@nsingh_tl
Unauthorized network access to workspace 403 error is generally a network layer block, not an IAM or permissions issue. When you are running a customer-managed VPC with back end PrivateLink, Unity Catalog needs to connect to the Databricks regional hostname rather than the specific workspace URL. The underlying issue here is likely that the VPC endpoint's Private DNS names option isn't enabled on the AWS side. When that is disabled, the regional hostname resolves to a public IP instead of routing through the private VPC endpoint. If the VPC is fully private and lacks a NAT gateway, that connection drops and throws 403 error. To isolate and fix this, you can check the AWS Console under VPC - Endpoints, open the Databricks workspace VPC endpoint, and verify that Private DNS names enabled is set to Yes. VPC must have both enableDnsSupport and enableDnsHostnames set to true.
If its already configured, confirm the account-level network policy in Databricks. If it is set to Restricted Access mode, it governs serverless compute egress and denies all outbound traffic by default except for Unity Catalog external locations and explicitly allow listed FQDNs or S3 buckets. Ask the account admin to check it in the Security - Networking - Context-based ingress & egress control. You can switch the policy to Full Access or manually add the required destinations in the allowed list.
Ensure that the Unity Catalog metastore is attached to this specific workspace (Account Console - Workspaces - check the Metastore). Ensure the workspace has the UC mapped and attached.
The pipelines rely on Unity Catalog for governance, and you won't be able to ingest your Oracle data or build out that silver layer until this is resolved. You can check the AWS-side VPC endpoint Private DNS, followed by the Databricks-side network policy and metastore attachment. If the 403 persists after fixing all sides, you can check with databricks support.
