Private connectivity from serverless compute to AWS resources is GA

Use cases

Imagine you have serverless workloads in Databricks that need to access data in Amazon S3 or query an RDS database without exposing traffic to the public internet. This feature allows you to:

• Ensure a dedicated and isolated connection between serverless workspaces and AWS resources.
• Reduce the attack surface to mitigate data exfiltration risks using AWS PrivateLink.
• Securely connect to services such as S3, DynamoDB, Glue, KMS, Bedrock, and RDS.

How to use

Configure private connectivity using the Databricks account console and adjust access policies in AWS. First, create a Network Connectivity Configuration (NCC) object.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyAccessOutsideVpcEndpoint",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "dynamodb:*",
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/my_table",
      "Condition": {
        "StringNotEquals": {
          "aws:SourceVpce": "vpce-12345"
        }
      }
    }
  ]
}

What happens in this code:

1. Defines an explicit deny policy for DynamoDB.
2. Restricts access exclusively to the VPC endpoint specified in the aws:SourceVpce key.
3. Blocks any external requests attempting to bypass the private tunnel.

Limitations and requirements

• Generally Available (GA).
• Requires an Enterprise tier workspace and AWS account administrator privileges.
• Each Databricks account supports up to 20 NCCs per region.
• S3 FIPS connections are supported only in US and Canada regions within the same region.