Networking

Databricks provides a secure networking environment by default. You can configure additional networking features to control access to workspaces, secure connectivity between the control plane and compute planes, and protect connections to your data sources.

note

There are currently no networking charges for serverless features. In a later release, you might be charged. Databricks will provide advance notice for networking pricing changes.

See Understand Databricks networking costs.

How Databricks networking fits together

Databricks networking spans three connection points, each secured independently. The features in the sections below map to these connections:

• Users and applications to Databricks: Control inbound access to workspaces and account-level resources with private connectivity, context-based ingress control, and IP access lists. See Users to Databricks networking.
• The control plane and the classic compute plane: Deploy classic compute in your own virtual network and keep control plane traffic on private networking. See Classic compute plane networking.
• The serverless compute plane and your resources: Govern how the Databricks-managed serverless compute plane reaches your data and services with egress controls, private connectivity, and firewall configurations. See Serverless compute plane networking.

For the control plane and compute plane architecture behind these connections, see Networking security architecture.

Get started

Understand Databricks networking architecture and explore key concepts.

• • Networking security architecture
  • Learn about the control plane and compute plane architecture that forms the foundation of Databricks networking.
• • Private Service Connect
  • Establish private connections between your network and Databricks using Private Service Connect for enhanced security.
• • Understand data transfer and connectivity costs
  • Learn about data transfer pricing and optimize costs for network connectivity features.

Connectivity

Configure secure network connections for inbound access to workspaces and outbound connectivity from compute resources.

• • Front-end networking
  • Configure network access controls for users connecting to Databricks workspaces through the web interface and APIs.
• • Front-end Private Link
  • Enable private connectivity from your corporate network to Databricks workspaces using Private Service Connect.
• • Serverless compute plane networking
  • Configure secure network access between serverless compute resources and your data sources and services.
• • Classic compute plane networking
  • Learn about networking options for classic compute resources deployed in your virtual network.
• • Deploy Databricks in a customer-managed VPC
  • Host Databricks clusters in your own Google Cloud VPC for enhanced network control.
• • Back-end Private Service Connect
  • Establish private connectivity between classic compute resources and the Databricks control plane.
• • Manage private access settings
  • Configure private connectivity settings at the account level for workspace deployment.

Network security

Implement security controls to restrict and monitor network access.

• • What is serverless egress control?
  • Restrict outbound network connections from serverless compute resources to prevent data exfiltration and enforce compliance.
• • Manage network policies for serverless egress control
  • Create and manage network policies that define allowed egress connections from serverless compute.
• • IP access lists overview
  • Learn how to use IP access lists to control which IP addresses can access your Databricks workspaces.
• • IP access lists for workspaces
  • Configure workspace-level IP access controls to restrict access from approved networks.
• • IP access lists for the account console
  • Set account-level IP restrictions that apply across multiple workspaces for centralized security management.
• • Limit network egress for your workspace using a firewall
  • Configure firewall rules to control outbound traffic from classic compute resources.
• • Domain name firewall rules
  • Configure domain-based firewall rules to allow Databricks services through your network security controls.