topic Re: PrivateLink Validation Error - When trying to access to Workspace in Administration & Architecture

PrivateLink Validation Error - When trying to access to Workspace

ambigus9 — Tue, 19 Nov 2024 17:46:26 GMT

The fact is when we disable the Public Access:

We are getting "login.html?error=private-link-validation-error"

We have the security group of Data Plane and Workspace configured as follows:

Data Plane Security Group - Inbound Rules:

Data Plane Security Group - Outbound Rules:

Workspaces Security Group - Inbound Rules:

Workspaces Security Group - Outbound Rules:

Any help will be appreciated

Walter_C — Tue, 19 Nov 2024 19:15:01 GMT

If you create a VM inside the same VPC of your workspace are you able to access the workspace? Also have you granted access to all the ports as provided in docs https://docs.databricks.com/en/security/network/classic/privatelink.html#step-1-configure-aws-network-objects

ambigus9 — Thu, 21 Nov 2024 14:34:38 GMT

We created a Windows VM inside the same VPC and we can access to the workspace. But, testing with the On-premise of our client network doesn't work.

The ports are configured as docs:

We validated for the Network ACLs and we have this configuration:

Walter_C — Thu, 21 Nov 2024 15:05:14 GMT

Have you created the Direct Connect set up for the on prem network:

To establish a front-end PrivateLink connection for accessing the workspace from your on-premises network, connect your on-premises network to an AWS VPC using Direct Connect or VPN.
Also have you checked the DNS set up for Private Link: https://docs.databricks.com/en/security/network/classic/privatelink.html#step-5-configure-internal-dns-to-redirect-user-requests-to-the-web-application-front-end

ambigus9 — Thu, 21 Nov 2024 22:57:12 GMT

We created a record A on AWS Route53 an the redirection works, However, now we have a warning due to SSL certificates. We configure as follows:

Record type	Record Name	Value
A	databricks.my_website.com	10.0.0.1,10.0.0.2

Aditionally, How we can register a CNAME using the cloud.databricks.com domain?

According to the docs we must setup as follows:

Record type	Record Name	Value
CNAME	dbc-01abcd23-4b0e.cloud.databricks.com	databricks.my_website.com

However, we only can take the hosted zone on Route53:

Record type	Record Name	Value
CNAME	dbc-01abcd23-4b0e.my_website.com	databricks.my_website.com

Thanks for your help!

Walter_C — Fri, 22 Nov 2024 19:22:46 GMT

Do you have capability to submit a support ticket so we can assist further on the validations?

ambigus9 — Fri, 22 Nov 2024 20:48:12 GMT

Currently I can't make a submit of a support ticket, I trying to submit

But I can't:

Walter_C — Mon, 25 Nov 2024 23:44:21 GMT

Can you share your workspace id so I can do a validation?

ambigus9 — Fri, 03 Jan 2025 13:48:16 GMT

Thanks for you help! Finally the solution was adjusting CNAME on ON-premise network.