Users to Databricks networking
This guide introduces features to customize network access between users and their Databricks workspaces.
By default, users and applications can connect to Databricks from any IP address. Users might access critical data sources using Databricks. If a user's credentials are compromised through phishing or a similar attack, securing network access dramatically reduces the risk of an account takeover. Configurations like private connectivity, IP access lists, and firewalls help keep critical data secure.
You can also configure authentication and access control features to protect your users' credentials, see Authentication and access control.
The features on this page secure how users and applications connect to Databricks, one of the three connection points in the Databricks networking architecture.
See Networking security architecture.
Users to Databricks secure networking features require the Premium plan.
Private connectivity
Between Databricks users and the control plane, Private Service Connect provides strong controls that limit the source for inbound requests. If your organization routes traffic through a GCP environment, you can use Private Service Connect to ensure the communication between users and the Databricks control plane does not traverse public IP addresses. See Configure Inbound Private Service Connect.
Context-based ingress control
Context-based ingress control uses workspace-level policies that combine identity, request type, and network source to determine who can reach your workspaces.
For the access types, network sources, and identities you can match, along with enforcement modes and how ingress interacts with IP access lists and private connectivity, see Context-based ingress control.
To configure policies, see Manage workspace context-based ingress policies.
IP access lists
Authentication proves user identity, but it does not enforce the users' network location. Accessing a cloud service from an unsecured network poses security risks, especially when the user may have authorized access to sensitive or personal data. Using IP access lists, you can configure Databricks workspaces so that users connect to the service only through existing networks with a secure perimeter.
Admins can specify the IP addresses that are allowed access to Databricks. You can also specify IP addresses or subnets to block. For details, see Manage IP access lists.
You can also use Private Service Connect to block all public internet access to a Databricks workspace.
Firewall rules
Many organizations use firewall to block traffic based on domain names. You must allow list Databricks domain names to ensure access to Databricks resources. For more information, see Configure domain name firewall rules.
Databricks also performs host header validation to ensure requests use authorized Databricks domains like .gcp.databricks.com. Requests using domains outside of the Databricks network will be blocked. This security measure protects against potential HTTP host header attacks.