network_policies

Creates, updates, deletes, gets or lists a network_policies resource.

Overview

Name	network_policies
Type	Resource
Id	databricks_account.settings.network_policies

Fields

The following fields are returned by SELECT queries:

get_network_policy_rpc

Name	Datatype	Description
account_id	string
network_policy_id	string	The unique identifier for the network policy.
▶egress	object	The network policies applying for egress traffic.
▶ingress	object	The network policies applying for ingress traffic.
▶ingress_dry_run	object	The ingress policy for dry run mode. Dry run will always run even if the request is allowed by the ingress policy. When this field is set, the policy will be evaluated and emit logs only without blocking requests.

list_network_policies_rpc

Name	Datatype	Description
account_id	string
network_policy_id	string	The unique identifier for the network policy.
▶egress	object	The network policies applying for egress traffic.
▶ingress	object	The network policies applying for ingress traffic.
▶ingress_dry_run	object	The ingress policy for dry run mode. Dry run will always run even if the request is allowed by the ingress policy. When this field is set, the policy will be evaluated and emit logs only without blocking requests.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_network_policy_rpc	select	account_id, network_policy_id, account_host		Gets a network policy.
list_network_policies_rpc	select	account_id, account_host	page_token	Gets an array of network policies.
create_network_policy_rpc	insert	account_id, account_host		Creates a new network policy to manage which network destinations can be accessed from the Databricks
update_network_policy_rpc	replace	account_id, network_policy_id, account_host		Updates a network policy. This allows you to modify the configuration of a network policy.
delete_network_policy_rpc	delete	account_id, network_policy_id, account_host		Deletes a network policy. Cannot be called on 'default-policy'.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
account_host	string	The Databricks account console host. Selected by DATABRICKS_CLOUD (aws, azure or gcp; default aws), or set explicitly with DATABRICKS_ACCOUNT_HOST (bare host, no scheme). (default: accounts.cloud.databricks.com, x-stackQL-envVar: DATABRICKS_ACCOUNT_HOST, x-stackQL-envVarSelector: {"envVar":"DATABRICKS_CLOUD","default":"aws","values":{"aws":"accounts.cloud.databricks.com","azure":"accounts.azuredatabricks.net","gcp":"accounts.gcp.databricks.com"}})
account_id	string
network_policy_id	string	The unique identifier of the network policy to delete.
page_token	string	Pagination token to go to next page based on previous query.

SELECT examples

get_network_policy_rpc

Gets a network policy.

SELECT
account_id,
network_policy_id,
egress,
ingress,
ingress_dry_run
FROM databricks_account.settings.network_policies
WHERE account_id = '{{ account_id }}' -- required
AND network_policy_id = '{{ network_policy_id }}' -- required
AND account_host = '{{ account_host }}' -- required
;

list_network_policies_rpc

Gets an array of network policies.

SELECT
account_id,
network_policy_id,
egress,
ingress,
ingress_dry_run
FROM databricks_account.settings.network_policies
WHERE account_id = '{{ account_id }}' -- required
AND account_host = '{{ account_host }}' -- required
AND page_token = '{{ page_token }}'
;

INSERT examples

create_network_policy_rpc

Creates a new network policy to manage which network destinations can be accessed from the Databricks

INSERT INTO databricks_account.settings.network_policies (
account_id,
egress,
ingress,
ingress_dry_run,
network_policy_id,
account_id,
account_host
)
SELECT 
'{{ account_id }}',
'{{ egress }}',
'{{ ingress }}',
'{{ ingress_dry_run }}',
'{{ network_policy_id }}',
'{{ account_id }}',
'{{ account_host }}'
RETURNING
account_id,
network_policy_id,
egress,
ingress,
ingress_dry_run
;

Manifest

# Description fields are for documentation purposes
- name: network_policies
props:
  - name: account_id
    value: "{{ account_id }}"
    description: Required parameter for the network_policies resource.
  - name: account_host
    value: "{{ account_host }}"
    description: Required parameter for the network_policies resource.
  - name: account_id
    value: "{{ account_id }}"
  - name: egress
    description: |
      The network policies applying for egress traffic.
    value:
      network_access:
        restriction_mode: "{{ restriction_mode }}"
        allowed_databricks_destinations:
          - workspace_ids: "{{ workspace_ids }}"
        allowed_internet_destinations:
          - destination: "{{ destination }}"
            internet_destination_type: "{{ internet_destination_type }}"
        allowed_storage_destinations:
          - azure_storage_account: "{{ azure_storage_account }}"
            azure_storage_service: "{{ azure_storage_service }}"
            bucket_name: "{{ bucket_name }}"
            region: "{{ region }}"
            storage_destination_type: "{{ storage_destination_type }}"
        blocked_internet_destinations:
          - destination: "{{ destination }}"
            internet_destination_type: "{{ internet_destination_type }}"
        policy_enforcement:
          dry_run_mode_product_filter:
            - "{{ dry_run_mode_product_filter }}"
          enforcement_mode: "{{ enforcement_mode }}"
  - name: ingress
    description: |
      The network policies applying for ingress traffic.
    value:
      cross_workspace_access:
        restriction_mode: "{{ restriction_mode }}"
        allow_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_source_workspaces: {{ all_source_workspaces }}
              selected_workspaces:
                workspace_ids: "{{ workspace_ids }}"
        deny_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_source_workspaces: {{ all_source_workspaces }}
              selected_workspaces:
                workspace_ids: "{{ workspace_ids }}"
      private_access:
        restriction_mode: "{{ restriction_mode }}"
        allow_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_private_access: {{ all_private_access }}
              all_registered_endpoints: {{ all_registered_endpoints }}
              azure_workspace_private_link: {{ azure_workspace_private_link }}
              endpoints:
                endpoint_ids: "{{ endpoint_ids }}"
        deny_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_private_access: {{ all_private_access }}
              all_registered_endpoints: {{ all_registered_endpoints }}
              azure_workspace_private_link: {{ azure_workspace_private_link }}
              endpoints:
                endpoint_ids: "{{ endpoint_ids }}"
      public_access:
        restriction_mode: "{{ restriction_mode }}"
        allow_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_ip_ranges: {{ all_ip_ranges }}
              excluded_ip_ranges:
                ip_ranges: "{{ ip_ranges }}"
              included_ip_ranges:
                ip_ranges: "{{ ip_ranges }}"
        deny_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_ip_ranges: {{ all_ip_ranges }}
              excluded_ip_ranges:
                ip_ranges: "{{ ip_ranges }}"
              included_ip_ranges:
                ip_ranges: "{{ ip_ranges }}"
  - name: ingress_dry_run
    description: |
      The ingress policy for dry run mode. Dry run will always run even if the request is allowed by the ingress policy. When this field is set, the policy will be evaluated and emit logs only without blocking requests.
    value:
      cross_workspace_access:
        restriction_mode: "{{ restriction_mode }}"
        allow_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_source_workspaces: {{ all_source_workspaces }}
              selected_workspaces:
                workspace_ids: "{{ workspace_ids }}"
        deny_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_source_workspaces: {{ all_source_workspaces }}
              selected_workspaces:
                workspace_ids: "{{ workspace_ids }}"
      private_access:
        restriction_mode: "{{ restriction_mode }}"
        allow_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_private_access: {{ all_private_access }}
              all_registered_endpoints: {{ all_registered_endpoints }}
              azure_workspace_private_link: {{ azure_workspace_private_link }}
              endpoints:
                endpoint_ids: "{{ endpoint_ids }}"
        deny_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_private_access: {{ all_private_access }}
              all_registered_endpoints: {{ all_registered_endpoints }}
              azure_workspace_private_link: {{ azure_workspace_private_link }}
              endpoints:
                endpoint_ids: "{{ endpoint_ids }}"
      public_access:
        restriction_mode: "{{ restriction_mode }}"
        allow_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_ip_ranges: {{ all_ip_ranges }}
              excluded_ip_ranges:
                ip_ranges: "{{ ip_ranges }}"
              included_ip_ranges:
                ip_ranges: "{{ ip_ranges }}"
        deny_rules:
          - authentication:
              identities:
                - principal_id: {{ principal_id }}
                  principal_type: "{{ principal_type }}"
              identity_type: "{{ identity_type }}"
            destination:
              account_api:
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              account_databricks_one:
                all_destinations: {{ all_destinations }}
              account_ui:
                all_destinations: {{ all_destinations }}
              all_destinations: {{ all_destinations }}
              apps_runtime:
                all_destinations: {{ all_destinations }}
              lakebase_runtime:
                all_destinations: {{ all_destinations }}
              workspace_api:
                excluded_scopes: "{{ excluded_scopes }}"
                scope_qualifier: "{{ scope_qualifier }}"
                scopes: "{{ scopes }}"
              workspace_ui:
                all_destinations: {{ all_destinations }}
            label: "{{ label }}"
            origin:
              all_ip_ranges: {{ all_ip_ranges }}
              excluded_ip_ranges:
                ip_ranges: "{{ ip_ranges }}"
              included_ip_ranges:
                ip_ranges: "{{ ip_ranges }}"
  - name: network_policy_id
    value: "{{ network_policy_id }}"
    description: |
      The unique identifier for the network policy.

REPLACE examples

update_network_policy_rpc

Updates a network policy. This allows you to modify the configuration of a network policy.

REPLACE databricks_account.settings.network_policies
SET 
account_id = '{{ account_id }}',
egress = '{{ egress }}',
ingress = '{{ ingress }}',
ingress_dry_run = '{{ ingress_dry_run }}',
network_policy_id = '{{ network_policy_id }}'
WHERE 
account_id = '{{ account_id }}' --required
AND network_policy_id = '{{ network_policy_id }}' --required
AND account_host = '{{ account_host }}' --required
RETURNING
account_id,
network_policy_id,
egress,
ingress,
ingress_dry_run;

DELETE examples

delete_network_policy_rpc

Deletes a network policy. Cannot be called on 'default-policy'.

DELETE FROM databricks_account.settings.network_policies
WHERE account_id = '{{ account_id }}' --required
AND network_policy_id = '{{ network_policy_id }}' --required
AND account_host = '{{ account_host }}' --required
;