From acd3520b6a5e6b7b42f5cd1c44dfe1b943977b10 Mon Sep 17 00:00:00 2001
From: rileymccuen <rileymccuen@ydropbox.com>
Date: Thu, 22 Jan 2026 20:14:08 -0600
Subject: [PATCH 1/2] Add run_as support for alerts

---
 .../config/mutator/resourcemutator/run_as.go  | 31 +++++++++++++------
 .../mutator/resourcemutator/run_as_test.go    |  4 +++
 2 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/bundle/config/mutator/resourcemutator/run_as.go b/bundle/config/mutator/resourcemutator/run_as.go
index 8433db9ed8..0d5465fd8a 100644
--- a/bundle/config/mutator/resourcemutator/run_as.go
+++ b/bundle/config/mutator/resourcemutator/run_as.go
@@ -11,6 +11,7 @@ import (
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
+	"github.com/databricks/databricks-sdk-go/service/sql"
 )
 
 type setRunAs struct{}
@@ -110,16 +111,6 @@ func validateRunAs(b *bundle.Bundle) diag.Diagnostics {
 		))
 	}
 
-	// Alerts do not support run_as in the API.
-	if len(b.Config.Resources.Alerts) > 0 {
-		diags = diags.Extend(reportRunAsNotSupported(
-			"alerts",
-			b.Config.GetLocation("resources.alerts"),
-			b.Config.Workspace.CurrentUser.UserName,
-			identity,
-		))
-	}
-
 	// Apps do not support run_as in the API.
 	if len(b.Config.Resources.Apps) > 0 {
 		diags = diags.Extend(reportRunAsNotSupported(
@@ -169,6 +160,24 @@ func setRunAsForPipelines(b *bundle.Bundle) {
 	}
 }
 
+func setRunAsForAlerts(b *bundle.Bundle) {
+	runAs := b.Config.RunAs
+	if runAs == nil {
+		return
+	}
+
+	for i := range b.Config.Resources.Alerts {
+		alert := b.Config.Resources.Alerts[i]
+		if alert.RunAs != nil {
+			continue
+		}
+		alert.RunAs = &sql.AlertV2RunAs{
+			ServicePrincipalName: runAs.ServicePrincipalName,
+			UserName:             runAs.UserName,
+		}
+	}
+}
+
 // Legacy behavior of run_as for DLT pipelines. Available under the experimental.use_run_as_legacy flag.
 // Only available to unblock customers stuck due to breaking changes in https://github.com/databricks/cli/pull/1233
 func setPipelineOwnersToRunAsIdentity(b *bundle.Bundle) {
@@ -216,6 +225,7 @@ func (m *setRunAs) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
 	if b.Config.Experimental != nil && b.Config.Experimental.UseLegacyRunAs {
 		setPipelineOwnersToRunAsIdentity(b)
 		setRunAsForJobs(b)
+		setRunAsForAlerts(b)
 		return diag.Diagnostics{
 			{
 				Severity:  diag.Warning,
@@ -234,5 +244,6 @@ func (m *setRunAs) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
 
 	setRunAsForJobs(b)
 	setRunAsForPipelines(b)
+	setRunAsForAlerts(b)
 	return nil
 }
diff --git a/bundle/config/mutator/resourcemutator/run_as_test.go b/bundle/config/mutator/resourcemutator/run_as_test.go
index 7500374adc..2121bbbbd9 100644
--- a/bundle/config/mutator/resourcemutator/run_as_test.go
+++ b/bundle/config/mutator/resourcemutator/run_as_test.go
@@ -99,6 +99,9 @@ func TestRunAsWorksForAllowedResources(t *testing.T) {
 			Pipelines: map[string]*resources.Pipeline{
 				"pipeline_one": {},
 			},
+			Alerts: map[string]*resources.Alert{
+				"alert_one": {},
+			},
 		},
 	}
 
@@ -158,6 +161,7 @@ var allowList = []string{
 	"secret_scopes",
 	"sql_warehouses",
 	"volumes",
+	"alerts",
 }
 
 func TestRunAsErrorForUnsupportedResources(t *testing.T) {

From b18c166b25b0575e5fd4ec8255bb1fd4ea461c22 Mon Sep 17 00:00:00 2001
From: rileymccuen <rileymccuen@ydropbox.com>
Date: Mon, 26 Jan 2026 10:04:20 -0600
Subject: [PATCH 2/2] added alert assetion in TestRunAsWorksForAllowedResources

---
 bundle/config/mutator/resourcemutator/run_as_test.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bundle/config/mutator/resourcemutator/run_as_test.go b/bundle/config/mutator/resourcemutator/run_as_test.go
index 2121bbbbd9..11f514b8b3 100644
--- a/bundle/config/mutator/resourcemutator/run_as_test.go
+++ b/bundle/config/mutator/resourcemutator/run_as_test.go
@@ -115,6 +115,10 @@ func TestRunAsWorksForAllowedResources(t *testing.T) {
 	for _, job := range b.Config.Resources.Jobs {
 		assert.Equal(t, "bob", job.RunAs.UserName)
 	}
+
+	for _, alert := range b.Config.Resources.Alerts {
+		assert.Equal(t, "bob", alert.RunAs.UserName)
+	}
 }
 
 // Bundle "run_as" has two modes of operation, each with a different set of