Configure IP access lists for workspaces
This article describes how to configure IP access lists for Azure Databricks workspaces. This article discusses the most common tasks you can perform with the Databricks CLI. You can also use the IP Access Lists API.
Requirements
This feature requires the Premium plan.
IP access lists support only Internet Protocol version 4 (IPv4) addresses.
If you enable secure cluster connectivity on a workspace, any public IPs that the compute plane uses to access the control plane must either be added to an allow list or you must configure configure back-end Private Link. Otherwise, classic compute resources cannot launch.
For example, if you enable secure cluster connectivity on a workspace that uses VNet Injection, Databricks recommends that your workspace has a stable egress public IP. That public IP and any others must be present in an allow list. See Egress IP addresses when using secure cluster connectivity. Alternatively, if you use an Azure Databricks-managed VNet and you configure the managed NAT gateway to access public IPs, those IPs must be present in an allow list. For more information, see the Databricks Community post.
Check if your workspace has the IP access list feature enabled
To check if your workspace has the IP access list feature enabled:
databricks workspace-conf get-status enableIpAccessLists
Enable or disable the IP access list feature for a workspace
In a JSON request body, specify enableIpAccessLists
as true
(enabled) or false
(disabled).
databricks workspace-conf set-status --json '{
"enableIpAccessLists": "true"
}'
Add an IP access list
When the IP access lists feature is enabled and there are no allow lists or block lists for the workspace, all IP addresses are allowed. Adding IP addresses to the allow list blocks all IP addresses that are not on the list. Ensure to add any public IPs that the compute plane uses to access the control plane to an allow list. Review the changes carefully to avoid unintended access restrictions.
IP access lists have a label, which is a name for the list, and a list type. The list type is either ALLOW
(allow list) or BLOCK
(a block list, which means exclude even if in allow list).
For example, to add an allow list:
databricks ip-access-lists create --json '{
"label": "office",
"list_type": "ALLOW",
"ip_addresses": [
"1.1.1.1"
]
}'
List IP access lists
databricks ip-access-lists list
Update an IP access list
Specify at least one of the following values to update:
label
— Label for this list.list_type
— EitherALLOW
(allow list) orBLOCK
(block list, which means exclude even if in allow list).ip_addresses
— A JSON array of IP addresses and CIDR ranges, as String values.enabled
— Specifies whether this list is enabled. Passtrue
orfalse
.
The response is a copy of the object that you passed in with additional fields for the ID and modification dates.
For example, to disable a list:
databricks ip-access-lists update <list-id> --json '{
"enabled": "false"
}'
Delete an IP access list
To delete an IP access:
databricks ip-access-lists delete <list-id>