Skip to main content
Last updated on

Configure DNS for AWS PrivateLink

Configure DNS to route user requests through your private network when using front-end PrivateLink for Databricks workspaces. This article covers DNS configuration patterns and step-by-step setup instructions.

You can configure DNS for AWS PrivateLink in multiple ways. This page defaults to a recommended approach that works for most deployments.

note

Back-end PrivateLink endpoints automatically use AWS DNS resolution when you enable the Enable DNS name option on the VPC endpoint. This page focuses on front-end PrivateLink DNS configuration.

Architecture overview​

The following diagrams illustrate the two DNS resolution patterns for AWS PrivateLink. The pattern you choose depends on your organizational requirements for endpoint management and isolation.

Single endpoint DNS resolution architecture

The single endpoint approach routes all workspaces in a region through one shared VPC endpoint, simplifying DNS configuration and management. This page defaults to this recommended approach for all configuration instructions.

Multiple endpoint DNS resolution architecture

The multi-endpoint approach provides dedicated VPC endpoints for each workspace, enabling workspace-level network isolation at the cost of increased complexity.

Without PrivateLink, workspace URLs resolve to public IP addresses through a regional hostname like sydney.cloud.databricks.com, which points to a public AWS Elastic Load Balancer. For example:

Bash
$ nslookup myworkspace.cloud.databricks.com

myworkspace.cloud.databricks.com    canonical name = sydney.cloud.databricks.com
sydney.cloud.databricks.com         canonical name = public-ingress-xxxxx.elb.ap-southeast-2.amazonaws.com
Name:    public-ingress-xxxxx.elb.ap-southeast-2.amazonaws.com
Address: 3.26.4.13

After you attach a private access settings object to a workspace, Databricks updates the DNS resolution chain to include the privatelink subdomain:

Bash
$ nslookup myworkspace.cloud.databricks.com

myworkspace.cloud.databricks.com    canonical name = sydney.privatelink.cloud.databricks.com
Name:    sydney.privatelink.cloud.databricks.com
Address: 10.176.10.182

The workspace URL now resolves to sydney.privatelink.cloud.databricks.com, which you configure to point to your VPC endpoint's private IP address. This allows you to override only the privatelink.cloud.databricks.com domain without affecting other Databricks services.

important

After you attach a private access settings object to a workspace, you cannot remove it. You can only replace it with a different private access settings object. This configuration is permanent.

DNS resolution​

The specific DNS records you need depend on your configuration approach, but all configurations resolve workspace URLs to the private IP address of your front-end VPC endpoint.

For most deployments, configure DNS to resolve the regional endpoint to your VPC endpoint's private IP. All workspaces in a region share the same VPC endpoint.

On-premises DNS configuration​

Configure conditional forwarding in your corporate DNS to forward Databricks domain queries to AWS:

Domain

Forwarding target

*.cloud.databricks.com

AWS DNS endpoint (Route 53 inbound resolver)

*.aws.databricksapps.com

AWS DNS endpoint (Route 53 inbound resolver)

Private Hosted Zone configuration​

Create a Private Hosted Zone for the privatelink.cloud.databricks.com domain:

Configuration

Value

Private Hosted Zone

privatelink.cloud.databricks.com

Record name

<region>

Record type

A (Alias)

Record value

VPC endpoint ID

The region value is the Databricks region name, for example, sydney, virginia, oregon, not the AWS region name. To find the correct region name for your workspace, see the Control plane services, including webapp row in Inbound IPs to Databricks control plane.

note

All workspaces in the same region that use front-end PrivateLink can share the same VPC endpoint and resolve to the same regional endpoint. This is the recommended approach for simplified management.

Configuration options​

Configure your corporate DNS to forward queries for Databricks domains to AWS Route 53. AWS automatically resolves workspace URLs to private IPs without manual record management.

Benefits of conditional forwarding​

  • Automatic resolution: Route 53 automatically resolves workspace URLs to private IPs when the VPC endpoint has the Enable DNS name option enabled.
  • No manual updates: If VPC endpoint IPs change, Route 53 automatically updates DNS records.
  • Simplifies management: A single configuration handles all workspaces in a region.

Prerequisites​

Before you begin, verify that you have:

  • A front-end PrivateLink VPC endpoint with Enable DNS name enabled
  • Network connectivity between your corporate network and AWS using Direct Connect or VPN
  • Permissions to create Route 53 resources and modify your corporate DNS

Step 1: Create a Private Hosted Zone​

Create a Private Hosted Zone in Route 53 for Databricks workspace DNS records.

  1. Go to the Route 53 Hosted zones page in the AWS Management Console.
  2. Click Create hosted zone.
  3. For Domain name, enter privatelink.cloud.databricks.com.
  4. For Type, select Private hosted zone.
  5. In the VPCs to associate section, select the VPC where your front-end VPC endpoint is located. This is typically your transit VPC.
  6. Click Create hosted zone.

Step 2: Create a DNS A record​

Create an A record that maps the regional endpoint to your VPC endpoint's private IP address.

  1. In the Route 53 console, select the privatelink.cloud.databricks.com hosted zone you created.

  2. Click Create record.

  3. For Record name, enter your Databricks region name (for example, sydney, virginia, oregon).

  4. For Record type, select A - Routes traffic to an IPv4 address.

  5. For Value, enter the private IP address of your front-end VPC endpoint.

    To find the private IP:

    1. Go to the VPC endpoints page.
    2. Select your front-end VPC endpoint.
    3. In the Subnets tab, note the IPv4 address.

  6. Click Create records.

Step 3: Create a Route 53 inbound resolver endpoint​

Create an inbound resolver endpoint so your corporate DNS can forward queries to Route 53.

  1. Go to the Route 53 Resolver page.
  2. In the left navigation, click Inbound endpoints.
  3. Click Create inbound endpoint.
  4. Provide a name for the endpoint, such as databricks-privatelink-resolver.
  5. Select your VPC.
  6. For Security group, select or create a security group that allows inbound TCP and UDP traffic on port 53 from your on-premises network.
  7. In the IP addresses section:
    • Select at least two subnets in different Availability Zones for high availability.
    • For each subnet, either let AWS automatically assign an IP address or choose a specific IP address within the subnet range.
  8. Click Create inbound endpoint.
  9. Note the IP addresses of the inbound resolver endpoint for use in the next step.

Step 4: Configure conditional forwarding in your corporate DNS​

Configure your corporate DNS server to forward queries for Databricks domains to the Route 53 inbound resolver endpoint.

The exact steps depend on your DNS software, such as BIND, Windows DNS, or Infoblox. See your DNS server documentation for specific configuration steps.

Configure conditional forwarding for the following domains:

  • *.cloud.databricks.com - Required for workspace URL resolution
  • *.aws.databricksapps.com - Required if you use Databricks Apps

Forward these domains to the IP addresses of your Route 53 inbound resolver endpoint.

Verification​

After you complete the configuration, test DNS resolution from your corporate network:

Bash
$ nslookup myworkspace.cloud.databricks.com

myworkspace.cloud.databricks.com    canonical name = sydney.privatelink.cloud.databricks.com
Name:    sydney.privatelink.cloud.databricks.com
Address: 10.176.10.182

The workspace URL should resolve to the private IP address of your VPC endpoint. If you see a public IP address, verify your conditional forwarding rules and Route 53 configuration.

Special deployment scenarios​

You can have some workspaces using front-end PrivateLink and others using public endpoints in the same account. DNS resolution automatically handles this scenario.

Workspaces without a private access settings object resolve to public IP addresses using <region>.cloud.databricks.com. Workspaces with a private access settings object resolve to <region>.privatelink.cloud.databricks.com and use the private IP.

No additional DNS configuration is required for mixed deployments.

Verification​

After configuring DNS, verify that workspace URLs resolve correctly to private IP addresses.

From a machine on your corporate network, test workspace DNS resolution:

Bash
$ nslookup myworkspace.cloud.databricks.com

Expected output:

myworkspace.cloud.databricks.com    canonical name = sydney.privatelink.cloud.databricks.com
Name:    sydney.privatelink.cloud.databricks.com
Address: 10.176.10.182

The workspace URL should resolve through the privatelink subdomain to a private IP address, typically in the 10.x.x.x, 172.16.x.x, or 192.168.x.x range.

Common issues​

DNS resolution returns public IPs: Your conditional forwarding rules aren't working correctly, or queries aren't reaching Route 53. Verify your DNS server configuration and Route 53 inbound resolver endpoint.

Workspace URL doesn't resolve: Your Private Hosted Zone may not have the correct A record, or the hosted zone isn't associated with the right VPC. Verify your Route 53 configuration.

Can't access workspace after DNS resolves: Check network connectivity and security group rules. Verify that your corporate network can reach the VPC endpoint's private IP on port 443.

What's next​