Skip to main content
Last updated on

Configure inbound Private Service Connect for account-level resources

Beta

Inbound Private Service Connect for account-level resources is in Beta. Enable Context-Based Ingress: Account Policy to get started.

This feature gives users in your Google Cloud Virtual Private Cloud (VPC) networks or on-premises networks private access to Databricks account-level resources, including the account console and account-level Genie One. Traffic routes through a Private Service Connect endpoint in your transit VPC instead of the public internet.

If you have multiple Databricks accounts, you can share a single inbound Private Service Connect endpoint across them by registering it in each account.

For an overview of private connectivity at Databricks, see Private Service Connect concepts.

With inbound Private Service Connect to account-level resources:

  • Configure private access: Configure inbound Private Service Connect connections to the Databricks web application and REST API.
  • Enforce private connectivity: Configure private connectivity from users to Databricks.

Requirements​

  • Your Databricks account is on the Enterprise plan.
  • You must have all necessary Google Cloud permissions to create subnets and Private Service Connect endpoints in your transit VPC.
  • To establish an inbound Private Service Connect connection for accessing the account-level resource from your on-premises network, connect your on-premises network to a Google Cloud VPC network using Cloud Interconnect or Cloud VPN.
  • Allow network traffic from all relevant address spaces within your local network to connect to your Private Service Connect endpoint using TCP port 443.

Configure inbound Private Service Connect​

Create a VPC endpoint​

tip

For account-level private access, you can reuse any General Access VPC endpoint you've already created for inbound Private Service Connect to your workspaces (see Configure inbound Private Service Connect for workspaces). This VPC endpoint can live in any region.

In your transit VPC network, create a General Access Private Service Connect endpoint that targets the plproxy-psc-endpoint-all-ports service attachment for your region. If you don't already have a subnet for the endpoint, create one first. See Create a subnet.

When naming the endpoint, Databricks recommends including general-access, such as databricks-general-access-psc.

To get the full service attachment name for your region, use the General Access value in Private Service Connect (PSC) attachment URIs and project numbers.

Register VPC endpoints​

After you create your VPC endpoint in the Google Cloud console, register it with Databricks. You can also use the VPC Endpoint Configurations API.

  1. Go to the Databricks account console.
  2. Click Security in the sidebar.
  3. Click Private endpoints.
  4. Click Register a private endpoint.
  5. Fill in the required fields:
    • VPC endpoint name: A descriptive name for your VPC endpoint registration. A naming convention that includes the purpose is recommended, such as VPCE for General Access.
    • Region: The Google Cloud region where this Private Service Connect endpoint is defined.
    • Google Cloud VPC network project ID: The Google Cloud project ID of the transit VPC where this endpoint is defined.
    • Google Cloud Private Service Connect (PSC) endpoint ID: The ID of the Private Service Connect endpoint you created.
  6. Click Register new VPC endpoint.

If you have multiple Databricks accounts, you can register the Private Service Connect endpoint in each account.

Configure private access policy with context-based ingress​

After you register your General Access VPC endpoint, you must configure a private access policy for your account-level resources using context-based ingress. See Context-based ingress control for more details.

  1. In the account console, click Security in the sidebar.

  2. Click Context-based ingress & egress control in the sidebar.

  3. Under Account level policy, click account-policy.

  4. Under Private Network Access, define your private access policy. By default, no registered endpoints are allowed.

    • If you would like to allowlist specific registered endpoints while denying all other endpoints, add an allow rule.
      1. Select the identities and workspace destinations you would like to allow access to (by default, all identities and destinations are allowed).
      2. Then select source type = Selected private endpoints, and select the General Access VPC endpoint(s) you registered. A General Access endpoint in any region can serve any account-level resource.
      3. Click Confirm.
      4. You can also add Deny rules in your policy, which define exceptions to your allow rules.
    • If you would like to allowlist all registered endpoints, check Allow access from all private endpoints. By default, this option only includes the first 200 registered VPC endpoints. If your policy requires more than 200 endpoints, contact your account team for an increase.

  5. Test your ingress policy in Dry run mode first, before switching it to Enforced.

  6. Save your network policy. Context-based ingress policy updates take under 10 minutes to take effect.

tip

There is only one network policy shared across all account-level resources. If you want to configure different policies for different account-level resources, you can do so by adding multiple allow rules to different destinations.

Configure DNS for inbound Private Service Connect​

After creating and registering your inbound Private Service Connect endpoint, configure DNS to route user requests through your private network to the endpoint's private IP address.

Account-level resources have two valid URLs: your custom URL (for example, <my-custom-account-name>.databricks.com) and accounts.gcp.databricks.com.

  • To use your custom URL, create a Cloud DNS private zone for your custom URL in your transit VPC and add an A record that resolves it to your Private Service Connect endpoint's private IP.
  • To use accounts.gcp.databricks.com, add an A record for accounts.gcp.databricks.com to the gcp.databricks.com Cloud DNS private zone in your transit VPC. This record is required if your transit VPC has a gcp.databricks.com private zone, for example for inbound Private Service Connect to workspaces, because the private zone overrides public DNS resolution for every name in the domain. It is also required to enable private unified login (see Configure inbound Private Service Connect with unified login).

For comprehensive DNS configuration instructions, including Cloud DNS zone setup and verification, see Configure DNS for Google Cloud inbound Private Service Connect.

Verify DNS resolution​

After configuring DNS, verify that the account-level resource URLs you routed resolve to a private IP address, not a public IP address. These private IPs might differ from the IPs shown below.

Custom URL:

Bash
nslookup <my-custom-account-name>.databricks.com

Expected output:

<my-custom-account-name>.databricks.com
Address: 10.0.0.2

accounts.gcp.databricks.com:

Bash
nslookup accounts.gcp.databricks.com

Expected output:

accounts.gcp.databricks.com
Address: 10.0.0.2

Disable public access (optional)​

Completing Private Service Connect setup doesn't automatically block public internet access to your account-level resources. Public and private access are independent settings. To enforce private-only connectivity, restrict public network access with the account-level context-based ingress policy (see Manage account context-based ingress policies) or account IP access lists (see Configure IP access lists for the account console).

Next steps​

On this page