Skip to main content

Ncc Private Endpoint Rule

View as Markdown

NccPrivateEndpointRule object

Properties of the new private endpoint rule. Note that you must approve the endpoint in Azure portal after initialization.

rule_idstring

The ID of a private endpoint rule.

Example: 728c1541-d6d1-4290-9a53-cdf01dd32d60

network_connectivity_config_idstring

The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.

Example: d6df3889-eefc-4ddb-bbb4-613efcb30035

connection_statestring

The current status of this private endpoint. The private endpoint rules are effective only if the connection state is ESTABLISHED. Remember that you must approve new endpoints on your resources in the Cloud console before they take effect. The possible values are:

  • PENDING: The endpoint has been created and pending approval.
  • ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
  • REJECTED: Connection was rejected by the private link resource owner.
  • DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
  • EXPIRED: If the endpoint was created but not approved in 14 days, it will be EXPIRED.
  • CREATING: The endpoint creation is in progress. Once successfully created, the state will transition to PENDING.
  • CREATE_FAILED: The endpoint creation failed. You can check the error_message field for more details.

Values: PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED, ESTABLISHED, REJECTED, DISCONNECTED, EXPIRED, PENDING, CREATING, CREATE_FAILED

Example: ESTABLISHED

domain_namesarray of string

Only used by private endpoints to customer-managed private endpoint services.

Domain names of target private link service. When updating this field, the full list of target domain_names must be specified.

AWS

Only used by private endpoints towards a VPC endpoint service behind a customer-managed VPC endpoint service.

The target AWS resource FQDNs accessible via the VPC endpoint service. When updating this field, we perform full update on this field. Please ensure a full list of desired domain_names is provided.

Example: my-example.exampledomain.com

creation_timeint64

Time in epoch milliseconds when this object was created.

Example: 1691436121706

updated_timeint64

Time in epoch milliseconds when this object was updated.

Example: 1691436121777

deactivatedboolean

Whether this private endpoint is deactivated.

Example: false

deactivated_atint64

Time in epoch milliseconds when this object was deactivated.

Example: 1691436121706

error_messagestring

Example: NOT_FOUND: The provided resource <input-resource> could not be found.

resource_idstring

The Azure resource ID of the target resource.

group_idstring

Not used by customer-managed private endpoint services.

The sub-resource type (group ID) of the target resource. Note that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.

Example: blob

endpoint_namestring

The name of the Azure private endpoint resource.

Example: databricks-088781b3-77fa-4132-b429-1af0d91bc593-pe-3cb31234

account_idstring

<Databricks> account ID. You can find your account ID from the Accounts Console.

Example: 449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65

endpoint_servicestring

The full target AWS endpoint service name that connects to the destination resources of the private endpoint.

Example: com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123

resource_namesarray of string

Only used by private endpoints towards AWS S3 service.

The globally unique S3 bucket names that will be accessed via the VPC endpoint. The bucket names must be in the same region as the NCC/endpoint service. When updating this field, we perform full update on this field. Please ensure a full list of desired resource_names is provided.

Example: mybucket1

vpc_endpoint_idstring

The AWS VPC endpoint ID. You can use this ID to identify the VPC endpoint created by <Databricks>.

Example: vpce-02c2bd4e6dcd6c76d

enabledboolean

Update this field to activate/deactivate this private endpoint to allow egress access from serverless compute resources. Only honored for first-party services on each cloud (e.g. AWS S3).

Example: true

gcp_endpointobject
Show child attributesHide child attributes
psc_endpoint_uristring

Output only. The URI of the created PSC endpoint.

Example: projects/databricks-egress/regions/us-east4/forwardingRules/1234567890

service_attachmentstring

The full url of the target service attachment. Example: projects/my-gcp-project/regions/us-east4/serviceAttachments/my-service-attachment

Example: projects/my-gcp-project/regions/us-east4/serviceAttachments/my-service-attachment

Get

GET /api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}/private-endpoint-rules/{private_endpoint_rule_id}

Gets the private endpoint rule.

API scopes: networking

Parameters

account_idstringpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

network_connectivity_config_idstringpath

Your Network Connectvity Configuration ID.

private_endpoint_rule_idstringpath

Your private endpoint rule ID.

Response

Returns the NccPrivateEndpointRule object.

Create

POST /api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}/private-endpoint-rules

Create a private endpoint rule for the specified network connectivity config object. Once the object is created, <Databricks> asynchronously provisions a new Azure private endpoint to your specified Azure resource.

IMPORTANT: You must use Azure portal or other Azure tools to approve the private endpoint to complete the connection. To get the information of the private endpoint created, make a GET request on the new private endpoint rule. See serverless private link.

API scopes: networking

AWS

Create a private endpoint rule for the specified network connectivity config object. Once the object is created, <Databricks> asynchronously provisions a new AWS private endpoint to your specified AWS resource.

IMPORTANT: For private connection towards a VPC endpoint service behind a customer-managed VPC endpoint service, you must use AWS console or other AWS tools to approve the private endpoint to complete the connection. To get the information of the private endpoint created, make a GET request on the new private endpoint rule.

GCP

Create a private endpoint rule for the specified network connectivity config object. Once the object is created, <Databricks> asynchronously provisions a new GCP private endpoint to your specified GCP resource. To get the information of the private endpoint created, make a GET request on the new private endpoint rule.

Parameters

network_connectivity_config_idstringpath

Your Network Connectivity Configuration ID.

account_idstringpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

Request body

private_endpoint_ruleobject
Show child attributesHide child attributes
rule_idstring

The ID of a private endpoint rule.

Example: 728c1541-d6d1-4290-9a53-cdf01dd32d60

network_connectivity_config_idstring

The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.

Example: d6df3889-eefc-4ddb-bbb4-613efcb30035

connection_statestring

The current status of this private endpoint. The private endpoint rules are effective only if the connection state is ESTABLISHED. Remember that you must approve new endpoints on your resources in the Cloud console before they take effect. The possible values are:

  • PENDING: The endpoint has been created and pending approval.
  • ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
  • REJECTED: Connection was rejected by the private link resource owner.
  • DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
  • EXPIRED: If the endpoint was created but not approved in 14 days, it will be EXPIRED.
  • CREATING: The endpoint creation is in progress. Once successfully created, the state will transition to PENDING.
  • CREATE_FAILED: The endpoint creation failed. You can check the error_message field for more details.

Values: PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED, ESTABLISHED, REJECTED, DISCONNECTED, EXPIRED, PENDING, CREATING, CREATE_FAILED

Example: ESTABLISHED

domain_namesarray of string

Only used by private endpoints to customer-managed private endpoint services.

Domain names of target private link service. When updating this field, the full list of target domain_names must be specified.

AWS

Only used by private endpoints towards a VPC endpoint service behind a customer-managed VPC endpoint service.

The target AWS resource FQDNs accessible via the VPC endpoint service. When updating this field, we perform full update on this field. Please ensure a full list of desired domain_names is provided.

Example: my-example.exampledomain.com

creation_timeint64

Time in epoch milliseconds when this object was created.

Example: 1691436121706

updated_timeint64

Time in epoch milliseconds when this object was updated.

Example: 1691436121777

deactivatedboolean

Whether this private endpoint is deactivated.

Example: false

deactivated_atint64

Time in epoch milliseconds when this object was deactivated.

Example: 1691436121706

error_messagestring

Example: NOT_FOUND: The provided resource <input-resource> could not be found.

resource_idstring

The Azure resource ID of the target resource.

group_idstring

Not used by customer-managed private endpoint services.

The sub-resource type (group ID) of the target resource. Note that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.

Example: blob

endpoint_namestring

The name of the Azure private endpoint resource.

Example: databricks-088781b3-77fa-4132-b429-1af0d91bc593-pe-3cb31234

account_idstring

<Databricks> account ID. You can find your account ID from the Accounts Console.

Example: 449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65

endpoint_servicestring

The full target AWS endpoint service name that connects to the destination resources of the private endpoint.

Example: com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123

resource_namesarray of string

Only used by private endpoints towards AWS S3 service.

The globally unique S3 bucket names that will be accessed via the VPC endpoint. The bucket names must be in the same region as the NCC/endpoint service. When updating this field, we perform full update on this field. Please ensure a full list of desired resource_names is provided.

Example: mybucket1

vpc_endpoint_idstring

The AWS VPC endpoint ID. You can use this ID to identify the VPC endpoint created by <Databricks>.

Example: vpce-02c2bd4e6dcd6c76d

enabledboolean

Update this field to activate/deactivate this private endpoint to allow egress access from serverless compute resources. Only honored for first-party services on each cloud (e.g. AWS S3).

Example: true

gcp_endpointobjectRequired
Show child attributesHide child attributes
psc_endpoint_uristring

Output only. The URI of the created PSC endpoint.

Example: projects/databricks-egress/regions/us-east4/forwardingRules/1234567890

service_attachmentstringRequired

The full url of the target service attachment. Example: projects/my-gcp-project/regions/us-east4/serviceAttachments/my-service-attachment

Example: projects/my-gcp-project/regions/us-east4/serviceAttachments/my-service-attachment

Response

Returns the NccPrivateEndpointRule object.

Update

PATCH /api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}/private-endpoint-rules/{private_endpoint_rule_id}

Updates a private endpoint rule. Currently only a private endpoint rule to customer-managed resources is allowed to be updated.

API scopes: networking

AWS

Updates a private endpoint rule.

Parameters

network_connectivity_config_idstringpath

The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.

account_idstringpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

private_endpoint_rule_idstringpath

Your private endpoint rule ID.

update_maskstringquery

Example: domain_names

Request body

private_endpoint_ruleobject
Show child attributesHide child attributes
rule_idstring

The ID of a private endpoint rule.

Example: 728c1541-d6d1-4290-9a53-cdf01dd32d60

network_connectivity_config_idstring

The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.

Example: d6df3889-eefc-4ddb-bbb4-613efcb30035

connection_statestring

The current status of this private endpoint. The private endpoint rules are effective only if the connection state is ESTABLISHED. Remember that you must approve new endpoints on your resources in the Cloud console before they take effect. The possible values are:

  • PENDING: The endpoint has been created and pending approval.
  • ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
  • REJECTED: Connection was rejected by the private link resource owner.
  • DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
  • EXPIRED: If the endpoint was created but not approved in 14 days, it will be EXPIRED.
  • CREATING: The endpoint creation is in progress. Once successfully created, the state will transition to PENDING.
  • CREATE_FAILED: The endpoint creation failed. You can check the error_message field for more details.

Values: PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED, ESTABLISHED, REJECTED, DISCONNECTED, EXPIRED, PENDING, CREATING, CREATE_FAILED

Example: ESTABLISHED

domain_namesarray of string

Only used by private endpoints to customer-managed private endpoint services.

Domain names of target private link service. When updating this field, the full list of target domain_names must be specified.

AWS

Only used by private endpoints towards a VPC endpoint service behind a customer-managed VPC endpoint service.

The target AWS resource FQDNs accessible via the VPC endpoint service. When updating this field, we perform full update on this field. Please ensure a full list of desired domain_names is provided.

Example: my-example.exampledomain.com

creation_timeint64

Time in epoch milliseconds when this object was created.

Example: 1691436121706

updated_timeint64

Time in epoch milliseconds when this object was updated.

Example: 1691436121777

deactivatedboolean

Whether this private endpoint is deactivated.

Example: false

deactivated_atint64

Time in epoch milliseconds when this object was deactivated.

Example: 1691436121706

error_messagestring

Example: NOT_FOUND: The provided resource <input-resource> could not be found.

resource_idstring

The Azure resource ID of the target resource.

group_idstring

Not used by customer-managed private endpoint services.

The sub-resource type (group ID) of the target resource. Note that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.

Example: blob

endpoint_namestring

The name of the Azure private endpoint resource.

Example: databricks-088781b3-77fa-4132-b429-1af0d91bc593-pe-3cb31234

account_idstring

<Databricks> account ID. You can find your account ID from the Accounts Console.

Example: 449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65

endpoint_servicestring

The full target AWS endpoint service name that connects to the destination resources of the private endpoint.

Example: com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123

resource_namesarray of string

Only used by private endpoints towards AWS S3 service.

The globally unique S3 bucket names that will be accessed via the VPC endpoint. The bucket names must be in the same region as the NCC/endpoint service. When updating this field, we perform full update on this field. Please ensure a full list of desired resource_names is provided.

Example: mybucket1

vpc_endpoint_idstring

The AWS VPC endpoint ID. You can use this ID to identify the VPC endpoint created by <Databricks>.

Example: vpce-02c2bd4e6dcd6c76d

enabledboolean

Update this field to activate/deactivate this private endpoint to allow egress access from serverless compute resources. Only honored for first-party services on each cloud (e.g. AWS S3).

Example: true

gcp_endpointobjectRequired
Show child attributesHide child attributes
psc_endpoint_uristring

Output only. The URI of the created PSC endpoint.

Example: projects/databricks-egress/regions/us-east4/forwardingRules/1234567890

service_attachmentstringRequired

The full url of the target service attachment. Example: projects/my-gcp-project/regions/us-east4/serviceAttachments/my-service-attachment

Example: projects/my-gcp-project/regions/us-east4/serviceAttachments/my-service-attachment

Response

Returns the NccPrivateEndpointRule object.

Delete

DELETE /api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}/private-endpoint-rules/{private_endpoint_rule_id}

Initiates deleting a private endpoint rule. If the connection state is PENDING or EXPIRED, the private endpoint is immediately deleted. Otherwise, the private endpoint is deactivated and will be deleted after one day of deactivation. When a private endpoint is deactivated, the deactivated field is set to true and the private endpoint is not available to your serverless compute resources.

API scopes: networking

AWS

Initiates deleting a private endpoint rule. The private endpoint is deactivated and will be deleted after one day of deactivation. When a private endpoint is deactivated, the deactivated field is set to true and the private endpoint will not be applied to your serverless compute resources.

GCP

Initiates deleting a private endpoint rule.

Parameters

account_idstringpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

network_connectivity_config_idstringpath

Your Network Connectvity Configuration ID.

private_endpoint_rule_idstringpath

Your private endpoint rule ID.

Response

Returns the NccPrivateEndpointRule object.