Manage private endpoint rules

note

There are currently no networking charges for serverless features. In a later release, you might be charged. Databricks will provide advance notice for networking pricing changes.

See Understand Databricks networking costs.

This article describes how to manage private endpoint rules for private connectivity from serverless compute using the Databricks account console. You can also use the Network connectivity configurations API.

Preview

This feature is in Private Preview. To try it, reach out to your Databricks contact.

To configure private connectivity for serverless compute, see Configure private connectivity to resources in your VPC.

View the connection status of a private endpoint rule

After you create a private endpoint rule, you can view its status on the Network connectivity configurations page under Private endpoint rules.

• PENDING: Pending approval on the resource.
• ESTABLISHED: Established on the resource.
• REJECTED: Rejected on the resource.
• DISCONNECTED: Disconnected on the resource.
• EXPIRED: Expired on the resource. A private endpoint rule expires after being in the REJECTED, DISCONNECTED, or PENDING state for 14 days.

Most changes to private endpoint rules propagate to serverless compute within 10 minutes, but can take up to 24 hours to fully apply.

:::

Remove private endpoint rules

You must be a Databricks account administrator to remove a private endpoint.

1. As an account administrator, go to the account console.

2. In the sidebar, click Security.

3. Click Network connectivity configurations.

4. Select your NCC.

5. In Private endpoint rules, click the trash button at the right of the rule you want to remove.

   If the rule is in ESTABLISHED, REJECTED, or DISCONNECTED state, Databricks might retain the private endpoint on your cloud resource for 1 day before permanently deleting it.

Update a private endpoint rule

1. From the Network connectivity configurations page, select the NCC object attached to your private endpoint.
2. Go to the Private endpoint rules tab.
3. Find the private endpoint you want to change and click the kebab menu .

Supported resources

Private connectivity from serverless compute supports resources in your VPC behind a customer-managed Google Cloud service attachment (internal load balancer).

The serverless compute plane on Google Cloud does not support Private Service Connect connectivity to Google-managed services. Serverless compute reaches Google APIs such as Google Cloud Storage and BigQuery through Private Google Access. If VPC Service Controls block that access, use the classic compute plane instead.

Next steps

• Configure private connectivity to internal network resources: Use Private Service Connect to establish secure and isolated access to your VPC resources from serverless compute, bypassing the public internet. See Configure private connectivity to resources in your VPC.
• Review Private Service Connect concepts: See Private Service Connect concepts.
• Understand data transfer and connectivity costs: Learn about the costs associated with data transfer and connectivity when using private endpoints and serverless compute. See Understand Databricks networking costs.