cancel
Showing results for 
Search instead for 
Did you mean: 
Get Started Discussions
cancel
Showing results for 
Search instead for 
Did you mean: 

Infrastructure question

horatiug
New Contributor III

We've noticed that the GKE worker nodes which are automatically created when Databricks workspace is created inside GCP project are using the default compute engine SA which's not the best security approach, even Google doesn't recommend using default resources inside production environments. Is there any option when creating the workspace to avoid using the Google default service account ?

2 REPLIES 2

Kaniz
Community Manager
Community Manager

Hi @horatiugthere is an option to avoid using the default service account when creating a Databricks workspace in a GCP project. You can create your workspaces in an existing customer-managed Virtual Private Cloud (VPC) that you make in your account. This allows you to exercise more control over your network configurations to comply with specific cloud security and governance standards that your organization may require. While creating a workspace, Databricks makes a service account and grants a role with the permissions needed to manage your workspace. If your workspace uses a customer-managed VPC, it does not need as many permissions. The part that Databricks creates omits permissions such as creating, updating, and deleting objects such as networks, routers, and subnets. 

Please note that you must specify the customer-managed VPC when you create the workspace through the account console. You cannot move an existing workspace with a Databricks-managed VPC to your own VPC.

Also, you cannot change which customer-managed VPC the workspace uses after workspace creation.

horatiug
New Contributor III

Hi @Kaniz 

we are already using custom VPC but the service account used is the the default compute engine. Expectation from our security team would be that when deploying the workspace a new SA is created in the project with required rights and not using the default compute engine SA.  

Welcome to Databricks Community: Lets learn, network and celebrate together

Join our fast-growing data practitioner and expert community of 80K+ members, ready to discover, help and collaborate together while making meaningful connections. 

Click here to register and join today! 

Engage in exciting technical discussions, join a group with your peers and meet our Featured Members.