fix: CDI-2604 Databricks cluster policy permission grants not being a…

…pplied correctly (#563)

* Change for each to dynamic

* fix: add note

databricks-cluster-policy/main.tf

@@ -35,12 +35,15 @@ resource "databricks_cluster_policy" "inherited_cluster_policy" {
 }
 
 resource "databricks_permissions" "can_use_inherited_cluster_policy" {
-  for_each = local.inherited_cluster_policy_grantees
-
   cluster_policy_id = databricks_cluster_policy.inherited_cluster_policy[0].id
-  access_control {
-    group_name       = each.value
-    permission_level = "CAN_USE"
+
+  # TF provider requires a dynamic block rather than a for_each - for_each will override permissions
+  dynamic "access_control" {
+    for_each = local.inherited_cluster_policy_grantees
+    content {
+      group_name       = access_control.value
+      permission_level = "CAN_USE"
+    }
   }
 }
 
@@ -53,11 +56,14 @@ resource "databricks_cluster_policy" "custom_cluster_policy" {
 }
 
 resource "databricks_permissions" "can_use_custom_cluster_policy" {
-  for_each = local.custom_cluster_policy_grantees
-
   cluster_policy_id = databricks_cluster_policy.custom_cluster_policy[0].id
-  access_control {
-    group_name       = each.value
-    permission_level = "CAN_USE"
+
+  # TF provider requires a dynamic block rather than a for_each - for_each will override permissions
+  dynamic "access_control" {
+    for_each = local.custom_cluster_policy_grantees
+    content {
+      group_name       = access_control.value
+      permission_level = "CAN_USE"
+    }
   }
 }