Skip to main content

AWS Credentials

Kostavo connects to Databricks on AWS using a Databricks service principal. This guide covers the exact setup, from the Databricks account console to a validated credential in Kostavo.

What You Need​

FieldDescription
Principal IDThe service principal's client ID from the Databricks account console
Principal SecretThe OAuth secret generated for the service principal

Step 1: Create a Service Principal​

  1. Open the Databricks account console and sign in as an account admin
  2. Go to User management, then the Service principals tab
  3. Click Add service principal
  4. Name it (e.g., kostavo-monitoring) and create it

Step 2: Generate an OAuth Secret​

  1. Open the service principal you just created
  2. Under OAuth secrets, click Generate secret
  3. Copy the Secret value immediately, it is only shown once
  4. Also copy the Client ID, this is the Principal ID Kostavo needs

Step 3: Grant Workspace Access​

The service principal needs admin access to each workspace Kostavo should monitor and manage:

  1. In the account console, go to Workspaces and open a workspace
  2. Under Permissions, add the service principal
  3. Assign the Admin role so Kostavo can read resources and apply Fix and Remove actions

Repeat for every workspace you plan to enroll. Grant only the workspaces you want governed, Kostavo never touches workspaces it cannot see.

Step 4: Add the Credential in Kostavo​

In the onboarding wizard or the Credentials page, create a new credential with the cloud provider set to AWS:

FieldValue
Principal IDClient ID from Step 2
Principal SecretSecret value from Step 2

After saving, the credential appears in the credentials list. AWS credentials are exercised per workspace: enrollment and scans use the workspace URL you provide, so a wrong secret surfaces as scan failures on the workspace rather than as an error at save time.

Workspace Enrollment​

Unlike Azure, AWS does not support cloud-level auto-discovery. You have two options in the wizard:

Single workspace: Enter the workspace name and Databricks host URL manually.

Workspace list: Use batch entry to paste multiple workspace entries at once. Each entry needs a name and the workspace URL (e.g., https://workspace-name.cloud.databricks.com).

Workspace URL Format​

AWS Databricks workspace URLs follow this pattern:

https://<workspace-name>.cloud.databricks.com

Or for non-default deployments:

https://<workspace-id>.<region>.databricks.com

Secret Rotation​

When you rotate the OAuth secret:

  1. Generate a new secret in the Databricks account console
  2. Update the credential in Kostavo with the new secret value
  3. Delete the old secret once scans keep succeeding with the new one

See Managing credentials for the in-app rotation flow.