Detections
Analytics

2.1.11 Ensure private endpoints are used to access Azure Databricks workspaces

Information

Use private endpoints for Azure Databricks workspaces to allow clients and services to securely access data located over a network via an encrypted Private Link. To do this, the private endpoint uses an IP address from the VNet for each service. Network traffic between disparate services securely traverses encrypted over the VNet. This VNet can also link addressing space, extending your network and accessing resources on it. Similarly, it can be a tunnel through public networks to connect remote infrastructures together. This creates further security through segmenting network traffic and preventing outside sources from accessing it.

Using private endpoints for Azure Databricks workspaces ensures that all communication between clients, services, and data sources occurs over a secure, private IP space within an Azure Virtual Network (VNet). This approach eliminates exposure to the public internet, significantly reducing the attack surface and aligning with Zero Trust principles.Additionally, integrating Databricks with a VNet enables network segmentation, fine-grained access control, and hybrid connectivity through VNet peering or VPN/ExpressRoute.

Solution

Remediate from Azure Portal

 - Go to Azure Databricks.
 - Click the name of a workspace.
 - Under Settings, click Networking.
 - Click Private endpoint connections.
 - Click + Private endpoint.
 - Under Project details, select a Subscription and a Resource group.
 - Under Instance details, provide a Name, Network Interface Name, and select a Region.
 - Click Next : Resource >.
 - Select a Target sub-resource.
 - Click Next : Virtual Network >.
 - Under Networking, select a Virtual network and a Subnet.
 - Optionally, configure Private IP configuration and Application security group.
 - Click Next : DNS >.
 - Optionally, configure Private DNS integration.
 - Click Next : Tags >.
 - Optionally, configure tags.
 - Click Next : Review + create >.
 - Click Create.
 - Repeat steps 1-18 for each workspace requiring remediation.

Remediate from Azure CLI

For each workspace requiring remediation, run the following command to create a private endpoint connection:

az network private-endpoint create --resource-group <resource-group> --name <private-endpoint> --location <location> --vnet-name <virtual-network> --subnet <subnet> --private-connection-resource-id <workspace> --connection-name <private-endpoint-connection> --group-id <browser_authentication| databricks_ui_api>

Impact:

If an Azure Virtual Network is not implemented correctly, this may result in the loss of critical network traffic.

Private endpoints are charged per hour of use. Refer to https://azure.microsoft.com/en-us/pricing/details/private-link/ and https://azure.microsoft.com/en-us/pricing/calculator/ to estimate potential costs.

Before a private endpoint can be configured, Azure Databricks workspaces:

 - must be deployed in a customer-managed virtual network (VNet injection)-refer to the recommendation Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)
 - must have secure cluster connectivity enabled-refer to the recommendation Ensure 'Enable No Public IP' is set to 'Yes'
 - must be on the Premium pricing tier

Ensure the requirements and concepts are considered carefully before applying this recommendation. Refer to https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/private-link for more information.

See Also

https://workbench.cisecurity.org/benchmarks/21611

Item Details

Category: CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CM-7, 800-53|CP-6, 800-53|CP-7, 800-53|PL-8, 800-53|PM-7, 800-53|SA-8, 800-53|SC-7, CSCv7|14.1

Plugin: microsoft_azure

Control ID: 1f06bdb6645a79f2b82dae339bf4bb87221701b09479d9ab207d1e37235e968b