# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from . import _utilities

__all__ = ['MwsPrivateAccessSettingsArgs', 'MwsPrivateAccessSettings']

@pulumi.input_type
class MwsPrivateAccessSettingsArgs:
    def __init__(__self__, *,
                 private_access_settings_name: pulumi.Input[_builtins.str],
                 region: pulumi.Input[_builtins.str],
                 account_id: Optional[pulumi.Input[_builtins.str]] = None,
                 allowed_vpc_endpoint_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 private_access_level: Optional[pulumi.Input[_builtins.str]] = None,
                 private_access_settings_id: Optional[pulumi.Input[_builtins.str]] = None,
                 public_access_enabled: Optional[pulumi.Input[_builtins.bool]] = None):
        """
        The set of arguments for constructing a MwsPrivateAccessSettings resource.
        :param pulumi.Input[_builtins.str] private_access_settings_name: Name of Private Access Settings in Databricks Account
        :param pulumi.Input[_builtins.str] region: Region of AWS VPC or the Google Cloud VPC network
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_vpc_endpoint_ids: An array of MwsVpcEndpoint `vpc_endpoint_id` (not `id`). Only used when `private_access_level` is set to `ENDPOINT`. This is an allow list of MwsVpcEndpoint that in your account that can connect to your MwsWorkspaces over AWS PrivateLink. If hybrid access to your workspace is enabled by setting `public_access_enabled` to true, then this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see the article for databricks_ip_access_list.
        :param pulumi.Input[_builtins.str] private_access_level: The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object. `ACCOUNT` level access _(default)_ lets only MwsVpcEndpoint that are registered in your Databricks account connect to your databricks_mws_workspaces. `ENDPOINT` level access lets only specified MwsVpcEndpoint connect to your workspace. Please see the `allowed_vpc_endpoint_ids` documentation for more details.
        :param pulumi.Input[_builtins.str] private_access_settings_id: Canonical unique identifier of Private Access Settings in Databricks Account
        :param pulumi.Input[_builtins.bool] public_access_enabled: If `true`, the MwsWorkspaces can be accessed over the MwsVpcEndpoint as well as over the public network. In such a case, you could also configure an IpAccessList for the workspace, to restrict the source networks that could be used to access it over the public network. If `false`, the workspace can be accessed only over VPC endpoints, and not over the public network. Once explicitly set, this field becomes mandatory.
        """
        pulumi.set(__self__, "private_access_settings_name", private_access_settings_name)
        pulumi.set(__self__, "region", region)
        if account_id is not None:
            warnings.warn("""Configuring `account_id` at the resource-level is deprecated; please specify it in the `provider {}` configuration block instead""", DeprecationWarning)
            pulumi.log.warn("""account_id is deprecated: Configuring `account_id` at the resource-level is deprecated; please specify it in the `provider {}` configuration block instead""")
        if account_id is not None:
            pulumi.set(__self__, "account_id", account_id)
        if allowed_vpc_endpoint_ids is not None:
            pulumi.set(__self__, "allowed_vpc_endpoint_ids", allowed_vpc_endpoint_ids)
        if private_access_level is not None:
            pulumi.set(__self__, "private_access_level", private_access_level)
        if private_access_settings_id is not None:
            pulumi.set(__self__, "private_access_settings_id", private_access_settings_id)
        if public_access_enabled is not None:
            pulumi.set(__self__, "public_access_enabled", public_access_enabled)

    @_builtins.property
    @pulumi.getter(name="privateAccessSettingsName")
    def private_access_settings_name(self) -> pulumi.Input[_builtins.str]:
        """
        Name of Private Access Settings in Databricks Account
        """
        return pulumi.get(self, "private_access_settings_name")

    @private_access_settings_name.setter
    def private_access_settings_name(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "private_access_settings_name", value)

    @_builtins.property
    @pulumi.getter
    def region(self) -> pulumi.Input[_builtins.str]:
        """
        Region of AWS VPC or the Google Cloud VPC network
        """
        return pulumi.get(self, "region")

    @region.setter
    def region(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "region", value)

    @_builtins.property
    @pulumi.getter(name="accountId")
    @_utilities.deprecated("""Configuring `account_id` at the resource-level is deprecated; please specify it in the `provider {}` configuration block instead""")
    def account_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        return pulumi.get(self, "account_id")

    @account_id.setter
    def account_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "account_id", value)

    @_builtins.property
    @pulumi.getter(name="allowedVpcEndpointIds")
    def allowed_vpc_endpoint_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        An array of MwsVpcEndpoint `vpc_endpoint_id` (not `id`). Only used when `private_access_level` is set to `ENDPOINT`. This is an allow list of MwsVpcEndpoint that in your account that can connect to your MwsWorkspaces over AWS PrivateLink. If hybrid access to your workspace is enabled by setting `public_access_enabled` to true, then this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see the article for databricks_ip_access_list.
        """
        return pulumi.get(self, "allowed_vpc_endpoint_ids")

    @allowed_vpc_endpoint_ids.setter
    def allowed_vpc_endpoint_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "allowed_vpc_endpoint_ids", value)

    @_builtins.property
    @pulumi.getter(name="privateAccessLevel")
    def private_access_level(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object. `ACCOUNT` level access _(default)_ lets only MwsVpcEndpoint that are registered in your Databricks account connect to your databricks_mws_workspaces. `ENDPOINT` level access lets only specified MwsVpcEndpoint connect to your workspace. Please see the `allowed_vpc_endpoint_ids` documentation for more details.
        """
        return pulumi.get(self, "private_access_level")

    @private_access_level.setter
    def private_access_level(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "private_access_level", value)

    @_builtins.property
    @pulumi.getter(name="privateAccessSettingsId")
    def private_access_settings_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Canonical unique identifier of Private Access Settings in Databricks Account
        """
        return pulumi.get(self, "private_access_settings_id")

    @private_access_settings_id.setter
    def private_access_settings_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "private_access_settings_id", value)

    @_builtins.property
    @pulumi.getter(name="publicAccessEnabled")
    def public_access_enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        If `true`, the MwsWorkspaces can be accessed over the MwsVpcEndpoint as well as over the public network. In such a case, you could also configure an IpAccessList for the workspace, to restrict the source networks that could be used to access it over the public network. If `false`, the workspace can be accessed only over VPC endpoints, and not over the public network. Once explicitly set, this field becomes mandatory.
        """
        return pulumi.get(self, "public_access_enabled")

    @public_access_enabled.setter
    def public_access_enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "public_access_enabled", value)


@pulumi.input_type
class _MwsPrivateAccessSettingsState:
    def __init__(__self__, *,
                 account_id: Optional[pulumi.Input[_builtins.str]] = None,
                 allowed_vpc_endpoint_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 private_access_level: Optional[pulumi.Input[_builtins.str]] = None,
                 private_access_settings_id: Optional[pulumi.Input[_builtins.str]] = None,
                 private_access_settings_name: Optional[pulumi.Input[_builtins.str]] = None,
                 public_access_enabled: Optional[pulumi.Input[_builtins.bool]] = None,
                 region: Optional[pulumi.Input[_builtins.str]] = None):
        """
        Input properties used for looking up and filtering MwsPrivateAccessSettings resources.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_vpc_endpoint_ids: An array of MwsVpcEndpoint `vpc_endpoint_id` (not `id`). Only used when `private_access_level` is set to `ENDPOINT`. This is an allow list of MwsVpcEndpoint that in your account that can connect to your MwsWorkspaces over AWS PrivateLink. If hybrid access to your workspace is enabled by setting `public_access_enabled` to true, then this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see the article for databricks_ip_access_list.
        :param pulumi.Input[_builtins.str] private_access_level: The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object. `ACCOUNT` level access _(default)_ lets only MwsVpcEndpoint that are registered in your Databricks account connect to your databricks_mws_workspaces. `ENDPOINT` level access lets only specified MwsVpcEndpoint connect to your workspace. Please see the `allowed_vpc_endpoint_ids` documentation for more details.
        :param pulumi.Input[_builtins.str] private_access_settings_id: Canonical unique identifier of Private Access Settings in Databricks Account
        :param pulumi.Input[_builtins.str] private_access_settings_name: Name of Private Access Settings in Databricks Account
        :param pulumi.Input[_builtins.bool] public_access_enabled: If `true`, the MwsWorkspaces can be accessed over the MwsVpcEndpoint as well as over the public network. In such a case, you could also configure an IpAccessList for the workspace, to restrict the source networks that could be used to access it over the public network. If `false`, the workspace can be accessed only over VPC endpoints, and not over the public network. Once explicitly set, this field becomes mandatory.
        :param pulumi.Input[_builtins.str] region: Region of AWS VPC or the Google Cloud VPC network
        """
        if account_id is not None:
            warnings.warn("""Configuring `account_id` at the resource-level is deprecated; please specify it in the `provider {}` configuration block instead""", DeprecationWarning)
            pulumi.log.warn("""account_id is deprecated: Configuring `account_id` at the resource-level is deprecated; please specify it in the `provider {}` configuration block instead""")
        if account_id is not None:
            pulumi.set(__self__, "account_id", account_id)
        if allowed_vpc_endpoint_ids is not None:
            pulumi.set(__self__, "allowed_vpc_endpoint_ids", allowed_vpc_endpoint_ids)
        if private_access_level is not None:
            pulumi.set(__self__, "private_access_level", private_access_level)
        if private_access_settings_id is not None:
            pulumi.set(__self__, "private_access_settings_id", private_access_settings_id)
        if private_access_settings_name is not None:
            pulumi.set(__self__, "private_access_settings_name", private_access_settings_name)
        if public_access_enabled is not None:
            pulumi.set(__self__, "public_access_enabled", public_access_enabled)
        if region is not None:
            pulumi.set(__self__, "region", region)

    @_builtins.property
    @pulumi.getter(name="accountId")
    @_utilities.deprecated("""Configuring `account_id` at the resource-level is deprecated; please specify it in the `provider {}` configuration block instead""")
    def account_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        return pulumi.get(self, "account_id")

    @account_id.setter
    def account_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "account_id", value)

    @_builtins.property
    @pulumi.getter(name="allowedVpcEndpointIds")
    def allowed_vpc_endpoint_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        An array of MwsVpcEndpoint `vpc_endpoint_id` (not `id`). Only used when `private_access_level` is set to `ENDPOINT`. This is an allow list of MwsVpcEndpoint that in your account that can connect to your MwsWorkspaces over AWS PrivateLink. If hybrid access to your workspace is enabled by setting `public_access_enabled` to true, then this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see the article for databricks_ip_access_list.
        """
        return pulumi.get(self, "allowed_vpc_endpoint_ids")

    @allowed_vpc_endpoint_ids.setter
    def allowed_vpc_endpoint_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "allowed_vpc_endpoint_ids", value)

    @_builtins.property
    @pulumi.getter(name="privateAccessLevel")
    def private_access_level(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object. `ACCOUNT` level access _(default)_ lets only MwsVpcEndpoint that are registered in your Databricks account connect to your databricks_mws_workspaces. `ENDPOINT` level access lets only specified MwsVpcEndpoint connect to your workspace. Please see the `allowed_vpc_endpoint_ids` documentation for more details.
        """
        return pulumi.get(self, "private_access_level")

    @private_access_level.setter
    def private_access_level(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "private_access_level", value)

    @_builtins.property
    @pulumi.getter(name="privateAccessSettingsId")
    def private_access_settings_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Canonical unique identifier of Private Access Settings in Databricks Account
        """
        return pulumi.get(self, "private_access_settings_id")

    @private_access_settings_id.setter
    def private_access_settings_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "private_access_settings_id", value)

    @_builtins.property
    @pulumi.getter(name="privateAccessSettingsName")
    def private_access_settings_name(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Name of Private Access Settings in Databricks Account
        """
        return pulumi.get(self, "private_access_settings_name")

    @private_access_settings_name.setter
    def private_access_settings_name(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "private_access_settings_name", value)

    @_builtins.property
    @pulumi.getter(name="publicAccessEnabled")
    def public_access_enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        If `true`, the MwsWorkspaces can be accessed over the MwsVpcEndpoint as well as over the public network. In such a case, you could also configure an IpAccessList for the workspace, to restrict the source networks that could be used to access it over the public network. If `false`, the workspace can be accessed only over VPC endpoints, and not over the public network. Once explicitly set, this field becomes mandatory.
        """
        return pulumi.get(self, "public_access_enabled")

    @public_access_enabled.setter
    def public_access_enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "public_access_enabled", value)

    @_builtins.property
    @pulumi.getter
    def region(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Region of AWS VPC or the Google Cloud VPC network
        """
        return pulumi.get(self, "region")

    @region.setter
    def region(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "region", value)


@pulumi.type_token("databricks:index/mwsPrivateAccessSettings:MwsPrivateAccessSettings")
class MwsPrivateAccessSettings(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 account_id: Optional[pulumi.Input[_builtins.str]] = None,
                 allowed_vpc_endpoint_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 private_access_level: Optional[pulumi.Input[_builtins.str]] = None,
                 private_access_settings_id: Optional[pulumi.Input[_builtins.str]] = None,
                 private_access_settings_name: Optional[pulumi.Input[_builtins.str]] = None,
                 public_access_enabled: Optional[pulumi.Input[_builtins.bool]] = None,
                 region: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        """
        Allows you to create a Private Access Setting resource that can be used as part of a MwsWorkspaces resource to create a [Databricks Workspace that leverages AWS PrivateLink](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html) or [GCP Private Service Connect](https://docs.gcp.databricks.com/administration-guide/cloud-configurations/gcp/private-service-connect.html)

        > This resource can only be used with an account-level provider!

        It is strongly recommended that customers read the [Enable AWS Private Link](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html) [Enable GCP Private Service Connect](https://docs.gcp.databricks.com/administration-guide/cloud-configurations/gcp/private-service-connect.html) documentation before trying to leverage this resource.

        ## Databricks on AWS usage

        > Initialize provider with `alias = "mws"`, `host  = "https://accounts.cloud.databricks.com"` and use `provider = databricks.mws`

        ```python
        import pulumi
        import pulumi_databricks as databricks

        pas = databricks.MwsPrivateAccessSettings("pas",
            account_id=databricks_account_id,
            private_access_settings_name=f"Private Access Settings for {prefix}",
            region=region,
            public_access_enabled=True)
        ```

        The `databricks_mws_private_access_settings.pas.private_access_settings_id` can then be used as part of a MwsWorkspaces resource:

        ```python
        import pulumi
        import pulumi_databricks as databricks

        this = databricks.MwsWorkspaces("this",
            aws_region=region,
            workspace_name=prefix,
            credentials_id=this_databricks_mws_credentials["credentialsId"],
            storage_configuration_id=this_databricks_mws_storage_configurations["storageConfigurationId"],
            network_id=this_databricks_mws_networks["networkId"],
            private_access_settings_id=pas["privateAccessSettingsId"],
            pricing_tier="ENTERPRISE",
            opts = pulumi.ResourceOptions(depends_on=[this_databricks_mws_networks]))
        ```

        ## Databricks on GCP usage

        > Initialize provider with `alias = "mws"`, `host  = "https://accounts.gcp.databricks.com"` and use `provider = databricks.mws`

        ```python
        import pulumi
        import pulumi_databricks as databricks

        this = databricks.MwsWorkspaces("this",
            workspace_name="gcp-workspace",
            location=subnet_region,
            cloud_resource_container={
                "gcp": {
                    "project_id": google_project,
                },
            },
            network_id=this_databricks_mws_networks["networkId"],
            private_access_settings_id=pas["privateAccessSettingsId"],
            pricing_tier="PREMIUM",
            opts = pulumi.ResourceOptions(depends_on=[this_databricks_mws_networks]))
        ```

        ## Related Resources

        The following resources are used in the same context:

        * Provisioning Databricks on AWS guide.
        * Provisioning Databricks on AWS with Private Link guide.
        * Provisioning AWS Databricks workspaces with a Hub & Spoke firewall for data exfiltration protection guide.
        * Provisioning Databricks workspaces on GCP with Private Service Connect guide.
        * MwsVpcEndpoint to register aws_vpc_endpoint resources with Databricks such that they can be used as part of a MwsNetworks configuration.
        * MwsNetworks to [configure VPC](https://docs.databricks.com/administration-guide/cloud-configurations/aws/customer-managed-vpc.html) & subnets for new workspaces within AWS.
        * MwsWorkspaces to set up [AWS and GCP workspaces](https://docs.databricks.com/getting-started/overview.html#e2-architecture-1).

        ## Import

        This resource can be imported by Databricks account ID and private access settings ID.

        hcl

        import {

          to = databricks_mws_private_access_settings.this

          id = "<account_id>/<private_access_settings_id>"

        }

        Alternatively, when using `terraform` version 1.4 or earlier, import using the `pulumi import` command:

        ```sh
        $ pulumi import databricks:index/mwsPrivateAccessSettings:MwsPrivateAccessSettings this '<account_id>/<private_access_settings_id>'
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_vpc_endpoint_ids: An array of MwsVpcEndpoint `vpc_endpoint_id` (not `id`). Only used when `private_access_level` is set to `ENDPOINT`. This is an allow list of MwsVpcEndpoint that in your account that can connect to your MwsWorkspaces over AWS PrivateLink. If hybrid access to your workspace is enabled by setting `public_access_enabled` to true, then this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see the article for databricks_ip_access_list.
        :param pulumi.Input[_builtins.str] private_access_level: The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object. `ACCOUNT` level access _(default)_ lets only MwsVpcEndpoint that are registered in your Databricks account connect to your databricks_mws_workspaces. `ENDPOINT` level access lets only specified MwsVpcEndpoint connect to your workspace. Please see the `allowed_vpc_endpoint_ids` documentation for more details.
        :param pulumi.Input[_builtins.str] private_access_settings_id: Canonical unique identifier of Private Access Settings in Databricks Account
        :param pulumi.Input[_builtins.str] private_access_settings_name: Name of Private Access Settings in Databricks Account
        :param pulumi.Input[_builtins.bool] public_access_enabled: If `true`, the MwsWorkspaces can be accessed over the MwsVpcEndpoint as well as over the public network. In such a case, you could also configure an IpAccessList for the workspace, to restrict the source networks that could be used to access it over the public network. If `false`, the workspace can be accessed only over VPC endpoints, and not over the public network. Once explicitly set, this field becomes mandatory.
        :param pulumi.Input[_builtins.str] region: Region of AWS VPC or the Google Cloud VPC network
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: MwsPrivateAccessSettingsArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        Allows you to create a Private Access Setting resource that can be used as part of a MwsWorkspaces resource to create a [Databricks Workspace that leverages AWS PrivateLink](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html) or [GCP Private Service Connect](https://docs.gcp.databricks.com/administration-guide/cloud-configurations/gcp/private-service-connect.html)

        > This resource can only be used with an account-level provider!

        It is strongly recommended that customers read the [Enable AWS Private Link](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html) [Enable GCP Private Service Connect](https://docs.gcp.databricks.com/administration-guide/cloud-configurations/gcp/private-service-connect.html) documentation before trying to leverage this resource.

        ## Databricks on AWS usage

        > Initialize provider with `alias = "mws"`, `host  = "https://accounts.cloud.databricks.com"` and use `provider = databricks.mws`

        ```python
        import pulumi
        import pulumi_databricks as databricks

        pas = databricks.MwsPrivateAccessSettings("pas",
            account_id=databricks_account_id,
            private_access_settings_name=f"Private Access Settings for {prefix}",
            region=region,
            public_access_enabled=True)
        ```

        The `databricks_mws_private_access_settings.pas.private_access_settings_id` can then be used as part of a MwsWorkspaces resource:

        ```python
        import pulumi
        import pulumi_databricks as databricks

        this = databricks.MwsWorkspaces("this",
            aws_region=region,
            workspace_name=prefix,
            credentials_id=this_databricks_mws_credentials["credentialsId"],
            storage_configuration_id=this_databricks_mws_storage_configurations["storageConfigurationId"],
            network_id=this_databricks_mws_networks["networkId"],
            private_access_settings_id=pas["privateAccessSettingsId"],
            pricing_tier="ENTERPRISE",
            opts = pulumi.ResourceOptions(depends_on=[this_databricks_mws_networks]))
        ```

        ## Databricks on GCP usage

        > Initialize provider with `alias = "mws"`, `host  = "https://accounts.gcp.databricks.com"` and use `provider = databricks.mws`

        ```python
        import pulumi
        import pulumi_databricks as databricks

        this = databricks.MwsWorkspaces("this",
            workspace_name="gcp-workspace",
            location=subnet_region,
            cloud_resource_container={
                "gcp": {
                    "project_id": google_project,
                },
            },
            network_id=this_databricks_mws_networks["networkId"],
            private_access_settings_id=pas["privateAccessSettingsId"],
            pricing_tier="PREMIUM",
            opts = pulumi.ResourceOptions(depends_on=[this_databricks_mws_networks]))
        ```

        ## Related Resources

        The following resources are used in the same context:

        * Provisioning Databricks on AWS guide.
        * Provisioning Databricks on AWS with Private Link guide.
        * Provisioning AWS Databricks workspaces with a Hub & Spoke firewall for data exfiltration protection guide.
        * Provisioning Databricks workspaces on GCP with Private Service Connect guide.
        * MwsVpcEndpoint to register aws_vpc_endpoint resources with Databricks such that they can be used as part of a MwsNetworks configuration.
        * MwsNetworks to [configure VPC](https://docs.databricks.com/administration-guide/cloud-configurations/aws/customer-managed-vpc.html) & subnets for new workspaces within AWS.
        * MwsWorkspaces to set up [AWS and GCP workspaces](https://docs.databricks.com/getting-started/overview.html#e2-architecture-1).

        ## Import

        This resource can be imported by Databricks account ID and private access settings ID.

        hcl

        import {

          to = databricks_mws_private_access_settings.this

          id = "<account_id>/<private_access_settings_id>"

        }

        Alternatively, when using `terraform` version 1.4 or earlier, import using the `pulumi import` command:

        ```sh
        $ pulumi import databricks:index/mwsPrivateAccessSettings:MwsPrivateAccessSettings this '<account_id>/<private_access_settings_id>'
        ```

        :param str resource_name: The name of the resource.
        :param MwsPrivateAccessSettingsArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(MwsPrivateAccessSettingsArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 account_id: Optional[pulumi.Input[_builtins.str]] = None,
                 allowed_vpc_endpoint_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 private_access_level: Optional[pulumi.Input[_builtins.str]] = None,
                 private_access_settings_id: Optional[pulumi.Input[_builtins.str]] = None,
                 private_access_settings_name: Optional[pulumi.Input[_builtins.str]] = None,
                 public_access_enabled: Optional[pulumi.Input[_builtins.bool]] = None,
                 region: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = MwsPrivateAccessSettingsArgs.__new__(MwsPrivateAccessSettingsArgs)

            __props__.__dict__["account_id"] = account_id
            __props__.__dict__["allowed_vpc_endpoint_ids"] = allowed_vpc_endpoint_ids
            __props__.__dict__["private_access_level"] = private_access_level
            __props__.__dict__["private_access_settings_id"] = private_access_settings_id
            if private_access_settings_name is None and not opts.urn:
                raise TypeError("Missing required property 'private_access_settings_name'")
            __props__.__dict__["private_access_settings_name"] = private_access_settings_name
            __props__.__dict__["public_access_enabled"] = public_access_enabled
            if region is None and not opts.urn:
                raise TypeError("Missing required property 'region'")
            __props__.__dict__["region"] = region
        super(MwsPrivateAccessSettings, __self__).__init__(
            'databricks:index/mwsPrivateAccessSettings:MwsPrivateAccessSettings',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            account_id: Optional[pulumi.Input[_builtins.str]] = None,
            allowed_vpc_endpoint_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
            private_access_level: Optional[pulumi.Input[_builtins.str]] = None,
            private_access_settings_id: Optional[pulumi.Input[_builtins.str]] = None,
            private_access_settings_name: Optional[pulumi.Input[_builtins.str]] = None,
            public_access_enabled: Optional[pulumi.Input[_builtins.bool]] = None,
            region: Optional[pulumi.Input[_builtins.str]] = None) -> 'MwsPrivateAccessSettings':
        """
        Get an existing MwsPrivateAccessSettings resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_vpc_endpoint_ids: An array of MwsVpcEndpoint `vpc_endpoint_id` (not `id`). Only used when `private_access_level` is set to `ENDPOINT`. This is an allow list of MwsVpcEndpoint that in your account that can connect to your MwsWorkspaces over AWS PrivateLink. If hybrid access to your workspace is enabled by setting `public_access_enabled` to true, then this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see the article for databricks_ip_access_list.
        :param pulumi.Input[_builtins.str] private_access_level: The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object. `ACCOUNT` level access _(default)_ lets only MwsVpcEndpoint that are registered in your Databricks account connect to your databricks_mws_workspaces. `ENDPOINT` level access lets only specified MwsVpcEndpoint connect to your workspace. Please see the `allowed_vpc_endpoint_ids` documentation for more details.
        :param pulumi.Input[_builtins.str] private_access_settings_id: Canonical unique identifier of Private Access Settings in Databricks Account
        :param pulumi.Input[_builtins.str] private_access_settings_name: Name of Private Access Settings in Databricks Account
        :param pulumi.Input[_builtins.bool] public_access_enabled: If `true`, the MwsWorkspaces can be accessed over the MwsVpcEndpoint as well as over the public network. In such a case, you could also configure an IpAccessList for the workspace, to restrict the source networks that could be used to access it over the public network. If `false`, the workspace can be accessed only over VPC endpoints, and not over the public network. Once explicitly set, this field becomes mandatory.
        :param pulumi.Input[_builtins.str] region: Region of AWS VPC or the Google Cloud VPC network
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _MwsPrivateAccessSettingsState.__new__(_MwsPrivateAccessSettingsState)

        __props__.__dict__["account_id"] = account_id
        __props__.__dict__["allowed_vpc_endpoint_ids"] = allowed_vpc_endpoint_ids
        __props__.__dict__["private_access_level"] = private_access_level
        __props__.__dict__["private_access_settings_id"] = private_access_settings_id
        __props__.__dict__["private_access_settings_name"] = private_access_settings_name
        __props__.__dict__["public_access_enabled"] = public_access_enabled
        __props__.__dict__["region"] = region
        return MwsPrivateAccessSettings(resource_name, opts=opts, __props__=__props__)

    @_builtins.property
    @pulumi.getter(name="accountId")
    @_utilities.deprecated("""Configuring `account_id` at the resource-level is deprecated; please specify it in the `provider {}` configuration block instead""")
    def account_id(self) -> pulumi.Output[_builtins.str]:
        return pulumi.get(self, "account_id")

    @_builtins.property
    @pulumi.getter(name="allowedVpcEndpointIds")
    def allowed_vpc_endpoint_ids(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
        """
        An array of MwsVpcEndpoint `vpc_endpoint_id` (not `id`). Only used when `private_access_level` is set to `ENDPOINT`. This is an allow list of MwsVpcEndpoint that in your account that can connect to your MwsWorkspaces over AWS PrivateLink. If hybrid access to your workspace is enabled by setting `public_access_enabled` to true, then this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see the article for databricks_ip_access_list.
        """
        return pulumi.get(self, "allowed_vpc_endpoint_ids")

    @_builtins.property
    @pulumi.getter(name="privateAccessLevel")
    def private_access_level(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object. `ACCOUNT` level access _(default)_ lets only MwsVpcEndpoint that are registered in your Databricks account connect to your databricks_mws_workspaces. `ENDPOINT` level access lets only specified MwsVpcEndpoint connect to your workspace. Please see the `allowed_vpc_endpoint_ids` documentation for more details.
        """
        return pulumi.get(self, "private_access_level")

    @_builtins.property
    @pulumi.getter(name="privateAccessSettingsId")
    def private_access_settings_id(self) -> pulumi.Output[_builtins.str]:
        """
        Canonical unique identifier of Private Access Settings in Databricks Account
        """
        return pulumi.get(self, "private_access_settings_id")

    @_builtins.property
    @pulumi.getter(name="privateAccessSettingsName")
    def private_access_settings_name(self) -> pulumi.Output[_builtins.str]:
        """
        Name of Private Access Settings in Databricks Account
        """
        return pulumi.get(self, "private_access_settings_name")

    @_builtins.property
    @pulumi.getter(name="publicAccessEnabled")
    def public_access_enabled(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        If `true`, the MwsWorkspaces can be accessed over the MwsVpcEndpoint as well as over the public network. In such a case, you could also configure an IpAccessList for the workspace, to restrict the source networks that could be used to access it over the public network. If `false`, the workspace can be accessed only over VPC endpoints, and not over the public network. Once explicitly set, this field becomes mandatory.
        """
        return pulumi.get(self, "public_access_enabled")

    @_builtins.property
    @pulumi.getter
    def region(self) -> pulumi.Output[_builtins.str]:
        """
        Region of AWS VPC or the Google Cloud VPC network
        """
        return pulumi.get(self, "region")

