Databricks workspace uses a customer-managed key

resource "azurerm_databricks_workspace" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<region>"
  sku                 = "premium"

  customer_managed_key_enabled      = true  # CRITICAL: enable CMK
  managed_disk_cmk_key_vault_key_id = "<example_resource_id>" # CRITICAL: key ID (Key Vault key) for managed disks
}

resource ws 'Microsoft.Databricks/workspaces@2023-02-01' = {
  name: '<example_resource_name>'
  location: '<region>'
  sku: {
    name: 'premium'
  }
  properties: {
    encryption: {
      keySource: 'Microsoft.Keyvault' // CRITICAL: enables CMK from Key Vault
      managedDiskKeyVaultProperties: { // CRITICAL: sets CMK for managed disks (encryption at rest)
        keyVaultUri: 'https://<key_vault_name>.vault.azure.net/'
        keyName: '<key_name>'
        keyVersion: '<key_version>'
      }
    }
  }
}