datatf

Export existing Azure Databricks platform configuration to Terraform variables and import blocks.

DataTF prepares an opinionated Terraform root for the workspace module. It reads Databricks and writes local files. It never reads secret values or applies Terraform.

Install

Download the archive for your system from GitHub Releases. Extract the archive and put datatf on your PATH. Releases include macOS, Linux, and Windows binaries for AMD64 and ARM64, with SHA-256 checksums.

On Windows, download the Windows AMD64 ZIP for an Intel or AMD computer. Use the ARM64 ZIP for a Windows ARM computer. Select Extract All, then open PowerShell in the extracted folder:

.\datatf.exe version
.\datatf.exe auth status --profile analytics
.\datatf.exe export --profile analytics --scaffold

Replace analytics with your saved Databricks profile. Go and administrator access are not required. You can add the folder to your user PATH to run datatf from any folder. Install Terraform only when you are ready to validate and import the generated files.

To build from source, see Contributing.

Interactive commands check GitHub Releases for updates. A notice links to the newer release. Set DATATF_NO_UPDATE_NOTIFIER=1 to disable checks. See upgrade instructions.

Quick start

Use the Databricks CLI to list saved profiles. Select the profile whose URL matches your workspace. This example uses analytics:

databricks auth profiles
datatf auth status --profile analytics
datatf export --profile analytics --out ./export --scaffold

The root uses version 0.2.0 of 536tech/workspace/databricks from the Terraform Registry. Terraform 1.7 or later is required.

The workspace pattern module pins independently released resource modules. DataTF keeps the same input maps and import addresses for both ownership scopes. Existing exports remain compatible. Use --module-version to select a different tested pattern release.

To create a profile, run databricks auth login --host <workspace-url> --profile analytics. Check the export permissions before use.

The export contains terraform.tfvars, imports.tf, JSON data, and an export report. --scaffold adds the Terraform root files and instructions for the first import. Review the report and require an imports-only plan before you apply Terraform.

Workspace scope is the default. Use --scope shared once per metastore for shared Unity Catalog objects. Give each root its own state. Each remote object must have one state owner.

Select resources

Select resource groups, or one exact name within a group:

datatf export --profile analytics --resources catalogs,warehouses --out ./selected --scaffold
datatf export --profile analytics --resources catalogs --name sales --out ./sales --scaffold

A catalog includes its schemas, grants, and bindings. Use --scope shared for a shared catalog. Export into a new directory. See resource selection for details and limits.

To call individual Registry modules without the workspace pattern:

datatf export --profile analytics --resources warehouses --module-layout resources --scaffold

See module layouts for versions, inputs, and state boundaries.

Resource coverage

Only the Terraform resources in this table are supported.

--resources group	Terraform resources	Scope
catalogs	databricks_catalog, databricks_schema, databricks_grants	Workspace or shared
storage_credentials	databricks_storage_credential, databricks_grants	Workspace or shared
external_locations	databricks_external_location, databricks_grants	Workspace or shared
Included with the three groups above	databricks_workspace_binding	Workspace or shared
cluster_policies	databricks_cluster_policy, databricks_permissions	Workspace
instance_pools	databricks_instance_pool, databricks_permissions	Workspace
warehouses	databricks_sql_endpoint, databricks_permissions	Workspace
secret_scopes	databricks_secret_scope, databricks_secret_acl	Workspace
service_principals	databricks_service_principal	Workspace

DataTF excludes Azure infrastructure, workspace creation, metastores, assignments, and account identities. Those resources have a separate lifecycle. It also excludes clusters, tables, stored data, secret values, and ML artifacts.

For workload adoption, consider Declarative Automation Bundles. DataTF prepares Terraform adoption, not a full workspace backup. Give each object one managing tool; export alone does not change its manager.

More

Optional telemetry is off by default. Run datatf telemetry status to check the setting. Read the telemetry notice for consent controls and event fields.

• datatf inventory --profile analytics previews the workspace inventory.
• datatf export --help describes export options and safety checks.
• Troubleshooting covers recovery hints, JSON errors, and exit codes.
• Agent workflow covers authentication, scope, and validation.
• Local Docker demo tests profile auth and a warehouse import with MiniLake.
• OpenTofu example covers export, import, and a local test.
• Contributing covers local builds, tests, and version tags.
• GitHub Releases contains the changelog and downloads.

License

Apache-2.0.