Network connectivity for the Files API
Files API 3.0 requires network connectivity both from your network to Databricks and from Databricks to your storage.
Connectivity from your network
If you allow public internet access to your workspace but restrict it with a firewall, allowlist the control plane IP ranges for your region to use Files API 3.0:
Allowlist the IPs under Default storage, OpenSharing SecureConnect, Zerobus Ingestion, and Lakebase Autoscaling. See Inbound IPs.
If you do not allow internet access to Databricks and connect through a front-end private link, create a second front-end private link for performance-intensive services to use Files API 3.0. See Configure inbound PrivateLink for performance-intensive services.
Connectivity to your storage
Files API 3.0 also requires network connectivity to your storage. Use the following guidance to determine which IPs or identities to allowlist in your storage firewalls.
If you allow public access to your storage but apply network restrictions, for in-region storage, allowlist the Databricks serverless OrgPath. Otherwise, allowlist the Databricks outbound IPs.
If you do not allow public access to your storage, create a private link to Amazon S3. See Configure private connectivity to AWS-managed resources.
Serverless network billing applies. See Understand Databricks networking costs.