🛡️ Azure Databricks Workspace is not deployed in a customer-managed virtual network (VNet)🟢

• Contextual name: 🛡️ Workspace is not deployed in a customer-managed virtual network (VNet)🟢
• ID: /ce/ca/azure/databricks/customer-managed-virtual-network
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Databricks Workspace
  • 🔌 Azure Databricks Workspace - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Networking for Azure Databricks can be set up in a few different ways. Using a customer-managed Virtual Network (VNet) (also known as VNet Injection) ensures that compute clusters and control planes are securely isolated within the organization’s network boundary. By default, Databricks creates a managed VNet, which provides limited control over network security policies, firewall configurations, and routing.

Rationale

Using a customer-managed VNet ensures better control over network security and aligns with zero-trust architecture principles. It allows for:

• Restricted outbound internet access to prevent unauthorized data exfiltration.
• Integration with on-premises networks via VPN or ExpressRoute for hybrid connectivity.
• Fine-grained NSG policies to restrict access at the subnet level.
• Private Link for secure API access, avoiding public internet exposure.

Impact

• Requires additional configuration during Databricks workspace deployment.
• Might increase operational overhead for network maintenance.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Delete the existing Databricks workspace (migration required).
2. Create a new Databricks workspace with VNet Injection:
3. Go to Azure Portal → Create Databricks Workspace.
4. Select Advanced Networking.
5. Choose Deploy into your own Virtual Network.
6. Specify a customer-managed VNet and associated subnets.
7. Enable Private Link for secure API access.

From Azure CLI

Deploy a new Databricks workspace in a custom VNet:

az databricks workspace create --name <databricks-workspace-name> \ 
    --resource-group <resource-group-name> \ 
    --location <region> \ 
    --managed-resource-group <managed-rg-name> \ 
    --enable-no-public-ip true \ 
    --network-security-group-rule "NoAzureServices" \ 
    --public-network-access Disabled \ 
    --custom-virtual-network-id /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>

Ensure NSG Rules are correctly configured:

az network nsg rule create --resource-group <resource-group-name> \ 

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v4.0.0 → 💼 3.1.1 Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet) (Automated)			1		no data
💼 Cloudaware Framework → 💼 Threat Protection			29		no data