Back to Checks
azure

Databricks workspace has public network access disabled

databricks_workspace_public_network_access_disabled
Service: databricksSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:microsoft.databricks/workspaces

Azure Databricks workspaces are evaluated for public network access. Disabling public network access ensures the workspace is only reachable through private endpoints, reducing the attack surface and preventing direct exposure of the control plane and data plane to the internet.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing public network access exposes the Databricks workspace control plane and data plane to the internet. Combined with leaked credentials, personal access tokens, or unpatched vulnerabilities, this enables unauthorized access, brute force, and data exfiltration from any source on the internet.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks databricks_workspace_public_network_access_disabled

Recommendation

Disable public network access on Databricks workspaces and require connectivity via Azure Private Link private endpoints. Before enforcement, validate that all application workloads have private-network connectivity, and pair this control with VNet injection, secure cluster connectivity (no public IP), and least-privilege access to uphold defense in depth.

Remediation

CLI

az databricks workspace update --name <workspace_name> --resource-group <resource_group_name> --public-network-access Disabled

Terraform

# Terraform: Disable public network access on a Databricks workspace
resource "azurerm_databricks_workspace" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<region>"
  sku                 = "premium"

  public_network_access_enabled = false # CRITICAL: Blocks all public-internet traffic to the workspace
}

NativeIaC

// Bicep: Disable public network access on a Databricks workspace
resource workspace 'Microsoft.Databricks/workspaces@2023-02-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  sku: {
    name: 'premium'
  }
  properties: {
    managedResourceGroupId: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>'
    publicNetworkAccess: 'Disabled' // CRITICAL: Blocks all public-internet traffic to the workspace
  }
}

Other

1Sign in to the Azure portal and open your Databricks workspace
2In the left menu, select Networking
3Under Public network access, select Disabled
4Configure Azure Private Link private endpoints before saving so clients retain connectivity
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.databricks.databricks_client import (
    databricks_client,
)


class databricks_workspace_public_network_access_disabled(Check):
    """
    Ensure Azure Databricks workspaces have public network access disabled.

    This check evaluates whether each Azure Databricks workspace in the subscription restricts connectivity to private endpoints by disabling public network access.

    - PASS: The workspace has public network access disabled (public_network_access is "Disabled").
    - FAIL: The workspace has public network access enabled (or the value is not set).
    """

    def execute(self):
        findings = []
        for subscription, workspaces in databricks_client.workspaces.items():
            subscription_name = databricks_client.subscriptions.get(
                subscription, subscription
            )
            for workspace in workspaces.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=workspace
                )
                report.subscription = subscription
                if workspace.public_network_access == "Disabled":
                    report.status = "PASS"
                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) has public network access disabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) has public network access enabled."
                findings.append(report)
        return findings

References