Warn and record when state_path folder permissions exceed static `permissions` block. by shreyas-goenka · Pull Request #5439 · databricks/cli

shreyas-goenka · 2026-06-04T11:43:05Z

Summary

Previously the "workspace folder has permissions not configured in bundle" warning was only emitted by bundle validate. This emits it on bundle deploy as well, and records related telemetry.

No extra API latency: deploy already calls SetPermissions on each workspace path prefix, and the response carries the folder's resulting ACL. We compare that against the declared permissions instead of issuing a separate GetPermissions. Since the Set replaces the direct ACL, any principal still showing higher access is inherited from a parent folder — broader access that persists after the deploy.

Telemetry (bool_values):

state_path_acl_exceeds_permissions — the folder holding the deployment state grants more access than declared.
state_path_is_shared, permissions_section_is_set

eng-dev-ecosystem-bot · 2026-06-04T12:34:01Z

Commit: 313ab31

Run: 27226691899

	Env	🟨KNOWN	🔄flaky	💚RECOVERED	🙈SKIP	✅pass	🙈skip	Time
🟨	aws linux	7			15	261	921	7:50
🟨	aws windows	7			15	263	919	15:19
💚	aws-ucws linux			7	15	357	835	8:10
💚	aws-ucws windows			7	15	359	833	13:19
💚	azure linux			1	17	264	919	7:07
💚	azure windows			1	17	266	917	10:46
🔄	azure-ucws linux		1	1	17	361	831	9:17
💚	azure-ucws windows			1	17	364	829	12:16
💚	gcp linux			1	17	260	922	7:46
💚	gcp windows			1	17	262	920	11:16

23 interesting tests: 15 SKIP, 7 KNOWN, 1 flaky

	Test Name	aws linux	aws windows	aws-ucws linux	aws-ucws windows	azure linux	azure windows	azure-ucws linux	azure-ucws windows	gcp linux	gcp windows
🟨	TestAccept	🟨K	🟨K	💚R	💚R	💚R	💚R	💚R	💚R	💚R	💚R
🙈	TestAccept/bundle/invariant/no_drift	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/permissions	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🟨	TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions	🟨K	🟨K	💚R	💚R	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🟨	TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/DATABRICKS_BUNDLE_ENGINE=direct	🟨K	🟨K	💚R	💚R
🟨	TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/DATABRICKS_BUNDLE_ENGINE=terraform	🟨K	🟨K	💚R	💚R
🟨	TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions	🟨K	🟨K	💚R	💚R	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🟨	TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/DATABRICKS_BUNDLE_ENGINE=direct	🟨K	🟨K	💚R	💚R
🟨	TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/DATABRICKS_BUNDLE_ENGINE=terraform	🟨K	🟨K	💚R	💚R
🙈	TestAccept/bundle/resources/postgres_branches/basic	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/postgres_branches/recreate	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/postgres_branches/replace_existing	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/postgres_branches/update_protected	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/postgres_branches/without_branch_id	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/postgres_endpoints/basic	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/postgres_endpoints/recreate	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/postgres_projects/update_display_name	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/synced_database_tables/basic	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/vector_search_indexes/basic	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/bundle/resources/vector_search_indexes/grants/select	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🙈	TestAccept/ssh/connection	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S	🙈S
🔄	TestSyncEnsureRemotePathIsUsableIfRepoExists	✅p	✅p	✅p	✅p	✅p	✅p	🔄f	✅p	✅p	✅p

Top 28 slowest tests (at least 2 minutes):

duration	env	testname
6:16	azure-ucws windows	TestAccept
5:56	gcp windows	TestAccept
5:45	azure windows	TestAccept
5:36	aws-ucws windows	TestAccept
5:00	gcp windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
4:23	gcp linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
4:09	gcp windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
4:01	gcp linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
3:33	azure windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
3:32	azure-ucws linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
3:26	azure windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:17	azure-ucws windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:12	aws-ucws windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
3:09	aws windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:09	azure-ucws linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:08	aws-ucws linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:07	azure-ucws windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
3:00	azure linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
2:57	aws windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
2:55	gcp linux	TestAccept
2:53	azure linux	TestAccept
2:51	azure-ucws linux	TestAccept
2:48	aws linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
2:47	aws-ucws linux	TestAccept
2:43	aws-ucws windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
2:37	aws linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
2:33	aws-ucws linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
2:32	azure linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct

shreyas-goenka · 2026-06-10T10:44:31Z

 has_serverless_compute true
 local.cache.attempt true
 local.cache.miss true
+permissions_section_is_set false


Because permissions are not set here, by definition state_path_acl_exceeds_permissions is true.

Analysis needs to take this into account when looking at state_path_acl_exceeds_permissions.

Can we choose to not emit it when permissions are not set?

github-actions · 2026-06-10T10:54:02Z

Approval status: pending

`/acceptance/bundle/` - needs approval

20 files changed
Suggested: @denik
Also eligible: @pietern, @janniklasrose, @andrewnester, @lennartkats-db, @anton-107

`/bundle/` - needs approval

4 files changed
Suggested: @denik
Also eligible: @pietern, @janniklasrose, @andrewnester, @lennartkats-db, @anton-107

General files (require maintainer)

Files: NEXT_CHANGELOG.md
Based on git history:

@denik -- recent work in ./, bundle/permissions/, bundle/metrics/

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @simonfaltum, @renaudhartert-db) can approve all areas.

See OWNERS for ownership rules.}

pietern · 2026-06-10T11:41:49Z

 has_serverless_compute true
 local.cache.attempt true
 local.cache.miss true
+permissions_section_is_set false


Analysis needs to take this into account when looking at state_path_acl_exceeds_permissions.

Can we choose to not emit it when permissions are not set?

pietern · 2026-06-10T11:46:11Z

+- level: CAN_MANAGE, group_name: data-engineers
+
+Add them to your bundle permissions or remove them from the folder.
+See https://docs.databricks.com/dev-tools/bundles/permissions


It is odd to see the same warning twice here. Anything we can do about it?

That is by design - we get two warnings, one for the root path and one for the state path (because they are different). The naming is a bit confusing because the target name is state_path as well.

pietern · 2026-06-10T11:54:50Z

+	statePath := b.Config.Workspace.StatePath
+	for i, p := range bundlePaths {
+		if pathContains(p, statePath) && !libraries.IsWorkspaceSharedPath(p) {
+			b.Metrics.SetBoolValue(metrics.StatePathAclExceedsPermissions, len(results[i]) > 0)


This depends on the presence or absence of diags for a path? Seems brittle if so.

pietern · 2026-06-10T11:56:44Z

 * Set the default `data_security_mode` to `DATA_SECURITY_MODE_AUTO` in bundle templates ([#5452](https://github.com/databricks/cli/pull/5452)).
 * Mark vector search index index_subtype as backend_default to prevent drift after deployment ([#5454](https://github.com/databricks/cli/pull/5454)).
 * `bundle deployment migrate`: handle resources added to or removed from `databricks.yml` since the last Terraform deploy ([#5463](https://github.com/databricks/cli/pull/5463)).
+* Warn during `bundle deploy` when a workspace folder used by the bundle grants broader permissions than the bundle's top-level `permissions` section declares, for example through permissions inherited from a parent folder ([#5439](https://github.com/databricks/cli/pull/5439)).


If I understand correctly, we already do this and this is not new. The only difference is that we record it.

We only warn in the bundle validate command today, where we fetch the permissions on all folders. This is new because now we also warn on bundle deploy.

…he bundle's ValidateFolderPermissions already compares the live workspace ACL against the declared permissions, but it only runs during `bundle validate`. This brings the same check to `bundle deploy` without adding any API latency: ApplyWorkspaceRoot- Permissions already calls SetPermissions on each workspace path prefix (root_path and, when separate, state_path), and the response carries the resulting ACL. Reusing that response, we compare against the declared permissions. Because the Set replaces the folder's direct ACL with the declared set, any principal still showing higher access is inherited from a parent folder — the broader access that actually persists after deploy, which is the scope mismatch worth surfacing. Three telemetry signals are recorded in bool_values during deploy: - state_path_acl_exceeds_permissions: whether the folder holding the deployment state grants more access than the permissions section declares. True by definition when no permissions are declared; determined statically for /Workspace/Shared state folders (all users have read/write) and from the live SetPermissions response otherwise. - state_path_is_shared: state_path is under /Workspace/Shared. - permissions_section_is_set: the bundle declares top-level permissions. Covered by acceptance tests (no permissions / clean ACL / shared state path, and an inherited-ACL mismatch staged via a server override) instead of unit tests. Co-authored-by: Shreyas Goenka <shreyas.goenka@databricks.com>

shreyas-goenka temporarily deployed to test-trigger-is June 4, 2026 11:43 — with GitHub Actions Inactive

shreyas-goenka force-pushed the ticklish-munching-bear branch from 60fba4e to cc47397 Compare June 4, 2026 11:49

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from e7e9e83 to 7c783aa Compare June 4, 2026 11:50

shreyas-goenka mentioned this pull request Jun 4, 2026

bundle: warn when a workspace path is in /Workspace/Shared without users CAN_MANAGE #5428

Draft

shreyas-goenka temporarily deployed to test-trigger-is June 4, 2026 11:51 — with GitHub Actions Inactive

shreyas-goenka force-pushed the ticklish-munching-bear branch from cc47397 to b2c7271 Compare June 5, 2026 10:05

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from 7c783aa to 5e587f0 Compare June 5, 2026 10:05

shreyas-goenka temporarily deployed to test-trigger-is June 5, 2026 10:06 — with GitHub Actions Inactive

shreyas-goenka force-pushed the ticklish-munching-bear branch from b2c7271 to c2aa303 Compare June 5, 2026 10:11

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from 5e587f0 to 2cd3ef3 Compare June 5, 2026 10:11

shreyas-goenka temporarily deployed to test-trigger-is June 5, 2026 10:12 — with GitHub Actions Inactive

shreyas-goenka force-pushed the ticklish-munching-bear branch from c2aa303 to b1d732b Compare June 5, 2026 10:14

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from 2cd3ef3 to 07abec1 Compare June 5, 2026 10:14

shreyas-goenka temporarily deployed to test-trigger-is June 5, 2026 10:15 — with GitHub Actions Inactive

shreyas-goenka force-pushed the ticklish-munching-bear branch from b1d732b to 9e2f26b Compare June 5, 2026 10:18

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from 07abec1 to 26c3380 Compare June 5, 2026 10:18

shreyas-goenka temporarily deployed to test-trigger-is June 5, 2026 10:18 — with GitHub Actions Inactive

shreyas-goenka force-pushed the ticklish-munching-bear branch from 9e2f26b to 00c5b7b Compare June 5, 2026 10:18

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from 26c3380 to 30172b5 Compare June 5, 2026 10:19

shreyas-goenka temporarily deployed to test-trigger-is June 5, 2026 10:19 — with GitHub Actions Inactive

shreyas-goenka force-pushed the ticklish-munching-bear branch from 00c5b7b to addcb6a Compare June 9, 2026 14:06

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from 30172b5 to 3646391 Compare June 9, 2026 14:06

shreyas-goenka temporarily deployed to test-trigger-is June 10, 2026 10:32 — with GitHub Actions Inactive

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from 46c9c69 to bf9f878 Compare June 10, 2026 10:37

shreyas-goenka temporarily deployed to test-trigger-is June 10, 2026 10:38 — with GitHub Actions Inactive

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from bf9f878 to abe3dfb Compare June 10, 2026 10:42

shreyas-goenka temporarily deployed to test-trigger-is June 10, 2026 10:42 — with GitHub Actions Inactive

shreyas-goenka commented Jun 10, 2026

View reviewed changes

shreyas-goenka changed the title ~~bundle: warn during deploy when workspace folder permissions exceed the bundle's~~ Warn and record when state_path folder permissions exceed static permissions block. Jun 10, 2026

shreyas-goenka marked this pull request as ready for review June 10, 2026 10:53

shreyas-goenka requested review from andrewnester, denik and pietern June 10, 2026 10:54

shreyas-goenka marked this pull request as draft June 10, 2026 11:12

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from abe3dfb to 3c6a454 Compare June 10, 2026 11:15

shreyas-goenka changed the base branch from ticklish-munching-bear to main June 10, 2026 11:15

shreyas-goenka temporarily deployed to test-trigger-is June 10, 2026 11:15 — with GitHub Actions Inactive

shreyas-goenka marked this pull request as ready for review June 10, 2026 11:31

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from 3c6a454 to 681e089 Compare June 10, 2026 11:32

shreyas-goenka temporarily deployed to test-trigger-is June 10, 2026 11:33 — with GitHub Actions Inactive

pietern reviewed Jun 10, 2026

View reviewed changes

shreyas-goenka force-pushed the pr-deploy-folder-permission-check branch from 681e089 to e6521fb Compare June 10, 2026 12:07

shreyas-goenka temporarily deployed to test-trigger-is June 10, 2026 12:08 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Warn and record when state_path folder permissions exceed static `permissions` block.#5439

Warn and record when state_path folder permissions exceed static `permissions` block.#5439
shreyas-goenka wants to merge 1 commit into
mainfrom
pr-deploy-folder-permission-check

shreyas-goenka commented Jun 4, 2026 •

edited

Loading

Uh oh!

eng-dev-ecosystem-bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

shreyas-goenka Jun 10, 2026

Uh oh!

pietern Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

pietern Jun 10, 2026

Uh oh!

pietern Jun 10, 2026

Uh oh!

shreyas-goenka Jun 10, 2026

Uh oh!

pietern Jun 10, 2026

Uh oh!

pietern Jun 10, 2026

Uh oh!

shreyas-goenka Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

shreyas-goenka commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

eng-dev-ecosystem-bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approval status: pending

/acceptance/bundle/ - needs approval

/bundle/ - needs approval

General files (require maintainer)

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

shreyas-goenka commented Jun 4, 2026 •

edited

Loading

eng-dev-ecosystem-bot commented Jun 4, 2026 •

edited

Loading

github-actions Bot commented Jun 10, 2026 •

edited

Loading

`/acceptance/bundle/` - needs approval

`/bundle/` - needs approval