Skip to main content

📝 Azure Databricks Workspace is not deployed in a customer-managed virtual network (VNet) 🟢

  • Contextual name: 📝 Workspace is not deployed in a customer-managed virtual network (VNet) 🟢
  • ID: /ce/ca/azure/databricks/customer-managed-virtual-network
  • Located in: 📁 Azure Databricks

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Logic​

Description​

Open File

Description​

Networking for Azure Databricks can be set up in a few different ways. Using a customer-managed Virtual Network (VNet) (also known as VNet Injection) ensures that compute clusters and control planes are securely isolated within the organization’s network boundary. By default, Databricks creates a managed VNet, which provides limited control over network security policies, firewall configurations, and routing.

Rationale​

Using a customer-managed VNet ensures better control over network security and aligns with zero-trust architecture principles. It allows for:

  • Restricted outbound internet access to prevent unauthorized data exfiltration.
  • Integration with on-premises networks via VPN or ExpressRoute for hybrid connectivity.
  • Fine-grained NSG policies to restrict access at the subnet level.
  • Private Link for secure API access, avoiding public internet exposure.

Impact​

  • Requires additional configuration during Databricks workspace deployment.
  • Might increase operational overhead for network maintenance.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Delete the existing Databricks workspace (migration required).
  2. Create a new Databricks workspace with VNet Injection:
  3. Go to Azure Portal → Create Databricks Workspace.
  4. Select Advanced Networking.
  5. Choose Deploy into your own Virtual Network.
  6. Specify a customer-managed VNet and associated subnets.
  7. Enable Private Link for secure API access.
From Azure CLI​

Deploy a new Databricks workspace in a custom VNet:

az databricks workspace create --name <databricks-workspace-name> \ 
    --resource-group <resource-group-name> \ 
    --location <region> \ 
    --managed-resource-group <managed-rg-name> \ 
    --enable-no-public-ip true \ 
    --network-security-group-rule "NoAzureServices" \ 
    --public-network-access Disabled \ 
    --custom-virtual-network-id /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>

Ensure NSG Rules are correctly configured:

az network nsg rule create --resource-group <resource-group-name> \ 

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS Azure v4.0.0 → 💼 3.1.1 Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet) (Automated)1
💼 Cloudaware Framework → 💼 Threat Protection27