Network connectivity for the Files API
Files API 3.0 requires network connectivity both from your network to Databricks and from Databricks to your storage.
Connectivity from your network
If you allow public internet access to your workspace but restrict it with a firewall, allowlist the control plane IP ranges for your region to use Files API 3.0:
Allowlist the IPs under Control Plane services, including default storage, webapp, and SecureConnect. See Inbound IPs to Databricks control plane.
If you do not allow internet access to Databricks and connect through a front-end private link, create a second front-end private link for performance-intensive services to use Files API 3.0. See Configure inbound Private Service Connect for performance-intensive services.
Connectivity to your storage
Files API 3.0 also requires network connectivity to your storage. Use the following guidance to determine which IPs or identities to allowlist in your storage firewalls.
If you allow public access to your storage but apply network restrictions, allowlist your project IDs in your VPC Service Controls (VPC-SC) policies.
If you do not allow public access to your storage, use Google Cloud Private Service Connect to reach your cloud resources. See Configure private connectivity to resources in your VPC.
Serverless network billing applies. See Understand Databricks networking costs.