Back to Checks
azure

Databricks workspace is deployed in a customer-managed VNet (VNet Injection enabled)

databricks_workspace_vnet_injection_enabled
Service: databricksSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:microsoft.databricks/workspaces

Azure Databricks workspaces using VNet injection are placed in a customer-managed VNet rather than a Databricks-managed network. This evaluates whether a workspace is linked to a customer VNet.

Prowler logoProwlerprowler-provider-azure

Risk

Using a Databricks-managed VNet limits control over routing, egress, and access boundaries, degrading confidentiality and integrity.

  • Unrestricted outbound paths enable data exfiltration
  • Harder to enforce private endpoints and NSG policies
  • Increased chance of lateral movement into compute nodes

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks databricks_workspace_vnet_injection_enabled

Recommendation

Deploy workspaces in a customer-managed VNet and apply defense in depth:

  • Enforce egress control with firewalls/NAT and UDRs
  • Prefer private endpoints to public access
  • Apply least privilege NSG rules and segregate subnets
  • Use DNS controls and monitoring to detect anomalies

Remediation

CLI

az databricks workspace create --name <workspace_name> --resource-group <resource_group_name> --location <region> --sku premium --vnet /subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.Network/virtualNetworks/<vnet_name> --public-subnet <public_subnet_name> --private-subnet <private_subnet_name>

Terraform

# Azure Databricks workspace with VNet injection
resource "azurerm_databricks_workspace" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<region>"
  sku                 = "premium"

  custom_parameters {
    virtual_network_id  = "/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>/providers/Microsoft.Network/virtualNetworks/<example_resource_name>" # CRITICAL: Enables VNet injection by using your VNet
    public_subnet_name  = "<example_resource_name>-public"   # Required: host (public) subnet
    private_subnet_name = "<example_resource_name>-private"  # Required: container (private) subnet
  }
}

NativeIaC

// Azure Databricks workspace with VNet injection enabled
resource databricks 'Microsoft.Databricks/workspaces@2023-02-01-preview' = {
  name: '<example_resource_name>'
  location: '<region>'
  sku: { name: 'premium' }
  properties: {
    managedResourceGroupId: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>'
    parameters: {
      customVirtualNetworkId: { // CRITICAL: Enables VNet injection by attaching your VNet
        value: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>/providers/Microsoft.Network/virtualNetworks/<example_resource_name>'
      }
      customPublicSubnetName: { value: '<example_resource_name>-public' } // Required: host (public) subnet name
      customPrivateSubnetName: { value: '<example_resource_name>-private' } // Required: container (private) subnet name
    }
  }
}

Other

1In the Azure Portal, go to Create a resource > Azure Databricks
2On Basics, enter workspace name, region, and resource group
3Open the Networking tab and select Your VNet (VNet injection)
4Choose your Virtual network and select the Host (public) and Container (private) subnets
5Click Review + create, then Create
6Migrate workloads to this workspace and delete the non-VNet workspace if no longer needed

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.databricks.databricks_client import (
    databricks_client,
)


class databricks_workspace_vnet_injection_enabled(Check):
    """
    Ensure Azure Databricks workspaces are deployed in a customer-managed VNet (VNet Injection).

    This check evaluates whether each Azure Databricks workspace in the subscription is configured to use VNet Injection, meaning it is deployed in a customer-managed virtual network (VNet).

    - PASS: The workspace is deployed in a customer-managed VNet (custom_managed_vnet_id is set).
    - FAIL: The workspace is not deployed in a customer-managed VNet (VNet Injection is not enabled).
    """

    def execute(self):
        findings = []
        for subscription, workspaces in databricks_client.workspaces.items():
            subscription_name = databricks_client.subscriptions.get(
                subscription, subscription
            )
            for workspace in workspaces.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=workspace
                )
                report.subscription = subscription
                if workspace.custom_managed_vnet_id:
                    report.status = "PASS"
                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) is deployed in a customer-managed VNet ({workspace.custom_managed_vnet_id})."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) is not deployed in a customer-managed VNet (VNet Injection is not enabled)."
                findings.append(report)
        return findings

References