Context-based ingress policies for private connectivity are now GA

Use cases

Imagine you need to restrict inbound access to Databricks, allowing only specific network endpoints while enforcing identity-based rules. With this feature, you can:

• Define context-based inbound access policies directly from the account console.
• Combine registered VPC endpoint rules with identity and request type conditions.
• Test policies using dry run mode before enforcing them.

How to use

To use context-based ingress policies, an account admin must first enable the feature in the account console Previews page. Then, verify the DNS resolution for your workspace:

nslookup myworkspace.cloud.databricks.com

What happens in this code:

1. The command queries the DNS server to check the workspace address resolution.
2. The output should resolve to a privatelink subdomain and a private IP address.
3. This confirms that traffic routes through the Private Link tunnel instead of the public internet.

Limitations and requirements

• This feature is Generally Available (GA).
• Your Databricks account must be on the Enterprise plan.
• Context-Based Ingress workspace private access policies must be enabled by an account admin in the account console Previews page.