PrivateLink Validation Error - When trying to access to Workspace

[ambigus9]

We have a workspace that had been deployed on AWS customer architecture using Terraform privatelink: https://registry.terraform.io/providers/databricks/databricks/latest/docs/guides/aws-private-link-wo...

The fact is when we disable the Public Access:

We are getting "login.html?error=private-link-validation-error"

We have the security group of Data Plane and Workspace configured as follows:

Data Plane Security Group - Inbound Rules:

Data Plane Security Group - Outbound Rules:

Workspaces Security Group - Inbound Rules:

Workspaces Security Group - Outbound Rules:

Any help will be appreciated

[Walter_C]

If you create a VM inside the same VPC of your workspace are you able to access the workspace? Also have you granted access to all the ports as provided in docs https://docs.databricks.com/en/security/network/classic/privatelink.html#step-1-configure-aws-networ... 

[ambigus9]

We created a Windows VM inside the same VPC and we can access to the workspace. But, testing with the On-premise of our client network doesn't work.

The ports are configured as docs:

We validated for the Network ACLs and we have this configuration:

[Walter_C]

Have you created the Direct Connect set up for the on prem network:

• To establish a front-end PrivateLink connection for accessing the workspace from your on-premises network, connect your on-premises network to an AWS VPC using Direct Connect or VPN.

• Also have you checked the DNS set up for Private Link: https://docs.databricks.com/en/security/network/classic/privatelink.html#step-5-configure-internal-d... 

[ambigus9]

We created a record A on AWS Route53 an the redirection works, However, now we have a warning due to SSL certificates. We configure as follows:

Record type	Record Name	Value
A	databricks.my_website.com	10.0.0.1,10.0.0.2

Aditionally, How we can register a CNAME using the cloud.databricks.com domain?

According to the docs we must setup as follows: 

Record type	Record Name	Value
CNAME	dbc-01abcd23-4b0e.cloud.databricks.com	databricks.my_website.com

However, we only can take the hosted zone on Route53:

Record type	Record Name	Value
CNAME	dbc-01abcd23-4b0e.my_website.com	databricks.my_website.com

Thanks for your help!

[Walter_C]

Do you have capability to submit a support ticket so we can assist further on the validations?

[ambigus9]

Currently I can't make a submit of a support ticket, I trying to submit

But I can't:

[Walter_C]

Can you share your workspace id so I can do a validation?

[ambigus9]

Thanks for you help! Finally the solution was adjusting CNAME on ON-premise network.