# Build a Governed Databricks Workspace with Pulumi

DevFeed: [Build a Governed Databricks Workspace with Pulumi](<https://devfeed.tech/articles/build-a-governed-databricks-workspace-with-pulumi-18999.md>)

Original publisher: [Read original article](<https://www.pulumi.com/blog/end-to-end-databricks-with-pulumi/>)

Author: Pablo Seibelt

Published: 2026-06-25T00:00:00Z

Content type: tutorial

Language: en

Sources: [Pulumi](<https://devfeed.tech/sources/pulumi.md>)

Topics: [databricks](<https://devfeed.tech/topics/databricks.md>), [data-platforms](<https://devfeed.tech/topics/data-platforms.md>), [Tutorial](<https://devfeed.tech/topics/tutorial.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [Security](<https://devfeed.tech/topics/security.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>)

Tags: [apis](<https://devfeed.tech/tags/apis.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [data-engineering](<https://devfeed.tech/tags/data-engineering.md>), [databricks](<https://devfeed.tech/tags/databricks.md>), [governance](<https://devfeed.tech/tags/governance.md>), [infrastructure-as-code](<https://devfeed.tech/tags/infrastructure-as-code.md>), [pulumi](<https://devfeed.tech/tags/pulumi.md>), [security](<https://devfeed.tech/tags/security.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>), [tutorials](<https://devfeed.tech/tags/tutorials.md>)

## AI overview

A tutorial on using Pulumi to establish a governed Databricks workspace baseline. It covers cluster policies, notebooks, secret scopes, permissions, and automated jobs, while distinguishing account-level from workspace-level resources and showing credential management with Pulumi ESC.

## Source excerpt

Platform teams responsible for Databricks often find themselves manually configuring clusters and notebooks for every new data science team. This manual overhead leads to inconsistent cluster policies, runaway costs from oversized instances, and security gaps in workspace operations. Without a standardized way to provision workspace-local resources, data platforms become a fragmented collection of bespoke environments that are impossible to govern at scale. As Databricks usage grows across the enterprise, the lack of a governed workspace baseline becomes a major operational risk. Inconsistent policies lead to unpredictable billing and audit failures. Standardizing your Databricks environment with Pulumi ensures that every workspace starts with the correct cost controls, cluster policies, notebooks, and automated jobs, allowing your data teams to move faster without compromising governance. What you'll build In this post, you will learn how to provision a governed Databricks workspace baseline using Pulumi. You will build: Cluster policies to enforce instance types and cost controls. Workspace notebooks to standardize workload locations. Secret scopes and permissions to make access reviewable. Automated jobs that run on policy-constrained compute. By the end, you will have a reproducible workspace configuration that you can deploy to any new Databricks environment. The Databricks management boundary When managing Databricks with Pulumi, understand the boundary between account-level and workspace-level resources. Account-level: Creating cloud prerequisites such as VPCs, subnets, IAM roles, and Azure resource groups uses the cloud provider for your target platform. On AWS and GCP, Databricks workspace creation and account-level identity use the Databricks provider's account APIs, such as databricks.MwsWorkspaces; on Azure, the workspace itself is commonly managed with azure-native. Workspace-level: Managing clusters, jobs, notebooks, permissions, and secret scopes with