Skip to main content
Last updated on

Manage account context-based ingress policies

Beta

Context-based ingress policies for your account are in Beta. Denials for account-level policies are not logged. Enable Front-end Private Link for Custom URLs and Account to get started.

The account-level context-based ingress policy controls access to account-level resources, such as the account console, account-level Genie One, and account APIs. This page shows account admins how to configure its public and private access rules.

For an overview of context-based ingress control, including enforcement modes, auditing, how ingress interacts with other network controls, and the API and Terraform options, see Context-based ingress control. To manage workspace-level policies, see Manage workspace context-based ingress policies.

Requirements​

  • You must be an account admin.
  • Your Databricks account must be on the Enterprise tier.

Access the account-level policy​

The account-level policy has the fixed policy ID account-policy. It cannot be renamed or deleted, and it is attached to your account-level resources by default and cannot be detached. There is one policy shared across all account-level resources. To apply different rules to different account-level resources, add multiple allow rules with different destinations.

To open the account-level policy:

  1. From the account console, click Security.
  2. Click the Networking tab.
  3. Under Policies, click Context-based ingress & egress control.
  4. Under Account level policy, click account-policy.

Configure ingress rules​

The account-level policy denies access by default in restricted access mode and grants access only when a request matches an explicit Allow rule. Deny rules are exceptions to allow rules. If a request matches both an allow rule and a deny rule, the request is denied.

To configure an allow or deny rule:

  1. Click Add rule above the Allow rules or Deny rules lists.
  2. Select an access type:
    • Account UI: Allow access to account-level UI, such as the account console and account-level Genie One.
    • Account API: Allow or deny access to Databricks account APIs.
  3. For identity, the account-level policy supports only All users and service principals.
  4. Select a network source, described in the following sections.
  5. Click Save.

Public network access​

For public network access, select one of the following network sources:

  • All public IPs: Allow access from all public IPs.
  • Selected IPs: Allow access from only specific IPs. Enter the IPs separated by commas.

For Deny rules with selected IPs, choose IN to deny IPs in the specified source, or NOT IN to deny IPs that are not in it.

Private network access​

For the account-level policy, context-based ingress is the single source of truth for private access. By default, no registered endpoints are allowed.

  • To allowlist all registered endpoints, check Allow access from all private endpoints. By default, this option includes only the first 200 registered private endpoints. If your policy requires more, contact your account team for an increase.
  • To allowlist specific registered endpoints while denying all others, add an allow rule, select Source type = Selected private endpoints, and select the general access endpoints you registered. A general access endpoint in any region can serve any account-level resource. You can add Deny rules as exceptions.

To set up inbound Private Link to account-level resources end to end, see Configure inbound Private Link for account-level resources.

Set the enforcement mode​

Test your policy in dry run mode before enforcing it. In dry run mode, requests that violate the policy are logged but not blocked. For details, see Enforcement modes.

  1. Set the policy enforcement mode to Enforced for all products or Dry run mode for all products.
  2. Click Save. Context-based ingress policy updates typically take 10 to 15 minutes to take effect.

Configure using the API or Terraform​

In addition to the account console, you can configure context-based ingress policies using the Databricks REST API or Terraform. See API and Terraform.

Check denial logs​

Beta limitation

Account-level policy denials are not logged.

For workspace-level policies, denial and dry-run events are logged in the system.access.inbound_network system table. See Auditing and Check denial logs.

Limitations​

  • Account-level context-based ingress policies are in Beta.
  • Account-level policy denials are not logged.
  • The account-level policy supports only the All users and service principals identity type.

Additional resources​

On this page