AWS PrivateLink for Databricks

AWS PrivateLink provides private connectivity from the Immuta SaaS platform to customer-managed Databricks accounts hosted on AWS. It ensures that all traffic to the configured endpoints only traverses private networks.

This front-end PrivateLink connection allows users to connect to the Databricks web application, REST API, and Databricks Connect API over a VPC interface endpoint. For details about AWS PrivateLink in Databricks and the network flow in a typical implementation, explore the Databricks documentation.

This feature is supported in most regions across Immuta's Global Segments (NA, EU, and AP); contact your Immuta account manager if you have questions about availability.

Requirements

Databricks

Ensure that your accounts meet the following requirements:

• Your Databricks account is on the E2 version of the platform.

• Your Databricks account is on the Enterprise pricing tier.

• You have your Databricks account ID from the account console.

• You have an Immuta SaaS tenant.

• AWS PrivateLink for Databricks has been enabled.

Databricks workspace

Ensure that your workspace meets the following requirements:

• Your workspace must be in an AWS region that supports the E2 version of the platform. In the us-west-1 region, Databricks does not support PrivateLink even for workspaces on the E2 version of the platform.

• Your Databricks workspace must use Customer-managed VPC to add any PrivateLink connection.

• Your workspaces must be configured with private_access_settings objects.

Enablement

Contact your Databricks representative to enable AWS PrivateLink on your account.

Configure Databricks with AWS PrivateLink

Register the Immuta VPC endpoint for the applicable AWS region with your Databricks workspaces. The Immuta VPC endpoint IDs are listed in the table below.

AWS Region	VPC Endpoint Id
ap-northeast-1 Asia Pacific (Tokyo)	vpce-08cadda15f0f70462
ap-south-1 Asia Pacific (Mumbai)	vpce-0efef886a4fbd9532
ap-southeast-1 Asia Pacific (Singapore)	vpce-07e9890053f5084b2
ap-southeast-2 Asia Pacific (Sydney)	vpce-0d363d9ea82658bec
ca-central-1 Canada (Central)	vpce-01933bcf30ac4ed19
eu-central-1 Europe (Frankfurt)	vpce-0048e36edfb27d0aa
eu-west-1 Europe (Ireland)	vpce-0783d9412b046df1f
eu-west-2 Europe (London)	vpce-0f546cc413bf70baa
us-east-1 US East (Virginia)	vpce-0c6e8f337e0753aa9
us-east-2 US East (Ohio)	vpce-00ba42c4e2be20721
us-west-2 US West (Oregon)	vpce-029306c6a510f7b79

Identify your private access level (either ACCOUNT or ENDPOINT) and configure your Databricks workspace accordingly.

• If the private_access_level on your private_access_settings object is set to ACCOUNT, no additional configuration is required.

• If the private_access_level on your private_access_settings object is set to ENDPOINT, using the table above, you will need to add it to the allowed_vpc_endpoint_ids list inside your private_access_settings object in Databricks. For example,

  "private_access_settings_name": "immuta-access",
  "region": "us-east-1",
  "public_access_enabled": false,
  "private_access_level": "ENDPOINT",
  "allowed_vpc_endpoint_ids": [
          "vpce-0fe5b17a0707d6fa5"
  ]