Serverless on-premises connectivity

This page introduces the options for connecting Databricks serverless compute to resources in your on-premises network, such as databases, API servers, and message brokers. Use these options to connect serverless workloads, including Databricks Apps, custom agents, jobs, and Genie, to data wherever it lives.

Classic compute runs in your own VPC, so it often reaches on-premises networks through connectivity you already have in place. Serverless compute runs in the Databricks-managed serverless compute plane, so it needs a separate network path to reach on-premises resources.

Why connect to on-premises data instead of moving it

You might need to access data from serverless compute where it lives, instead of moving it into your lakehouse, for the following reasons:

• Data sovereignty and compliance: Regulatory jurisdictions, local privacy laws, and industry mandates can require data to physically remain within specific boundaries or on local infrastructure.
• Data at rest and custody: Your organization might require sensitive customer records, intellectual property, or core datastores to remain at rest on-premises under direct organizational custody.
• No reason to migrate: If a legacy database or core service runs reliably on-premises, there might be no reason to migrate it.
• Technical and latency constraints: Tight application dependencies, sub-millisecond local network requirements, and WAN bandwidth limits can make cloud migration impractical.

Use cases

Common reasons to connect serverless compute to on-premises resources include:

• Connect to databases hosted on VMs.
• Get data from or post data to an on-premises API server.
• Query an on-premises Oracle database.
• Connect to an on-premises Kafka cluster.
• Consume data through OpenSharing.
• Route all serverless traffic through a central firewall.

Prerequisites

Before you connect serverless compute to on-premises resources, you must have the following:

• A network path between your cloud environment and your on-premises network, such as AWS Direct Connect or a site-to-site VPN.
• Domain Name System (DNS), routing, and firewalls configured so that serverless traffic can reach your target resources.

The following table compares the two types of network paths:

Network path	Setup time	Characteristics
Dedicated connection (AWS Direct Connect)	Weeks to months	More complex to set up. Offers better network performance, stability, and reliability.
Site-to-site VPN	Days to weeks	Easier and faster to set up. Provides lower bandwidth and higher latency than a dedicated connection.

Network path	Setup time	Characteristics
Dedicated connection (AWS Direct Connect)	Weeks to months	More complex to set up. Offers better network performance, stability, and reliability.
Site-to-site VPN	Days to weeks	Easier and faster to set up. Provides lower bandwidth and higher latency than a dedicated connection.

Connectivity options

The following table summarizes the network connectivity options for connecting serverless compute to on-premises resources, followed by the data access options that work with on-premises sources. To choose a network connectivity option, see Choose a serverless connectivity option.

Option	Description	Use when
Private Link service	A private endpoint connection to a load balancer in your VPC that routes traffic to on-premises resources.	Your on-premises resources allow inbound access from the cloud.
SSH reverse tunnel	An on-premises host opens an outbound SSH connection to proxy VMs in your cloud environment.	Your firewall blocks inbound traffic from the cloud.
Outbound IP addresses	Published public IP ranges that serverless compute uses, which you allowlist on your firewall.	Your target resource has a public endpoint and public access is acceptable.
Lakehouse Federation	Runs governed, read-only federated queries against on-premises databases through Unity Catalog foreign catalogs. Requires one of the network connectivity options in this table.	You want to query on-premises data in place, such as for ad hoc reporting, exploration, or an incremental migration.
Lakeflow Connect	Ingests data from on-premises SQL Server and Oracle databases into Databricks using an integrated change data capture (CDC) pipeline or an on-premises agent.	You want managed ingestion, or performance on high data volumes and low latency are priorities.
OpenSharing	Provides governed, zero-copy access to on-premises data in object storage. Doesn't require a dedicated connection or site-to-site VPN.	You want to limit data duplication and query the freshest possible data.

Option	Description	Use when
Private Link service	A private endpoint connection to a load balancer in your VPC that routes traffic to on-premises resources.	Your on-premises resources allow inbound access from the cloud.
SSH reverse tunnel	An on-premises host opens an outbound SSH connection to proxy VMs in your cloud environment.	Your firewall blocks inbound traffic from the cloud.
Outbound IP addresses	Published public IP ranges that serverless compute uses, which you allowlist on your firewall.	Your target resource has a public endpoint and public access is acceptable.
Lakehouse Federation	Runs governed, read-only federated queries against on-premises databases through Unity Catalog foreign catalogs. Requires one of the network connectivity options in this table.	You want to query on-premises data in place, such as for ad hoc reporting, exploration, or an incremental migration.
Lakeflow Connect	Ingests data from on-premises SQL Server and Oracle databases into Databricks using an integrated change data capture (CDC) pipeline or an on-premises agent.	You want managed ingestion, or performance on high data volumes and low latency are priorities.
OpenSharing	Provides governed, zero-copy access to on-premises data in object storage. Doesn't require a dedicated connection or site-to-site VPN.	You want to limit data duplication and query the freshest possible data.