databricks update groups command is unnecessarily destructive

[tim-sparq]

Describe the issue

Running the databricks groups update [group id] command without the --json flag deletes all of the specified group's configuration, including all members, potentially with destructive impact.

Recently this caused a production incident in our environment when all users were silently removed from our workspace's admins group, causing pipelines to break and locking us out of our workspace.

This behaviour - which is undocumented - is unnecessarily destructive. If no configuration is supplied, the command should arguably throw an error, instead of silently removing all users from the specified group. Compare to other major clis (such as az / gcloud) where such a destructive behavior is not possible.

Steps to reproduce the behavior

Please list the steps required to reproduce the issue, for example:

1. Run databricks groups update [group id], omitting the --json flag

Expected Behavior

The command should return an error notifying the user that no configuration was supplied

Actual Behavior

The command silently deletes all of the specified group's configuration, including all members, potentially with destructive impact

OS and CLI version

macos, Databricks CLI v0.219.0,

Is this a regression?

No

Debug Logs

N/A