← All updates Databricks Update One-Pager Navy version
databricks Platform · Updated Jul 6, 2026

Private Link for Account-Level Resources

Securely connect to Databricks resources without exposing them to the public internet.

Beta Open docs ↗release note ↗
What it does

This feature enables private access to Databricks account-level resources, such as the account console, through a VPC interface endpoint, ensuring that traffic does not traverse the public internet. Users can configure inbound Private Link connections for both the Databricks web application and REST API. Additionally, it allows sharing a single inbound VPC endpoint across multiple Databricks accounts, enhancing resource management and security.

Why it matters

By utilizing Private Link, organizations can significantly enhance their security posture by ensuring that sensitive data does not traverse the public internet. This feature is particularly beneficial for enterprises that require strict compliance and governance measures, as it reduces exposure to potential threats and vulnerabilities. It also streamlines connectivity for users in AWS VPCs or on-premises networks, improving overall productivity.

Key capabilities
Private Access Configuration
Users can configure inbound Private Link connections to securely access Databricks resources.
Shared VPC Endpoint
Multiple Databricks accounts can share a single inbound VPC endpoint for efficient resource management.
Context-Based Ingress Control
Allows for detailed access policies to be set for account-level resources based on user context.
DNS Configuration
Enables routing of user requests through private networks to ensure secure access.
Prerequisites
Databricks account must be on the Enterprise plan.
Necessary AWS permissions to create new VPC endpoints.
On-premises network must connect to an AWS VPC using Direct Connect or VPN.
Network traffic must be allowed from relevant address spaces to connect to the VPC endpoint using TCP port 443.
Recommended use cases
Organizations needing secure access to Databricks resources without public exposure.Companies with multiple Databricks accounts wanting to streamline resource access.Enterprises requiring compliance with strict data governance policies.
Limitations · remember
!Public and private access settings are independent; completing setup does not block public access automatically.
!Default context-based ingress policy allows no registered endpoints unless configured otherwise.
!Only the first 200 registered VPC endpoints are included by default in the allow access option.
Architecture
User Network → Transit VPC → VPC Endpoint → Databricks Account-Level Resources
Get started
1
Create VPC Endpoints
Use the AWS Management Console to create inbound VPC endpoints for Databricks.
2
Register VPC Endpoints
Register the created VPC endpoints in the Databricks account console.
3
Configure Private Access Policy
Set up a private access policy using context-based ingress in the account console.
4
Configure DNS
Route user requests through the private network to the VPC endpoint's private IP address.
5
Disable Public Access (Optional)
Use account IP access lists to enforce private-only connectivity.
Key takeaway
Private Link for account-level resources enhances security by enabling private connectivity to Databricks without exposing sensitive data to the public internet.
2026-07-06-private-link-for-account-level-resources-beta Generated by the Databricks Updates Agent · browse all updates