Choose a serverless connectivity option

This page helps you choose how to connect serverless compute to a target resource. Start by identifying what you want to access, and then follow the decision guide for that type of target:

• Cloud storage. See Cloud storage.
• Other cloud services or resources in your VPC. See Cloud services and network resources.
• On-premises resources or software as a service (SaaS) services. See On-premises and SaaS resources.

Cloud storage

To connect serverless compute to cloud storage, decide whether you require dedicated private connectivity:

• If you require dedicated private connectivity, create a private endpoint rule in a network connectivity configuration (NCC). See What is a network connectivity configuration (NCC)?.

• If you don't require dedicated private connectivity, allow serverless compute access using virtual private cloud (VPC) IDs. See Serverless compute firewall configuration.

Cloud services and network resources

To connect serverless compute to other cloud services or to resources in your VPC, answer the following questions in order:

1. Do you require dedicated private connectivity?
   • If yes, go to step 2.
   • If no, go to step 3.
2. Does the target resource support Private Link?
   • If yes, create a private endpoint rule to the resource in an NCC. See What is a network connectivity configuration (NCC)?.
   • If no, use a Private Link service and a load balancer.
3. Is connectivity over public endpoints acceptable? If yes, go to step 4.
4. Is the target resource protected by a firewall?
   • If yes, allowlist the Databricks outbound IP addresses.
   • If no, allow the target hostname in your serverless egress control policy. See What is serverless egress control?.

On-premises and SaaS resources

To connect serverless compute to on-premises resources or SaaS services, first identify how the target resource is reachable.

Publicly accessible resources

If the target resource is publicly accessible, decide whether it is protected by a firewall:

• If yes, allowlist the Databricks outbound IP addresses.
• If no, allow the target hostname in your serverless egress control policy. See What is serverless egress control?.

Resources reachable only over a private network path

If the target resource is reachable only over AWS Direct Connect or a site-to-site VPN, use a Private Link service and a load balancer. If your on-premises resources don't allow inbound access from the cloud, also add an SSH reverse tunnel.