This section contains information about private connectivity options for Databricks integrations.

Overview

The Immuta SaaS platform supports private connectivity to Databricks on AWS and the Azure Databricks Service. This allows customers to meet security and compliance controls by ensuring that traffic to data sources from Immuta SaaS only traverses private networks, never the public internet.

Support for AWS PrivateLink is available in most regions across Immuta's Global Segments (NA, EU, and AP); please contact your Immuta account manager if you have questions about availability.

Support for Azure Private Link is available in all Databricks-supported Azure regions.

Configuration Guides

• AWS PrivateLink

• Azure Private Link

AWS PrivateLink provides private connectivity from the Immuta SaaS platform to customer-managed Databricks accounts hosted on AWS. It ensures that all traffic to the configured endpoints only traverses private networks.

This front-end PrivateLink connection allows users to connect to the Databricks web application, REST API, and Databricks Connect API over a VPC interface endpoint. For details about AWS PrivateLink in Databricks and the network flow in a typical implementation, explore the Databricks documentation.

This feature is supported in most regions across Immuta's Global Segments (NA, EU, and AP); please contact your Immuta account manager if you have questions about availability.

Requirements

Databricks

Ensure that your accounts meet the following requirements:

• Your Databricks account is on the E2 version of the platform.

• Your Databricks account is on the Enterprise pricing tier.

• You have your Databricks account ID from the account console.

• You have an Immuta SaaS tenant.

• AWS PrivateLink for Databricks has been enabled.

Databricks workspace

Ensure that your workspace meets the following requirements:

• Your workspace must be in an AWS region that supports the E2 version of the platform. In the us-west-1 region, Databricks does not support PrivateLink even for workspaces on the E2 version of the platform.

• Your Databricks workspace must use Customer-managed VPC to add any PrivateLink connection.

• Your workspaces must be configured with private_access_settings objects.

Enablement

Contact your Databricks representative to enable AWS PrivateLink on your account.

Configure Databricks with AWS PrivateLink

Register the Immuta VPC endpoint for the applicable AWS region with your Databricks workspaces. The Immuta VPC endpoint IDs are listed in the table below.

Identify your private access level (either ACCOUNT or ENDPOINT) and configure your Databricks workspace accordingly.

• If the private_access_level on your private_access_settings object is set to ACCOUNT, no additional configuration is required.

• If the private_access_level on your private_access_settings object is set to ENDPOINT, using the table above, you will need to add it to the allowed_vpc_endpoint_ids list inside your private_access_settings object in Databricks. For example,

  Copy

  "private_access_settings_name": "immuta-access",
  "region": "us-east-1",
  "public_access_enabled": false,
  "private_access_level": "ENDPOINT",
  "allowed_vpc_endpoint_ids": [
          "vpce-0fe5b17a0707d6fa5"
  ]

AWS PrivateLink provides private connectivity from the Immuta SaaS platform to customer-managed Redshift Clusters hosted on AWS. It ensures that all traffic to the configured endpoints only traverses private networks.

This feature is supported in most regions across Immuta's Global Segments (NA, EU, and AP); please contact your Immuta account manager if you have questions about availability.

Requirements

• You have an Immuta SaaS tenant.

• You have set up an AWS PrivateLink Service for your Redshift Cluster endpoints.

  • If you have configured Private DNS Hostnames on your PrivateLink Service, the domain ownership must be verifiable via a public DNS zone. This means that you cannot use a Top-Level Domain (TLD) that is not publicly resolvable, e.g. redshift.mycompany.internal.

  • If you are using TLS, the presented certificate must have the Fully-Qualified Domain Name (FQDN) of your cluster as a Subject Alternative Name (SAN).

  • When creating the service, make sure that the Require Acceptance option is checked (this does not allow anyone to connect, all connections will be blocked until the Immuta Service Principal is added).

Configure Redshift with AWS PrivateLink

1. Open a support ticket with Immuta Support with the following information:

   • AWS Region

   • AWS Subnet Availability Zones IDs (e.g. use1-az3)

   • VPC Endpoint Service ID

   • DNS Hostname

   • Ports Used

2. Authorize the Service Principal provided by your representative so that Immuta can complete the VPC Endpoint configuration.

3. Configure the Redshift integration.

4. Register your tables as Immuta data sources.

Azure Private Link provides private connectivity from the Immuta SaaS platform, hosted on AWS, to customer-managed Azure Databricks accounts. It ensures that all traffic to the configured endpoints only traverses private networks over the Immuta Private Cloud Exchange.

This front-end Private Link connection allows users to connect to the Databricks web application, REST API, and Databricks Connect API over an Azure Private Endpoint. For details about Azure Private Link for Databricks and the network flow in a typical implementation, explore the Databricks documentation.

Support for Azure Private Link is available in all Databricks-supported Azure regions.

Requirements

Ensure that your accounts meet the following requirements:

• You have an Immuta SaaS tenant.

• Your Azure Databricks workspace must be on the Premium or Enterprise pricing tier.

• Azure Private Link for Databricks has been configured and enabled.

• You have your Databricks account ID from the account console.

Configure Databricks with Azure Private Link

1. Contact your Immuta representative, and provide the following information for each Azure Databricks Workspace you wish to connect to:

   • Azure Region

   • Azure Databricks hostname

   • Azure Databricks Resource ID or Alias

2. Your representative will inform you when the two Azure Private Link connections have been made available. Accept them in your Azure Databricks workspace configuration.

3. Configure the Databricks integration using your standard azuredatabricks.net URL.

4. Register your tables as Immuta data sources. Note that the privatelink-account-url from the JSON object in step one will be the Server when registering data sources.

This section contains information about private connectivity options for Snowflake integrations.

Overview

Support for AWS PrivateLink is available in most regions across Immuta's Global Segments (NA, EU, and AP); please contact your Immuta account manager if you have questions about availability.

Configuration Guides

This section contains information about private connectivity options for Starburst (Trino) integrations.

Overview

The Immuta SaaS platform supports private connectivity to Starburst (Trino) clusters hosted in both AWS and Azure. This allows customers to meet security and compliance controls by ensuring that traffic to data sources from Immuta SaaS only traverses private networks, never the public internet.

Support for AWS PrivateLink is available in most regions across Immuta's Global Segments (NA, EU, and AP); please contact your Immuta account manager if you have questions about availability.

Support for Azure Private Link is available in all Azure regions.

Configuration Guides

• AWS PrivateLink

• Azure Private Link

Azure Private Link provides private connectivity from the Immuta SaaS platform, hosted on AWS, to customer-managed Snowflake Accounts on Azure. It ensures that all traffic to the configured endpoints only traverses private networks over the Immuta Private Cloud Exchange.

Support for Azure Private Link is available in all Snowflake-supported Azure regions.

Requirements

• You have an Immuta SaaS tenant.

• Your Snowflake account is hosted on Azure.

• Your Snowflake account is on the Business Critical Edition.

• You have ACCOUNTADMIN role on your Snowflake account to configure the Private Link connection.

Configure Snowflake with Azure Private Link

1. In your Snowflake environment, run the following SQL query, which will return a JSON object with the connection information you will need to include in your support ticket:

   Copy

   select SYSTEM$GET_PRIVATELINK_CONFIG()

2. Copy the returned JSON object into a support ticket with Immuta Support to request for the feature to be enabled on your Immuta SaaS tenant.

3. Your Immuta representative will work with you to schedule a time in which to accept the connection in your Snowflake account. They will provide you with a SQL query to run using the ACCOUNTADMIN role. The SQL query will be in this format:

   Copy

   SELECT SYSTEM$AUTHORIZE_PRIVATELINK (
   '/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Network/privateEndpoints/abc12345.east-us-2.azure.snowflakecomputing.com-eus2',
     '<ACCESS_TOKEN>'
   );

   The query should return the following response: Private link access authorized.

4. Configure the Snowflake integration.

5. Register your tables as Immuta data sources. Note that the privatelink-account-url from the JSON object in step one will be the Server when registering data sources.

AWS PrivateLink provides private connectivity from the Immuta SaaS platform to customer-managed Snowflake accounts hosted on AWS. It ensures that all traffic to the configured endpoints only traverses private networks.

This feature is supported in most regions across Immuta's Global Segments (NA, EU, and AP); please contact your Immuta account manager if you have questions about availability.

Requirements

• You have an Immuta SaaS tenant.

• Your Snowflake account is hosted on AWS.

• Your Snowflake account is on the Business Critical Edition.

• You have ACCOUNTADMIN role on your Snowflake account to configure the Private Link connection.

• You have enabled AWS PrivateLink for Snowflake.

Configure Snowflake with AWS PrivateLink

1. In your Snowflake environment, run the following SQL query, which will return a JSON object with the connection information you will need to include in your support ticket:

   Copy

   select SYSTEM$GET_PRIVATELINK_CONFIG()

2. Copy the returned JSON object into a support ticket with Immuta Support to request for the feature to be enabled on your Immuta SaaS tenant.

3. Configure the Snowflake integration.

4. Register your tables as Immuta data sources.

AWS PrivateLink provides private connectivity from the Immuta SaaS platform to customer-managed Starburst (Trino) Clusters hosted on AWS. It ensures that all traffic to the configured endpoints only traverses private networks.

This feature is supported in most regions across Immuta's Global Segments (NA, EU, and AP); please contact your Immuta account manager if you have questions about availability.

Requirements

• You have an Immuta SaaS tenant.

• Your Starburst (Trino) Cluster is hosted on AWS.

• You have set up an AWS PrivateLink Service for your Starburst Cluster endpoints.

  • If you have configured Private DNS Hostnames on your PrivateLink Service, the domain ownership must be verifiable via a public DNS zone. This means that you cannot use a Top-Level Domain (TLD) that is not publicly resolvable, e.g. starburst.mycompany.internal.

  • If you are using TLS, the presented certificate must have the Fully-Qualified Domain Name (FQDN) of your cluster as a Subject Alternative Name (SAN).

  • When creating the service, make sure that the Require Acceptance option is checked (this does not allow anyone to connect; all connections will be blocked until the Immuta Service Principal is added).

  • Only TCP connections over IPv4 are supported.

Configure Starburst (Trino) with AWS PrivateLink

1. Open a support ticket with Immuta Support with the following information:

   • AWS Region

   • AWS Subnet Availability Zones IDs (e.g. use1-az3)

   • VPC Endpoint Service ID

   • DNS Hostname

   • Ports Used

2. Authorize the Service Principal provided by your representative so that Immuta can complete the VPC Endpoint configuration.

3. Configure the Starburst (Trino) integration.

4. Register your tables as Immuta data sources.

Azure Private Link provides private connectivity from the Immuta SaaS platform, hosted on AWS, to customer-managed Starburst (Trino) clusters on Azure. It ensures that all traffic to the configured endpoints only traverses private networks over the Immuta Private Cloud Exchange.

Support for Azure Private Link is available in all Azure regions.

Prerequisites

• You have an Immuta SaaS tenant.

• Your Starburst (Trino) cluster is hosted on Azure.

• You have set up an Azure Private Link Service for your Starburst cluster.

  • The Private Link Service's Access Security should be set to Restricted by Subscription.

Configure Starburst (Trino) with Azure Private Link

1. Open a support ticket with Immuta Support with the following information:

   • Azure Region

   • Azure Private Link Service Resource ID or Alias

   • DNS Hostname

2. Your Immuta representative will provide you with the Immuta Subscription ID that needs to be authorized to consume the service.

3. Once the Immuta Azure Subscription is authorized, please inform your representative so that Immuta can complete Private Link Endpoint configuration.

4. Your representative will inform you when the two Azure Private Link connections have been made available. Accept them in the Private Link Center of your Azure Portal.

5. Configure the Starburst (Trino) integration.

6. Register your tables as Immuta data sources.