> [CLI] bundle plan -o json
+
+>>> print_requests.py --get //permissions
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-model-provider-service-grants-[UNIQUE_NAME]/default/files...
+Created model_provider_services.my_model_provider_service
+Created model_provider_services.my_model_provider_service.grants
+Files: 7 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //permissions
+
+>>> [CLI] grants get model_provider_service main.myschema.myservice
+{
+  "privilege_assignments": [
+    {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+        "APPLY_TAG"
+      ]
+    }
+  ]
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.model_provider_services.my_model_provider_service
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-model-provider-service-grants-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //permissions

acceptance/bundle/resources/grants/model_provider_services/script

@@ -0,0 +1,12 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle plan -o json | jq 'del(.features)' > out.plan1.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --get //permissions
+trace $CLI bundle deploy
+trace print_requests.py //permissions > out.deploy1.requests.$DATABRICKS_BUNDLE_ENGINE.json
+
+# Assert the end result: the grant is applied on the model provider service securable.
+trace $CLI grants get model_provider_service main.myschema.myservice | jq --sort-keys
+
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //permissions > out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json

acceptance/bundle/resources/grants/model_provider_services/test.toml

@@ -0,0 +1,5 @@
+# AI Gateway securables are direct-engine only (no Terraform provider path), so
+# there is no direct-vs-terraform request divergence to reconcile on cloud;
+# compare the recorded requests locally instead.
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]

acceptance/bundle/resources/grants/model_services/databricks.yml.tmpl

@@ -0,0 +1,12 @@
+bundle:
+  name: deploy-model-service-grants-$UNIQUE_NAME
+
+resources:
+  model_services:
+    my_model_service:
+      parent: schemas/main.myschema
+      model_service_id: myservice
+      comment: mycomment
+      grants:
+        - principal: deco-test-user@databricks.com
+          privileges: ["APPLY_TAG"]

acceptance/bundle/resources/grants/model_services/out.deploy1.requests.direct.json

@@ -0,0 +1,17 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/model_service/main.myschema.myservice",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "APPLY_TAG"
+        ],
+        "principal": "deco-test-user@databricks.com",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      }
+    ]
+  }
+}