topic Re: Azure Databricks DBFS Root, Storage Account Networking in Data Engineering

Azure Databricks DBFS Root, Storage Account Networking

sintsan — Thu, 20 Apr 2023 13:00:20 GMT

For an Azure Databricks with vnet injection, we would like to change the networking on the default managed Azure Databricks storage account (dbstorage) from Enabled from all networks to Enabled from selected virtual networks and IP addresses.

Can this be done and if not can you point to some docs describing how the managed storage account is secured?

Thanks!

Re: Azure Databricks DBFS Root, Storage Account Networking

karthik_p — Thu, 20 Apr 2023 16:54:23 GMT

@Sander Sintjorissen As far as i know storage config for azure is different from aws. but it looks in azure during workspace configuration encryption is enabled by default for your storage, if you want to have more security you can go with "Double Encryption for DBFS Root"

https://learn.microsoft.com/en-us/azure/databricks/security/keys/double-encryption

Re: Azure Databricks DBFS Root, Storage Account Networking

sintsan — Fri, 21 Apr 2023 04:03:29 GMT

@karthik p Thank you for your answer, although it does not really answer my question. Reading this post https://community.databricks.com/s/question/0D53f00001mFBAkCAO/network-security-for-dbfs-storage-account I understand the current workaround is to create another Azure SA and then redirect logs, etc to that account.

Is there any descriptive documentation on Azure Databricks as to what the impact of having Allow All in networking on DBFS Root actually is?

Thanks!

Re: Azure Databricks DBFS Root, Storage Account Networking

karthik_p — Tue, 25 Apr 2023 02:35:51 GMT

@Sander Sintjorissen usually root storage bucket has below directories present in article

https://learn.microsoft.com/en-us/azure/databricks/dbfs/root-locations

to store logs related to auditing you can create another storage and add that. hope this helps