rules/findings/azure/databricks/azure-databricks-lacks-private-endpoint.json
|
{
"provider": "Azure", "serviceType": "Databricks", "serviceName": "Analytics Services", "displayName": "Ensure private endpoints are used to access Azure Databricks workspaces", "description": "Use private endpoints for Azure Databricks workspaces to allow clients and services to securely access data located over a network via an encrypted Private Link. To do this, the private endpoint uses an IP address from the VNet for each service. Network traffic between disparate services securely traverses encrypted over the VNet. This VNet can also link addressing space, extending your network and accessing resources on it.<br/><br/>Similarly, it can be a tunnel through public networks to connect remote infrastructures together. This creates further security through segmenting network traffic and preventing outside sources from accessing it.", "rationale": "Using private endpoints for Azure Databricks workspaces ensures that all communication between clients, services, and data sources occurs over a secure, private IP space within an Azure Virtual Network (VNet). This approach eliminates exposure to the public internet, significantly reducing the attack surface and aligning with Zero Trust principles. Additionally, integrating Databricks with a VNet enables network segmentation, fine-grained access control, and hybrid connectivity through VNet peering or VPN/ExpressRoute.", "impact": "If an Azure Virtual Network is not implemented correctly, this may result in the loss of critical network traffic.<br/><br/>Private endpoints are charged per hour of use. Refer to https://azure.microsoft.com/en- us/pricing/details/private-link/ and https://azure.microsoft.com/en-us/pricing/calculator/ to estimate potential costs.<br/><br/>Before a private endpoint can be configured, Azure Databricks workspaces:\n• must be deployed in a customer-managed virtual network (VNet injection)—refer to the recommendation Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)\n• must have secure cluster connectivity enabled—refer to the recommendation Ensure 'Enable No Public IP' is set to 'Yes'\n• must be on the Premium pricing tier Ensure the requirements and concepts are considered carefully before applying this recommendation. Refer to https://learn.microsoft.com/en- us/azure/databricks/security/network/classic/private-link for more information.", "remediation": { "text": "Remediate from Azure Portal 1. Go to Azure Databricks. 2. Click the name of a workspace. 3. Under Settings, click Networking. 4. Click Private endpoint connections. 5. Click + Private endpoint. 6. Under Project details, select a Subscription and a Resource group. 7. Under Instance details, provide a Name, Network Interface Name, and select a Region. 8. Click Next : Resource >. 9. Select a Target sub-resource. 10. Click Next : Virtual Network >. 11. Under Networking, select a Virtual network and a Subnet. 12. Optionally, configure Private IP configuration and Application security group. 13. Click Next : DNS >. 14. Optionally, configure Private DNS integration. 15. Click Next : Tags >. 16. Optionally, configure tags. 17. Click Next : Review + create >. 18. Click Create. 19. Repeat steps 1-18 for each workspace requiring remediation.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/databricks/security/network/concepts/private-link", "https://learn.microsoft.com/en-us/cli/azure/databricks/workspace?view=azure-cli-latest", "https://learn.microsoft.com/en-us/powershell/module/az.databricks/?view=azps-15.4.0" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "6.0.0", "reference": "2.1.11", "profile": [ "Level 2" ] } ], "level": "low", "tags": [], "rule": { "path": "", "subPath": null, "selectCondition": {}, "query": [ ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": {}, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": ["name"], "message": "Ensure private endpoints are used to access Azure Databricks workspaces", "defaultMessage": null }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "type" }, "onlyStatus": false } }, "idSuffix": "azure_databricks_private_endpoint_not_set", "notes": [], "categories": [], "immutable_properties": [ "name", "id" ], "id": "az_databricks_011" } |