Network Connectivity Configuration

View as Markdown

GetGET /api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}CreatePOST /api/2.0/accounts/{account_id}/network-connectivity-configsDeleteDELETE /api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}

Get

GET /api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}

Gets a network connectivity configuration.

API scopes: networking

Parameters

account_idstringpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

network_connectivity_config_idstringpath

Your Network Connectivity Configuration ID.

Response

network_connectivity_config_idstring

<Databricks> network connectivity configuration ID.

Example: d6df3889-eefc-4ddb-bbb4-613efcb30035

account_idstring

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

Example: 449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65

namestring

The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens, and underscores. The length must be between 3 and 30 characters. The name must match the regular expression ^[0-9a-zA-Z-_]{3,30}$

Example: my-example-ncc

regionstring

The region for the network connectivity configuration. Only workspaces in the same region can be attached to the network connectivity configuration.

egress_configobject

The network connectivity rules that apply to network traffic from your serverless compute resources.

Show child attributesHide child attributes

default_rulesobject

The network connectivity rules that are applied by default without resource specific configurations. You can find the stable network information of your serverless compute resources here.

Show child attributesHide child attributes

azure_service_endpoint_ruleobject

Show child attributesHide child attributes

target_regionstring

The Azure region in which this service endpoint rule applies..

Example: westus

target_servicesarray of string

The Azure services to which this service endpoint rule applies to.

Values: EGRESS_RESOURCE_TYPE_UNSPECIFIED, AZURE_BLOB_STORAGE

subnetsarray of string

The list of subnets from which <Databricks> network traffic originates when accessing your Azure resources.

aws_stable_ip_ruleobject

Show child attributesHide child attributes

cidr_blocksarray of string

The list of stable IP CIDR blocks from which <Databricks> network traffic originates when accessing your resources.

Example: 10.0.0.0/24

target_rulesobject

The network connectivity rules that configured for each destinations. These rules override default rules.

Show child attributesHide child attributes

azure_private_endpoint_rulesarray of object

Show child attributesHide child attributes

rule_idstring

The ID of a private endpoint rule.

Example: 728c1541-d6d1-4290-9a53-cdf01dd32d60

network_connectivity_config_idstring

The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.

Example: d6df3889-eefc-4ddb-bbb4-613efcb30035

resource_idstring

The Azure resource ID of the target resource.

group_idstring

Only used by private endpoints to Azure first-party services.

The sub-resource type (group ID) of the target resource. Note that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.

Example: blob

endpoint_namestring

The name of the Azure private endpoint resource.

Example: databricks-088781b3-77fa-4132-b429-1af0d91bc593-pe-3cb31234

connection_statestring

The current status of this private endpoint. The private endpoint rules are effective only if the connection state is ESTABLISHED. Remember that you must approve new endpoints on your resources in the Azure portal before they take effect. The possible values are:

• INIT: (deprecated) The endpoint has been created and pending approval.
• PENDING: The endpoint has been created and pending approval.
• ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
• REJECTED: Connection was rejected by the private link resource owner.
• DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
• EXPIRED: If the endpoint was created but not approved in 14 days, it will be EXPIRED.

Values: PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED, INIT, ESTABLISHED, REJECTED, DISCONNECTED, EXPIRED, PENDING, CREATING, CREATE_FAILED

Example: ESTABLISHED

creation_timeint64

Time in epoch milliseconds when this object was created.

Example: 1691436121706

updated_timeint64

Time in epoch milliseconds when this object was updated.

Example: 1691436121777

deactivatedboolean

Whether this private endpoint is deactivated.

Example: false

deactivated_atint64

Time in epoch milliseconds when this object was deactivated.

Example: 1691436121706

domain_namesarray of string

Not used by customer-managed private endpoint services.

Domain names of target private link service. When updating this field, the full list of target domain_names must be specified.

Example: my-example.exampledomain.com

error_messagestring

aws_private_endpoint_rulesarray of object

AWS private endpoint rule controls the AWS private endpoint based egress rules.

Show child attributesHide child attributes

rule_idstring

The ID of a private endpoint rule.

Example: 728c1541-d6d1-4290-9a53-cdf01dd32d60

network_connectivity_config_idstring

The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.

Example: d6df3889-eefc-4ddb-bbb4-613efcb30035

account_idstring

<Databricks> account ID. You can find your account ID from the Accounts Console.

Example: 449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65

endpoint_servicestring

The full target AWS endpoint service name that connects to the destination resources of the private endpoint.

Example: com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123

domain_namesarray of string

Only used by private endpoints towards a VPC endpoint service for customer-managed VPC endpoint service.

The target AWS resource FQDNs accessible via the VPC endpoint service. When updating this field, we perform full update on this field. Please ensure a full list of desired domain_names is provided.

Example: testing.casg1cikhkce.us-east-1.rds.amazonaws.com

resource_namesarray of string

Only used by private endpoints towards AWS S3 service.

The globally unique S3 bucket names that will be accessed via the VPC endpoint. The bucket names must be in the same region as the NCC/endpoint service. When updating this field, we perform full update on this field. Please ensure a full list of desired resource_names is provided.

Example: mybucket1

vpc_endpoint_idstring

The AWS VPC endpoint ID. You can use this ID to identify VPC endpoint created by <Databricks>.

Example: vpce-02c2bd4e6dcd6c76d

connection_statestring

The current status of this private endpoint. The private endpoint rules are effective only if the connection state is ESTABLISHED. Remember that you must approve new endpoints on your resources in the AWS console before they take effect. The possible values are:

• PENDING: The endpoint has been created and pending approval.
• ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
• REJECTED: Connection was rejected by the private link resource owner.
• DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
• EXPIRED: If the endpoint is created but not approved in 14 days, it is EXPIRED.

Values: PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED, ESTABLISHED, REJECTED, DISCONNECTED, EXPIRED, PENDING, CREATING, CREATE_FAILED

Example: ESTABLISHED

creation_timeint64

Time in epoch milliseconds when this object was created.

Example: 1691436121706

updated_timeint64

Time in epoch milliseconds when this object was updated.

Example: 1691436121777

deactivatedboolean

Whether this private endpoint is deactivated.

Example: false

deactivated_atint64

Time in epoch milliseconds when this object was deactivated.

Example: 1691436121706

enabledboolean

Only used by private endpoints towards an AWS S3 service.

Update this field to activate/deactivate this private endpoint to allow egress access from serverless compute resources.

Example: true

error_messagestring

Example: The provided endpoint service 'com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123' could not be found.

updated_timeint64

Time in epoch milliseconds when this object was updated.

Example: 1691436121777

creation_timeint64

Time in epoch milliseconds when this object was created.

Example: 1691436121706

View as Markdown

Response

{
  "network_connectivity_config_id": "d6df3889-eefc-4ddb-bbb4-613efcb30035",
  "account_id": "449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65",
  "name": "my-example-ncc",
  "region": "string",
  "egress_config": {
    "default_rules": {},
    "target_rules": {}
  },
  "updated_time": 1691436121777,
  "creation_time": 1691436121706
}

Create

POST /api/2.0/accounts/{account_id}/network-connectivity-configs

Creates a network connectivity configuration (NCC), which provides stable Azure service subnets when accessing your Azure Storage accounts. You can also use a network connectivity configuration to create <Databricks> managed private endpoints so that <Databricks> serverless compute resources privately access your resources.

IMPORTANT: After you create the network connectivity configuration, you must assign one or more workspaces to the new network connectivity configuration. You can share one network connectivity configuration with multiple workspaces from the same Azure region within the same <Databricks> account. See configure serverless secure connectivity.

API scopes: networking

AWS

Creates a network connectivity configuration (NCC), which provides stable IP CIDR blocks that are associated with your workspace. You can assign an NCC to one or more workspaces in the same region. Once assigned, the workspace serverless compute resources use the same set of stable IP CIDR blocks to access your resources.

Parameters

account_idstringpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

Request body

network_connectivity_configobject

Show child attributesHide child attributes

network_connectivity_config_idstring

<Databricks> network connectivity configuration ID.

Example: d6df3889-eefc-4ddb-bbb4-613efcb30035

account_idstring

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

Example: 449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65

namestring

The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens, and underscores. The length must be between 3 and 30 characters. The name must match the regular expression ^[0-9a-zA-Z-_]{3,30}$

Example: my-example-ncc

regionstring

The region for the network connectivity configuration. Only workspaces in the same region can be attached to the network connectivity configuration.

egress_configobject

The network connectivity rules that apply to network traffic from your serverless compute resources.

Show child attributesHide child attributes

default_rulesobject

The network connectivity rules that are applied by default without resource specific configurations. You can find the stable network information of your serverless compute resources here.

Show child attributesHide child attributes

azure_service_endpoint_ruleobject

aws_stable_ip_ruleobject

target_rulesobject

The network connectivity rules that configured for each destinations. These rules override default rules.

Show child attributesHide child attributes

azure_private_endpoint_rulesarray of object

aws_private_endpoint_rulesarray of object

AWS private endpoint rule controls the AWS private endpoint based egress rules.

updated_timeint64

Time in epoch milliseconds when this object was updated.

Example: 1691436121777

creation_timeint64

Time in epoch milliseconds when this object was created.

Example: 1691436121706

Response

network_connectivity_config_idstring

<Databricks> network connectivity configuration ID.

Example: d6df3889-eefc-4ddb-bbb4-613efcb30035

account_idstring

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

Example: 449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65

namestring

The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens, and underscores. The length must be between 3 and 30 characters. The name must match the regular expression ^[0-9a-zA-Z-_]{3,30}$

Example: my-example-ncc

regionstring

The region for the network connectivity configuration. Only workspaces in the same region can be attached to the network connectivity configuration.

egress_configobject

The network connectivity rules that apply to network traffic from your serverless compute resources.

Show child attributesHide child attributes

default_rulesobject

The network connectivity rules that are applied by default without resource specific configurations. You can find the stable network information of your serverless compute resources here.

Show child attributesHide child attributes

azure_service_endpoint_ruleobject

Show child attributesHide child attributes

target_regionstring

The Azure region in which this service endpoint rule applies..

Example: westus

target_servicesarray of string

The Azure services to which this service endpoint rule applies to.

Values: EGRESS_RESOURCE_TYPE_UNSPECIFIED, AZURE_BLOB_STORAGE

subnetsarray of string

The list of subnets from which <Databricks> network traffic originates when accessing your Azure resources.

aws_stable_ip_ruleobject

Show child attributesHide child attributes

cidr_blocksarray of string

The list of stable IP CIDR blocks from which <Databricks> network traffic originates when accessing your resources.

Example: 10.0.0.0/24

target_rulesobject

The network connectivity rules that configured for each destinations. These rules override default rules.

Show child attributesHide child attributes

azure_private_endpoint_rulesarray of object

Show child attributesHide child attributes

rule_idstring

The ID of a private endpoint rule.

Example: 728c1541-d6d1-4290-9a53-cdf01dd32d60

network_connectivity_config_idstring

The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.

Example: d6df3889-eefc-4ddb-bbb4-613efcb30035

resource_idstring

The Azure resource ID of the target resource.

group_idstring

Only used by private endpoints to Azure first-party services.

The sub-resource type (group ID) of the target resource. Note that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.

Example: blob

endpoint_namestring

The name of the Azure private endpoint resource.

Example: databricks-088781b3-77fa-4132-b429-1af0d91bc593-pe-3cb31234

connection_statestring

The current status of this private endpoint. The private endpoint rules are effective only if the connection state is ESTABLISHED. Remember that you must approve new endpoints on your resources in the Azure portal before they take effect. The possible values are:

• INIT: (deprecated) The endpoint has been created and pending approval.
• PENDING: The endpoint has been created and pending approval.
• ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
• REJECTED: Connection was rejected by the private link resource owner.
• DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
• EXPIRED: If the endpoint was created but not approved in 14 days, it will be EXPIRED.

Values: PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED, INIT, ESTABLISHED, REJECTED, DISCONNECTED, EXPIRED, PENDING, CREATING, CREATE_FAILED

Example: ESTABLISHED

creation_timeint64

Time in epoch milliseconds when this object was created.

Example: 1691436121706

updated_timeint64

Time in epoch milliseconds when this object was updated.

Example: 1691436121777

deactivatedboolean

Whether this private endpoint is deactivated.

Example: false

deactivated_atint64

Time in epoch milliseconds when this object was deactivated.

Example: 1691436121706

domain_namesarray of string

Not used by customer-managed private endpoint services.

Domain names of target private link service. When updating this field, the full list of target domain_names must be specified.

Example: my-example.exampledomain.com

error_messagestring

aws_private_endpoint_rulesarray of object

AWS private endpoint rule controls the AWS private endpoint based egress rules.

Show child attributesHide child attributes

rule_idstring

The ID of a private endpoint rule.

Example: 728c1541-d6d1-4290-9a53-cdf01dd32d60

network_connectivity_config_idstring

The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.

Example: d6df3889-eefc-4ddb-bbb4-613efcb30035

account_idstring

<Databricks> account ID. You can find your account ID from the Accounts Console.

Example: 449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65

endpoint_servicestring

The full target AWS endpoint service name that connects to the destination resources of the private endpoint.

Example: com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123

domain_namesarray of string

Only used by private endpoints towards a VPC endpoint service for customer-managed VPC endpoint service.

The target AWS resource FQDNs accessible via the VPC endpoint service. When updating this field, we perform full update on this field. Please ensure a full list of desired domain_names is provided.

Example: testing.casg1cikhkce.us-east-1.rds.amazonaws.com

resource_namesarray of string

Only used by private endpoints towards AWS S3 service.

The globally unique S3 bucket names that will be accessed via the VPC endpoint. The bucket names must be in the same region as the NCC/endpoint service. When updating this field, we perform full update on this field. Please ensure a full list of desired resource_names is provided.

Example: mybucket1

vpc_endpoint_idstring

The AWS VPC endpoint ID. You can use this ID to identify VPC endpoint created by <Databricks>.

Example: vpce-02c2bd4e6dcd6c76d

connection_statestring

The current status of this private endpoint. The private endpoint rules are effective only if the connection state is ESTABLISHED. Remember that you must approve new endpoints on your resources in the AWS console before they take effect. The possible values are:

• PENDING: The endpoint has been created and pending approval.
• ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
• REJECTED: Connection was rejected by the private link resource owner.
• DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
• EXPIRED: If the endpoint is created but not approved in 14 days, it is EXPIRED.

Values: PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED, ESTABLISHED, REJECTED, DISCONNECTED, EXPIRED, PENDING, CREATING, CREATE_FAILED

Example: ESTABLISHED

creation_timeint64

Time in epoch milliseconds when this object was created.

Example: 1691436121706

updated_timeint64

Time in epoch milliseconds when this object was updated.

Example: 1691436121777

deactivatedboolean

Whether this private endpoint is deactivated.

Example: false

deactivated_atint64

Time in epoch milliseconds when this object was deactivated.

Example: 1691436121706

enabledboolean

Only used by private endpoints towards an AWS S3 service.

Update this field to activate/deactivate this private endpoint to allow egress access from serverless compute resources.

Example: true

error_messagestring

Example: The provided endpoint service 'com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123' could not be found.

updated_timeint64

Time in epoch milliseconds when this object was updated.

Example: 1691436121777

creation_timeint64

Time in epoch milliseconds when this object was created.

Example: 1691436121706

View as Markdown

Request

{
  "network_connectivity_config": {
    "network_connectivity_config_id": "d6df3889-eefc-4ddb-bbb4-613efcb30035",
    "account_id": "449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65",
    "name": "my-example-ncc",
    "region": "string",
    "egress_config": {},
    "updated_time": 1691436121777,
    "creation_time": 1691436121706
  }
}

Response

{
  "network_connectivity_config_id": "d6df3889-eefc-4ddb-bbb4-613efcb30035",
  "account_id": "449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65",
  "name": "my-example-ncc",
  "region": "string",
  "egress_config": {
    "default_rules": {},
    "target_rules": {}
  },
  "updated_time": 1691436121777,
  "creation_time": 1691436121706
}

Delete

DELETE /api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}

Deletes a network connectivity configuration.

API scopes: networking

Parameters

account_idstringpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

network_connectivity_config_idstringpath

Your Network Connectivity Configuration ID.

View as Markdown

Response

{}