The Databricks Terraform provider added write-only secret values and new domain and sandbox resources.

In September 2026, the Databricks Terraform provider received three releases, led by versions v1.132.0 and v1.135.0 [1, 3, 6]. Version 1.132.0 introduced the databricks_domain and databricks_sandbox resources, added secret securable support to databricks_grant, and resolved persistent diff errors and inconsistent results in databricks_app configurations managing Git source fields [6]. Later in the month, version 1.135.0 added the string_value_wo and string_value_wo_version attributes to the databricks_secret resource, enabling users to write secret values into secret scopes without storing them in clear text [1]. Version 1.134.0 was also tagged during this cycle [3].

At the same time, changes in the broader Databricks toolchain influenced how teams organized their infrastructure code. Databricks CLI releases v1.16.0 through v1.18.0 improved the Databricks Asset Bundles direct deployment engine, fixing unnecessary resource recreations and resolving Unity Catalog grant convergence issues [2, 5, 7]. The direct deployment engine state format also updated to version 3, creating a breaking change that required Databricks CLI v1.8.0 or newer [5].

Because the direct engine reached default status, community members debated the operational boundary between bundles and the Terraform provider [4]. Practitioners discussed whether core infrastructure and access controls should remain strictly in Terraform, while application packaging, jobs, and development environments migrate to direct engine bundles.