Manage private access settings

This article explains how to create private access settings objects, which are required to enable private connectivity using Private Service Connect.

To enable Private Service Connect on your workspace, see Enable Private Service Connect for your workspace.

What is a private access settings object?

A private access settings object is a Databricks object that describes a workspace's Private Service Connect connectivity. Create a new private access settings object just for this workspace, or re-use and share an existing private access setting object among multiple workspaces in the same region.

A private access settings object:

• Expresses your intent to use Private Service Connect with your workspace.
• Controls your settings for the front-end use case of Private Service Connect for public network access.
• Controls which VPC endpoints are permitted to access your workspace.

Create a private access settings object using the account console or the Private Access Settings API. You reference the private access settings object when you create or update a workspace.

Create a private access settings object

1. As an account admin, go to the account console.

2. In the sidebar, click Security.

3. Click Private access settings.

4. Click Add private access settings.

5. Enter a name for your new private access settings object.

6. Select a region, be sure to match the region of your workspace.

7. Set the Public access enabled field.

   • If public access is enabled, the workspaces that use this private access settings object can be accessed from Private Service Connect connectivity or from the public internet. Use IP access lists or context-based ingress control to limit public access.
   • If public access is disabled (the default), no public traffic can access the workspaces that use this private access settings object. IP access lists and context-based ingress public access policies are not evaluated.

   In both cases, IP access lists cannot block private traffic from Private Service Connect because the access lists only control access from the public internet. To limit private traffic to specific registered endpoints, use the Private Access Level field or a context-based ingress private access policy. See Configure private access policy.

8. Select a Private Access Level that restricts access to only authorized Private Service Connect connections. It can be one of the below values:

   • Account: Any VPC endpoints registered with your Databricks account can access this workspace. This is the default value.
   • Endpoint: Only the VPC endpoints that you specify explicitly can access the workspace. If you choose this value, you can choose from among your registered VPC endpoints.

   To manage private access with context-based ingress instead, set Public access enabled to True and Private Access Level to Account. Context-based ingress then makes the private access decision. Leave Public access enabled set to True and use context-based ingress to restrict access.

9. Click Add private access setting.

Update a private access settings object

To update fields on a private access object:

1. In the account console, click Security.
2. In sidebar, click Private access settings.
3. On the row for the configuration, click the kebab menu on the right, and select Update.
4. Change any fields. For guidance on specific fields, see Create a private access settings object.
5. Click Update private access setting.

Delete a private access settings object

To delete a private access settings object:

1. In the account console, click Security.
2. Click Private access settings.
3. On the row for the configuration, click the kebab menu on the right, and select Delete.
4. In the confirmation dialog, click Ok.