Block public access to Azure databricks

Question

Block public access to Azure databricks

Gil Shinar 0

Hi,

I have created a Databricks workspace of standard tier. In the public/not public access I have chosen public and in the vnet injection I have chosen true and used my vnet/subnets/NSGs.
In the NSGs there's a default rule to block all access. In a higher priority I have opened access to 443 to some IPs but haven't added mine. While testing, I can access the databricks workspace no problems at all. To be on the safe side, I sent the URL to one of my colleagues who's not part of this project and he could telenet to port 443 no problem.

During some trial and error, I realized some interesting things. One of them is that whatever databricks workspace I have created (in useast), they all resolve to the same DNS address of: eastus-c3.azuredatabricks.net

I read a lot. Tried whatever I have found while reading. telnet to 443 works always!! Created firewall rule (didn't work).

I created a databricks workspace of premium tier and chose to not use public IP. Created a private endpoint but, still, could telnet to 443. I still haven't tried to access the databricks other than telnet while using premium tier and private endpoint.

Today, someone told me that the firewall rule is not enough because I'm connecting to eastus-c3.azuredatabricks.net and not directly to my vnet so he helped me to create a route from my vnet to the public IP of the firewall rule and that blocked access but also created critical issues with the compute of the workspace.

My question is as follows, is there a way to block all access to the workspace (standard tier) except a few single IPs? If there is, I'll be glad to know how? In case I have to use premium tier, I'll not be using public access and add an endpoint. Should that solve this issue or will I require a VPN to access the databricks?

Thanks!
Gil

0 comments

2 answers

Your answer

Answer 1

You can refer below KB article -

https://learn.microsoft.com/en-us/azure/databricks/administration-guide/cloud-configurations/azure/vnet-inject

Steps to block public access to Azure Databricks Standard tier:

Create a network security group (NSG) with rules to deny all inbound and outbound traffic.
Associate the NSG to the subnets used by your Azure Databricks workspace.
Create a network interface (NIC) in the same subnet as your Azure Databricks workspace.
Assign a public IP address to the NIC.
Create a route table in your virtual network (VNet).
Add a route to the route table that directs traffic for the Azure Databricks DNS name (eastus-c3.azuredatabricks.net) to the public IP address of the NIC.

This will allow you to access your Azure Databricks workspace from the allowed IP addresses. All other traffic will be blocked.

Answer 2

Gil Shinar 0

Hi

First thanks for replying!
The above procedure wasn't fully obvious to me and on top of that, no matter what I have tried, it didn't work.
First I'll elaborate on what wasn't clear to me:

I'm creating the setup using TF and while doing that I'm also creating two NSGs. These NSGs are being created with a 3 default inbound and outbound rules. The least prioritiesed is the deny all access. Do I still need to create another NSG?
The above are associated
Which subnet? The private one or public one?
No problem with this
Which of the subnets should be associated with this route table?
Couldn't find a way to create route from a DNS. I can only use IP address or service tag

Now for what I have tried:

At first I tried to create a NIC from the portal and attach it to one of the subnets. It didn't work because of the databricks rules that had been added to the subnet using the databricks delegation. What I did to solve this issue is to destroy and recreate all using terraform. That way I was able to attach the NIC with the public IP to the subnet
At first I tried to add the NIC to the public subnet and associate the route table to the public subnet. That caused issues with the cluster. The cluster failed to be created/start. No matter what I've tried with the route rule, it failed to create/start.
I tried to attach the NIC on the private subnet and whatever I tried with the route rule, I could reach the databricks from my laptop although my IP address is not part of any NSG.
I created a new NSG with one rule fir inbound and one rule to outbound to deny all traffic but failed to associate this NSG with any of the subnets due to intent policy conflicts (rules that had been added by databricks using the delegation)

Is there anything that I'm missing?

Thanks

Gil

VasimTamboli 5,550 Reputation points MVP

2023-10-23T13:52:35.68+00:00
i apologies but sometime its hard to understand your actual scenario and we usually suggest based on our limited knowledge.

Create a network security group (NSG) with rules to deny all inbound and outbound traffic.

Associate the NSG to the subnets used by your Azure Databricks workspace.

Create a network interface (NIC) in the same subnet as your Azure Databricks workspace.

Assign a public IP address to the NIC.

Create a route table in your virtual network (VNet).

Add a route to the route table that directs traffic for the Azure Databricks DNS name (eastus-c3.azuredatabricks.net) to the public IP address of the NIC.

This will allow you to access your Azure Databricks workspace from the allowed IP addresses. All other traffic will be blocked.

Addressing your specific questions:

Do I still need to create another NSG?

No, you do not need to create another NSG. You can use the same NSG that you created in step 1.

Which subnet? The private one or public one?

You need to associate the NSG to the private subnet used by your Azure Databricks workspace.

Which of the subnets should be associated with this route table?

You need to associate the route table to the private subnet used by your Azure Databricks workspace.

Couldn't find a way to create route from a DNS. I can only use IP address or service tag

To create a route from a DNS, you need to use a custom user defined route (UDR). To do this, you can use the Azure CLI or Azure PowerShell.

Here is an example of how to create a UDR using the Azure CLI:

az network route-table create -g myResourceGroup -n myRouteTable az network route-table route create -g myResourceGroup -n myRouteTable --address-prefix eastus-c3.azuredatabricks.net --next-hop-type VirtualAppliance --next-hop-address myNicPublicIpAddress

Here is an example of how to create a UDR using Azure PowerShell:

New-AzNetworkRouteTable -Name myRouteTable -ResourceGroupName myResourceGroup New-AzNetworkRouteTableRule -Name myRouteTableRule -RouteTableId myRouteTable -AddressPrefix eastus-c3.azuredatabricks.net -NextHopType VirtualAppliance -NextHopIpAddress myNicPublicIpAddress

Once you have created the UDR, you need to associate it to the private subnet used by your Azure Databricks workspace.

To do this, you can use the Azure CLI or Azure PowerShell.

Here is an example of how to associate a UDR to a subnet using the Azure CLI:

az network vnet subnet update -g myResourceGroup -n mySubnet --vnet-name myVNet --route-table myRouteTable

Here is an example of how to associate a UDR to a subnet using Azure PowerShell:

Set-AzNetworkVnetSubnet -Name mySubnet -ResourceGroupName myResourceGroup -VNetName myVNet -RouteTable myRouteTable

Once you have associated the UDR to the private subnet, all traffic to the Azure Databricks DNS name will be directed to the public IP address of the NIC.

Please note that you will need to create a new NIC and assign it a public IP address if you want to change the allowed IP addresses that can access your Azure Databricks workspace.
Gil Shinar 0 Reputation points

2023-10-23T14:06:51.05+00:00
In that case I have three more questions:

I have mentioned above that I have already created two NSGs that are attached to the two networks. These NSGs has a default rule with lowest priority to deny all traffic. You haven't related your answer to this information. :-)

Do I need to set the NPIP configuration in the databricks to true or false (should it has a public IP of shouldn't it has)?

If the NSG has only one rule of denying all traffic, were will be the allowed list of IPs? In that NSG? Somewhere else? What about databricks rules that are being applied on that NSG?

Thanks
Gil Shinar 0 Reputation points

2023-10-23T14:36:22.2466667+00:00

I have to admit, reading this:
**Please note that you will need to create a new NIC and assign it a public IP address if you want to change the allowed IP addresses that can access your Azure Databricks workspace.
**
Makes me loose context of what is the architecture of the solution? Is this another NIC? Should I attach it to the private network as well? How is that related to the allowed IP addresses?

Sorry for that

Share via

Block public access to Azure databricks

2 answers

Your answer