Explanation:
In Databricks, audit logs capture the identity of the specific principal (user or service principal) whose credentials were used to authenticate each individual REST API request.
jobs/create endpoint, the audit log entry for that event will list User A as the actor (userId).jobs/run-now (or equivalent) endpoint, the audit log will record User B as the actor for that specific execution event.This can be verified by querying the Databricks audit log system table (system.access.audit), which tracks the userId and userName for every API event.
Why the other options are incorrect:
Ultimate access to all questions.
A Data Engineer (User A) has established several new data pipeline jobs using the Databricks REST API. Subsequently, a DevOps Engineer (User B) configures an external tool to trigger these jobs via the REST API. Both engineers utilized their respective personal access tokens (PATs) for authorization. How will these specific actions be documented in the workspace audit logs?
A
To maintain security, user identities are excluded from audit logs when actions are performed via the REST API.
B
Because User A is the owner and creator of the jobs, their identity will be logged for both the creation and all subsequent executions, regardless of who triggers them.
C
User A's identity will be associated with the job creation events, while User B's identity will be associated with the job execution events.
D
The system will automatically assign a Service Principal identity to these events because the REST API was used for both creation and execution.
No comments yet.