Serverless compute plane networking
This page introduces tools to secure network access between the compute resources in the Databricks serverless compute plane and customer resources.
To learn more about the control plane and the serverless compute plane, see Networking security architecture.
To learn more about classic compute and serverless compute, see Compute.
There are currently no networking charges for serverless features. In a later release, you might be charged. Databricks will provide advance notice for networking pricing changes.
Serverless compute plane networking overview
Serverless compute resources run in the serverless compute plane, which is managed by Databricks. Account admins can configure secure connectivity between the serverless compute plane and their resources. This network connection is labeled as 2 on the diagram below:
Connectivity between the control plane and the serverless compute plane is always over the cloud network backbone and not the public internet. On the serverless compute plane, traffic to Google APIs routes over the Google Cloud backbone.
For more information on configuring security features on the other network connections in the diagram, see Networking.
Identifying serverless compute traffic to enable firewall configurations
Serverless compute reaches your resources using different connectivity methods depending on the resource's location, configuration, and type.
For Google Cloud resources in your workspace's region, Databricks connects using serverless project numbers with VPC Service Controls (VPC-SC). For other resources, serverless compute reaches them using public outbound IP addresses that Databricks publishes.
If you want to create a firewall around your resources while still allowing access from serverless compute, see Serverless compute firewall configuration.
Creating a resource firewall also affects connectivity from the classic compute plane. You must also allow the networks on your resource firewalls for connections from classic compute resources.
Configure access to Google Cloud resources using serverless project numbers
This feature is in Private Preview. To join this preview, contact your Databricks account team.
Google Cloud VPC Service Controls (VPC-SC) are used to define service perimeters that create a security boundary around Google Cloud resources. Serverless project numbers enable you to create VPC-SCs between the Databricks serverless compute plane and your Google Cloud resources, such as GCS buckets. This ensures that only Databricks serverless SQL compute projects can access your resources. For configuration instructions, see Serverless compute firewall configuration.
Serverless project numbers are only supported from SQL warehouses. They are not supported from other compute resources in the serverless compute plane.
Configure access to other resources using outbound IPs
This feature is in Public Preview.
For resources other than Google Cloud resources in the same region as your workspace, serverless compute reaches your resources using outbound IP addresses that Databricks publishes. If your resource is protected by a firewall, add these IPs to your allowlist. For the list of outbound IPs and configuration instructions, see Serverless compute firewall configuration.
The static list of outbound IPs shared through legacy versions of this preview has been decommissioned. Workloads relying on legacy, static allowlists might experience connection errors. Build automation to keep your allowlist current, as described in Serverless compute firewall configuration.