Skip to main content
Last updated on

Connect to on-premises resources using a Private Link service

A Private Link service provides a dedicated, private connection from serverless compute to resources in your VPC and in transitively connected networks, such as your on-premises network. Serverless compute connects to a private endpoint in your network connectivity configuration (NCC), which connects to a load balancer in your VPC. The load balancer routes traffic to your target resources.

What problem it solves​

A Private Link service establishes a dedicated, private connection from serverless compute to:

  • Cloud services that don't support Private Link directly.
  • Resources in your VPC and transitively connected networks, such as databases hosted on VMs and custom TCP applications.
  • On-premises resources over AWS Direct Connect or a site-to-site VPN.

Use a Private Link service when you want to connect serverless compute to services and resources in your VPC, or in networks connected to it, that don't support Private Link directly.

How it works​

You expose your resources to serverless compute through a Network Load Balancer (NLB) and a virtual private cloud (VPC) endpoint service:

  1. Create an NLB that serves as the frontend for your VPC resources.
  2. Configure listeners on the NLB with dedicated ports, such as 1521 or 3306, that route traffic to specific target groups, such as resources in your VPC and on-premises network.
  3. Create a VPC endpoint service, and expose your NLB to Databricks through a private endpoint in an NCC.

Serverless compute reaching target groups in your VPC and on-premises network through an NCC private endpoint, a VPC endpoint service, and an NLB with listeners on dedicated ports.

For detailed steps, see Configure private connectivity to resources in your VPC.

Considerations​

Review the following before you use a Private Link service:

  • This is not a managed solution. You must provision, monitor, and maintain infrastructure such as load balancers, which adds cost and operational overhead.
  • This approach requires deep technical knowledge, especially of proxy configuration and custom routing.
  • Application teams might need to work with infrastructure teams each time they connect to a new resource.

Before you set up a Private Link service, check whether your target resource supports a direct private endpoint rule. See Serverless compute plane networking.

Additional resources​

On this page