Skip to main content

​
About Databricks

Iru reads users and groups, workspace permissions, cluster configurations, secret scopes, and Unity Catalog permissions (where Unity Catalog is in use) from the Databricks REST API. Authentication uses a Bearer token: either a personal access token created under User Settings → Developer → Access tokens, or a service principal token. Requests target your workspace host, so Iru stores the workspace URL first, then the token.

​
How It Works

Databricks is per-workspace: each workspace has its own host (for example https://dbc-1234abcd-5e6f.cloud.databricks.com on AWS, or https://adb-1234567890.12.azuredatabricks.net on Azure) and its own tokens. A token is valid only against the workspace that issued it, so connect one source per workspace you need evidence from. Iru reads secret scope names and their access control lists. It does not read secret values. Official references: REST API reference, Authentication.

​
Prerequisites

  • Your workspace URL, copied from the browser when signed in to the workspace.
  • Workspace admin access. Token creation can be restricted by workspace settings, and a non-admin token returns only the permissions and clusters that account can already see.
  • Personal access tokens enabled for the workspace. If admins have disabled them, use a service principal instead.
  • Decide what is in scope. Databricks lets you exclude workspaces or secret scopes, and excluded objects produce no evidence.

​
Connect Databricks to Iru

Complete this tab before you connect the source in Compliance.
1

Sign in to the workspace

Sign in to the Databricks workspace you want Iru to read, using an account with the admin role.
2

Open Settings

Select your username in the top bar, then Settings.
3

Open Access tokens

Go to Developer, then select Manage beside Access tokens.
4

Generate a new token

Select Generate new token.
5

Name and set lifetime

Enter a Comment such as Iru Compliance, and set a Lifetime your team can track. Collection stops when a token expires. Leaving the lifetime blank creates a non-expiring token, which some security policies disallow.
6

Copy the token and workspace URL

Select Generate, then copy the token value once while Databricks displays it. Copy the workspace URL from your browser’s address bar (the scheme and host only, with no trailing path).
Continue on the Iru Compliance tab.

​
Troubleshooting

Check pop-up blocker settings for the Iru site and try again.
Confirm the token was created in the same workspace as the URL you entered. Tokens are not portable between workspaces.
A workspace admin has disabled personal access tokens. Either re-enable them or authenticate with a service principal.
The token belongs to a non-admin account and is returning only what that account can see. Recreate it from a workspace admin.
This is expected if the workspace does not use Unity Catalog. Iru collects Unity Catalog data only when it is present.
The token’s Lifetime has elapsed. Generate a new one and reconnect.

Sources Management

Browse and manage every Compliance source.

Getting Started With Compliance

Frameworks, actions, and Artifacts.

Iru Overview

How Endpoint, Compliance, and Identity fit together.

Artifacts Management

Upload, review, and organize evidence from sources and actions.