Private Link

Private Link is a Databricks compute / bi capability, introduced April 2021.

Private connectivity to and from Databricks over the cloud provider's private endpoint service (AWS PrivateLink or Azure Private Link), in three independently enabled flavours: inbound (front-end) from users to workspaces and account-level resources, classic compute plane (back-end) from clusters to the control plane, and outbound (serverless) from serverless compute to your own resources.

• For its first year and a half on AWS, turning it on started with asking - only in August 2022 did Databricks announce you no longer need to contact them to enable PrivateLink on your account. 🔗
• The original default was maximally trusting - the private access level started out as ANY, which filtered nothing about which VPC endpoints could reach your workspace, until Databricks deprecated it in 2022. 🔗
• Since October 2022 IP access lists no longer block PrivateLink traffic - they only police requests arriving over the public internet, so a private IP you had blocked could suddenly be let in. 🔗

⚠ Limitations: Requires the Enterprise tier on AWS (Premium on Azure). Classic compute plane (back-end) Private Link, and inbound Private Link on a workspace with a classic compute plane, need a customer-managed VPC (VNet injection on Azure) and secure cluster connectivity; outbound (serverless) and serverless-only workspaces do not. On AWS, VPC endpoint registrations and network configurations cannot be updated after creation, and an account holds at most 110 VPC endpoint registrations and 55 private access settings objects (fixed limits). 🔗

Category

Compute / BI

Introduced

April 2021🔗

Announced at

Private Databricks Workspaces With AWS PrivateLink launch blog (Public Preview)🔗

Also known as

PrivateLink, AWS PrivateLink, Azure Private Link, Inbound Private Link, Front-end Private Link, Outbound Private Link, Serverless Private Link, Classic compute plane Private Link, Back-end Private Link, Classic PrivateLink

Verified

2026-09-27