Skip to content

AWS PrivateLink for Databricks

AWS PrivateLink provides private connectivity from the Immuta SaaS platform to customer-managed Databricks accounts hosted on AWS. It ensures that all traffic to the configured endpoints only traverses private networks.

This front-end PrivateLink connection allows users to connect to the Databricks web application, REST API, and Databricks Connect API over a VPC interface endpoint. For details about AWS PrivateLink in Databricks and the network flow in a typical implementation, explore the Databricks documentation.

This feature is supported in most regions across Immuta's Global Segments (NA, EU, and AP); please contact your Immuta account manager if you have questions about availability.

Data Flow



Ensure that your accounts meet the following requirements:

Databricks workspace

Ensure that your workspace meets the following requirements:


Contact your Databricks representative to enable AWS PrivateLink on your account.

  1. Contact your Immuta representative, who will provide the PrivateLink endpoint IDs to register with your accounts. You will need to provide the following information:

  2. Register the PrivateLink endpoint IDs.

    • If the private_access_level on your private_access_settings object is set to ACCOUNT, you should not need to do anything else beyond the registration.
    • If the private_access_level on your private_access_settings object is set to ENDPOINT, you will need to add it to the allowed_vpc_endpoint_ids list inside your private_access_settings object in Databricks. For example,

      "private_access_settings_name": "immuta-access",
      "region": "us-east-1",
      "public_access_enabled": false,
      "private_access_level": "ENDPOINT",
      "allowed_vpc_endpoint_ids": [
  3. Configure the Databricks integration using your Databricks workspace URL.

  4. Register your tables as Immuta data sources.


    Note that the privatelink-account-url from the JSON object in step one will be the Server when registering data sources.