How can I create a storage credential in Databricks using an AWS IAM Role and assign it to specific workspaces?
1. In Databricks, log in to a workspace that is linked to the metastore. You must have the CREATE STORAGE CREDENTIAL privilege. Click Catalog, then click the +Add button and select Add a storage credential from the menu. Select a Credential Type of AWS IAM Role, enter a name for the credential, the IAM Role ARN, and an optional comment. Click Create, then copy the External ID.

2. (Optional) Bind the storage credential to specific workspaces: By default, any privileged user can use the storage credential on any workspace attached to the metastore. If you want to allow access only from specific workspaces, go to the Workspaces tab and assign workspaces.

3. Update the IAM role policy in AWS: Modify the trust relationship policy to add your storage credential’s external ID and make it self-assuming. Return to your saved IAM role and go to the Trust Relationships tab. Edit the trust relationship policy as follows: Add the following ARN to the “Allow” statement. Replace <YOUR-AWS-ACCOUNT-ID> and <THIS-ROLE-NAME> with your actual account ID and IAM role values. In the "sts:AssumeRole" statement, update the placeholder external ID to your storage credential’s external ID that you copied in the previous step.

(Optional) Assign a storage credential to specific workspaces: By default, any privileged user can use the storage credential on any workspace attached to the metastore. If you want to allow access only from specific workspaces, go to the Workspaces tab and assign workspaces.