https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/ba-p/70061 <P><STRONG>IMPORTANT NOTE: We have indefinitely delayed the automatic enforcement described below for workspaces that had enabled workspace IP access lists prior to July 29, 2024. We still recommend manually enforcing IP access lists on compute plane requests in these workspaces by taking the steps outlined below.&nbsp;</STRONG></P> <P><STRONG>Note: New IP access controls enabled on workspaces after July 29, 2024 are still enforced on data plane traffic, per the original communication below.</STRONG></P> <H2><SPAN>---------------------------------</SPAN></H2> <H2><SPAN>Communication</SPAN></H2> <P><SPAN>To enhance security, we are making a change to workspaces that use the </SPAN><A href="https://docs.databricks.com/en/security/network/front-end/ip-access-list.html" target="_blank" rel="noopener"><SPAN>workspace IP access lists</SPAN></A><SPAN> feature. For these workspaces, we will begin to apply workspace IP access controls to compute plane traffic. See </SPAN><I><SPAN>Action Required</SPAN></I><SPAN> and </SPAN><I><SPAN>Timeline</SPAN></I><SPAN> below for details.</SPAN></P> <P><STRONG>Action Required</STRONG></P> <P><SPAN>This change will impact all new workspaces on July 29 2024, and existing workspaces on August 26 2024.&nbsp;</SPAN></P> <P><SPAN>To ensure your compute plane can continue to talk to the Databricks control plane - take action to add the </SPAN><A href="https://docs.aws.amazon.com/appstream2/latest/developerguide/add-nat-gateway-existing-vpc.html" target="_blank" rel="noopener"><SPAN>NAT gateway</SPAN></A><SPAN> IP addresses to your </SPAN><A href="https://docs.databricks.com/en/security/network/front-end/ip-access-list-workspace.html" target="_blank" rel="noopener"><SPAN>workspace IP access list</SPAN></A><SPAN>. Step-by-step instructions are available below.</SPAN></P> <P><STRONG>Timeline</STRONG></P> <P><SPAN>The required actions must be taken by the following dates:</SPAN></P> <UL> <LI style="font-weight: 400;" aria-level="1"><SPAN>Starting on July 29 2024, </SPAN><STRONG>all new workspaces</STRONG><SPAN> that use </SPAN><A href="https://docs.databricks.com/en/security/network/front-end/ip-access-list.html" target="_blank" rel="noopener"><SPAN>workspace IP access lists</SPAN></A><SPAN> will begin enforcing workspace IP access lists on compute plane traffic</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN>By August 26 2024, </SPAN><STRONG>all existing workspaces</STRONG><SPAN> that use </SPAN><A href="https://docs.databricks.com/en/security/network/front-end/ip-access-list.html" target="_blank" rel="noopener"><SPAN>workspace IP access lists</SPAN></A><SPAN> will begin enforcing workspace IP access lists on compute plane traffic</SPAN></LI> </UL> <H2><SPAN>Step-by-Step Instructions</SPAN></H2> <P><SPAN>Note: If your compute plane traffic egresses through a firewall/proxy appliance, ensure that the IPs of the appliance are added to the workspace IP ACL policy. If it does not, read on for NAT gateway deployment.</SPAN></P> <OL> <LI style="font-weight: 400;" aria-level="1"><SPAN>Retrieve IPs for the NAT gateway (via AWS console)</SPAN></LI> <OL> <LI style="font-weight: 400;" aria-level="2"><SPAN>Find your NAT gateway in</SPAN><SPAN><BR /></SPAN><SPAN>https://&lt;REGION&gt;</SPAN><A href="http://.console.aws.amazon.com/vpcconsole/home?region=" target="_blank" rel="noopener"><SPAN>.console.aws.amazon.com/vpcconsole/home?region=</SPAN></A><SPAN>&lt;REGION&gt;#NatGateways:</SPAN><SPAN><BR /></SPAN><SPAN>You can identify the NAT gateway by filtering by your compute plane VPC ID.</SPAN></LI> <LI style="font-weight: 400;" aria-level="2"><SPAN>Note down "Primary public IPv4 address". That is your public IP of your NAT gateway.</SPAN></LI> </OL> <LI style="font-weight: 400;" aria-level="1"><SPAN>Adding the NAT Gateway IP addresses to the workspace IP access list</SPAN></LI> <OL> <LI style="font-weight: 400;" aria-level="2"><SPAN>Follow the steps outlined here to add the IP addresses for the NAT gateways collected above to your workspace IP ACL policy: </SPAN><SPAN><BR /></SPAN><A href="https://docs.databricks.com/en/security/network/front-end/ip-access-list-workspace.html" target="_blank" rel="noopener"><SPAN>https://docs.databricks.com/en/security/network/front-end/ip-access-list-workspace.html</SPAN></A></LI> </OL> <LI style="font-weight: 400;" aria-level="1"><SPAN>Test that your deployment was successful&nbsp;</SPAN></LI> <OL> <LI style="font-weight: 400;" aria-level="2"><SPAN>Log in to your workspace</SPAN></LI> <LI style="font-weight: 400;" aria-level="2"><SPAN>Navigate to "Preview" &gt; "View All"&nbsp;</SPAN></LI> <LI style="font-weight: 400;" aria-level="2"><SPAN>Find "Enforce IP access list on Compute Plane Requests". On toggle on, IP ACL will be enforced on your NAT IP</SPAN></LI> <LI style="font-weight: 400;" aria-level="2"><SPAN>Wait for up to 10 minutes for the config to be applied to the workspace.</SPAN></LI> <LI style="font-weight: 400;" aria-level="2"><SPAN>Create and run a python notebook with a new cluster of any type except serverless.</SPAN><BR /> <P><SPAN>Cell #1&nbsp;</SPAN></P> <PRE class="lia-code-sample language-markup"><CODE>%pip install databricks-sdk --upgrade dbutils.library.restartPython() </CODE></PRE> <P><SPAN>Cell #2</SPAN></P> <PRE class="lia-code-sample language-markup"><CODE>from databricks.sdk import WorkspaceClient w = WorkspaceClient() w.clusters.list() </CODE></PRE> <SPAN>If the code sample works, then your IP access list is set up correctly.</SPAN></LI> <LI style="font-weight: 400;" aria-level="2"><SPAN>In case of failures, toggle off "Enforce IP access list on Compute Plane Requests". Wait for up to 10 minutes for the config to be applied to the workspace.</SPAN></LI> </OL> </OL> Wed, 16 Oct 2024 16:38:07 GMT AlexEsibov 2024-10-16T16:38:07Z https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/ba-p/70061 <P><SPAN>The following blog post details action required for workspaces that use workspace IP access lists.&nbsp;</SPAN><STRONG>The communication will also be sent out by email to users who Databricks determines might be affected.</STRONG></P> Wed, 16 Oct 2024 16:38:07 GMT https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/ba-p/70061 AlexEsibov 2024-10-16T16:38:07Z https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/71070#M19 <P>We are not using NAT gateway and using Enterprise proxy for the compute resources. What is the solution for our case?</P> Thu, 30 May 2024 04:56:34 GMT https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/71070#M19 SathwickKollipa 2024-05-30T04:56:34Z https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/71119#M20 <P><a href="https://community.databricks.com/t5/user/viewprofilepage/user-id/341">@SathwickKollipa</a>&nbsp;&nbsp;thanks for the question. You should allow the public IPs that are used for outbound traffic for your Databricks classic compute plane. If this goes through a proxy that obfuscates the IPs, then it makes sense to use the public IPs of that proxy.</P> Thu, 30 May 2024 21:21:38 GMT https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/71119#M20 AlexEsibov 2024-05-30T21:21:38Z https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/72015#M25 <P><a href="https://community.databricks.com/t5/user/viewprofilepage/user-id/89926">@AlexEsibov</a>&nbsp;, we don't allow any outbound traffic from our VPC/subnets. By default, any cluster's we spin up don't have ability to talk to internet. If it needs internet connectivity, we set proxy thru init script of the cluster.&nbsp;</P><P>In route table, the traffic for internet is routed to TGW and from their it routes to proxy. How does it works in our case?</P> Fri, 07 Jun 2024 09:25:52 GMT https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/72015#M25 SathwickKollipa 2024-06-07T09:25:52Z https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/73071#M27 <P>we don't use the NAT Gateway IP at our VPC level which using customer managed VPC for the Databricks. we use the IP whitelisting in our environment , do we still needs to whitelist anything? or not required?&nbsp;</P> Wed, 12 Jun 2024 19:59:16 GMT https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/73071#M27 krikotti 2024-06-12T19:59:16Z https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/74520#M28 <P>Hi&nbsp;<a href="https://community.databricks.com/t5/user/viewprofilepage/user-id/89926">@AlexEsibov</a>&nbsp; Does this apply to Premium Tier?</P><P>As in the fix it says need to be in Enterprise Pricing tier.</P> Mon, 17 Jun 2024 01:37:02 GMT https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/74520#M28 sactom 2024-06-17T01:37:02Z https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/74910#M30 <P><a href="https://community.databricks.com/t5/user/viewprofilepage/user-id/341">@SathwickKollipa</a>&nbsp;if I understood your set-up correctly, all compute plane traffic will egress through proxy before hitting the control plane. In this case, allow-listing the IPs of the proxy in the workspace IP ACL should be sufficient.&nbsp;</P> <P><a href="https://community.databricks.com/t5/user/viewprofilepage/user-id/99490">@krikotti</a>&nbsp;can you clarify what you mean by "IP whitelisting in our environment"?</P> <P>&nbsp;</P> <P><a href="https://community.databricks.com/t5/user/viewprofilepage/user-id/108670">@sactom</a>&nbsp;the workspace IP ACL list is available on the enterprise license tier, so this comm is not applicable to customers using the premium tier.</P> <P>&nbsp;</P> Tue, 18 Jun 2024 22:53:06 GMT https://community.databricks.com/t5/product-platform-updates/action-required-aws-update-outbound-connectivity-for-classic/bc-p/74910#M30 AlexEsibov 2024-06-18T22:53:06Z