rules/findings/azure/databricks/azure-databricks-not-deployed-under-managed-vnet.json
|
{
"provider": "Azure", "serviceType": "Databricks", "serviceName": "Analytics Services", "displayName": "Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)", "description": "Networking for Azure Databricks can be set up in a few different ways. Using a customer-managed Virtual Network (VNet) (also known as VNet Injection) ensures that compute clusters and control planes are securely isolated within the organization\u2019s network boundary. By default, Databricks creates a managed VNet, which provides limited control over network security policies, firewall configurations, and routing.", "rationale": "Using a customer-managed VNet ensures better control over network security and aligns with zero-trust architecture principles. It allows for:\n\u2022 Restricted outbound internet access to prevent unauthorized data exfiltration.\n\u2022 Integration with on-premises networks via VPN or ExpressRoute for hybrid connectivity.\n\u2022 Fine-grained NSG policies to restrict access at the subnet level.\n\u2022 Private Link for secure API access, avoiding public internet exposure.", "impact": "\n\t\t* Requires additional configuration during Databricks workspace deployment.\n\t\t* Might increase operational overhead for network maintenance.\n\t\t* May impact connectivity if misconfigured (e.g., restrictive NSG rules or missing routes).\n\t", "remediation": { "text": "#### Remediate from Azure Portal \n\t\t\t\t1. Delete the existing Databricks workspace (migration required).\n\t\t\t\t2. Create a new Databricks workspace with VNet Injection:\n\t\t\t\t3. Go to Azure Portal \u2192 Create Databricks Workspace.\n\t\t\t\t4. Select Advanced Networking.\n\t\t\t\t5. Choose Deploy into your own Virtual Network.\n\t\t\t\t6. Specify a customer-managed VNet and associated subnets.\n\t\t\t\t7. Enable Private Link for secure API access.\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "6.0.0", "reference": "2.1.1", "profile": [ "Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "", "subPath": null, "selectCondition": {}, "query": [], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": {}, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": [ "name" ], "message": "Ensure that Azure Databricks is deployed in a customer-managed virtual network", "defaultMessage": null }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "type" }, "onlyStatus": false } }, "idSuffix": "azure_databricks_not_deployed_managed_vnet", "notes": [], "categories": [], "immutableProperties": [ "name", "id" ], "id": "az_databricks_001" } |