Granular budget access control in Databricks with ACLs

You can now delegate budget management and visibility in Databricks without granting full account administrator privileges. This update introduces access control lists (ACLs) for budgets, allowing you to assign Budget Manager and Budget Viewer roles.

Use cases

Imagine a FinOps team or engineering lead needs to track team-specific spending, receive alerts, and adjust notification thresholds without requiring broad administrative rights across the Databricks account. With budget ACLs, you can:

• Grant roles/budget.viewer to let team members view current spend and budget configurations.
• Grant roles/budget.manager to delegate editing thresholds, setting alert recipients, and managing other users' access.
• Allow service principals to read budget metrics via the API for automated cost governance.

How to use

Budget permissions are managed at the account level through the Databricks CLI or the Rule Set API. Rule updates rely on optimistic concurrency via an etag.

First, retrieve the current rule set and its etag:

databricks account access-control get-rule-set \
  "accounts/<ACCOUNT_ID>/budgets/<BUDGET_ID>/ruleSets/default" ""

What happens in this code:

1. The command queries the default rule set associated with the given budget ID.
2. Passing an empty string for the second argument bypasses version check constraints during read.
3. The JSON output returns the existing grant_rules along with an etag required for modification.

Prepare a local file named rule-set.json containing the retrieved etag and the complete desired permissions:

{
  "name": "accounts/<ACCOUNT_ID>/budgets/<BUDGET_ID>/ruleSets/default",
  "rule_set": {
    "name": "accounts/<ACCOUNT_ID>/budgets/<BUDGET_ID>/ruleSets/default",
    "etag": "1790271814348000",
    "grant_rules": [
      { "role": "roles/budget.manager", "principals": ["users/manager@example.com"] },
      { "role": "roles/budget.viewer", "principals": ["users/viewer@example.com", "groups/finops"] }
    ]
  }
}

Then, apply the updated permissions:

databricks account access-control update-rule-set --json @rule-set.json

What happens in this code:

1. The update operation replaces the entire rule set with the definitions in the JSON payload.
2. Principals must use prefix notations: users/<email>, groups/<group-name>, or servicePrincipals/<application-id>.
3. Because the update completely overwrites existing permissions, any grant omitted from the file will be removed.

Limitations and requirements

• Account admins have non-revocable super-user access to all account budgets.
• The Budgets UI in the Account Console and Governance Hub is restricted to account and workspace admins. Non-admin users holding Manager or Viewer roles interact with budgets through the Budget API.
• Budget filters are locked at creation time and cannot be modified.
• Permission updates may take 30 seconds or longer to propagate across the system.