IP addresses and domains for Databricks services and assets
This article lists IP addresses and domains for Databricks services and assets.
You may need the following information if:
-
You create your Databricks workspaces in your own VPC, a feature known as customer-managed VPC.
-
You use AWS PrivateLink within your Databricks network environment.
Databricks control plane addresses
The following tables list the IP addresses or domain names the Databricks control plane uses for each supported region. Port 443 is used for all addresses except for the SCC relay for PrivateLink, which uses Port 6666.
Inbound IPs to Databricks control plane
Databricks Region | Service | Public IP or domain name |
|---|---|---|
| Control plane services, including webapp | tokyo.cloud.databricks.com, 35.72.28.0/28 |
SCC relay | tunnel.ap-northeast-1.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.ap-northeast-1.cloud.databricks.com | |
| Control plane services, including webapp | seoul.cloud.databricks.com, 3.38.156.176/28 |
SCC relay | tunnel.ap-northeast-2.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.ap-northeast-2.cloud.databricks.com | |
| Control plane services, including webapp | mumbai.cloud.databricks.com, 65.0.37.64/28 |
SCC relay | tunnel.ap-south-1.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.ap-south-1.cloud.databricks.com | |
| Control plane services, including webapp | singapore.cloud.databricks.com, 13.214.1.96/28 |
SCC relay | tunnel.ap-southeast-1.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.ap-southeast-1.cloud.databricks.com | |
| Control plane services, including webapp | sydney.cloud.databricks.com, 3.26.4.0/28 |
SCC relay | tunnel.ap-southeast-2.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.ap-southeast-2.cloud.databricks.com | |
| Control plane services, including webapp | canada.cloud.databricks.com, 3.96.84.208/28 |
SCC relay | tunnel.ca-central-1.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.ca-central-1.cloud.databricks.com | |
| Control plane services, including webapp | frankfurt.cloud.databricks.com, 18.159.44.32/28 |
SCC relay | tunnel.eu-central-1.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.eu-central-1.cloud.databricks.com | |
| Control plane services, including webapp | ireland.cloud.databricks.com, 3.250.244.112/28 |
SCC relay | tunnel.eu-west-1.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.eu-west-1.cloud.databricks.com | |
| Control plane services, including webapp | london.cloud.databricks.com, 18.134.65.240/28 |
SCC relay | tunnel.eu-west-2.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.eu-west-2.cloud.databricks.com | |
| Control plane services, including webapp | paris.cloud.databricks.com, 13.39.141.128/28 |
SCC relay | tunnel.eu-west-3.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.eu-west-3.cloud.databricks.com | |
| Control plane services, including webapp | saopaulo.cloud.databricks.com, 15.229.120.16/28 |
SCC relay | tunnel.sa-east-1.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.sa-east-1.cloud.databricks.com | |
| Control plane services, including webapp | nvirginia.cloud.databricks.com, 3.237.73.224/28 |
SCC relay | tunnel.us-east-1.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.us-east-1.cloud.databricks.com | |
| Control plane services, including webapp | ohio.cloud.databricks.com, 3.128.237.208/28 |
SCC relay | tunnel.us-east-2.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.us-east-2.cloud.databricks.com | |
| Control plane services, including webapp | pendleton.cloud.databricks.us, 3.30.186.128/28 |
SCC relay | tunnel.us-gov-west-1.cloud.databricks.us | |
SCC relay for PrivateLink | tunnel.privatelink.us-gov-west-1.cloud.databricks.us | |
| Control plane services, including webapp | pendleton-dod.cloud.databricks.mil |
SCC relay | tunnel.us-gov-west-1dod.cloud.databricks.mil | |
SCC relay for PrivateLink | tunnel.privatelink.us-gov-west-1dod.cloud.databricks.mil | |
| Control plane services, including webapp | oregon.cloud.databricks.com, 44.234.192.32/28 |
SCC relay | tunnel.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.cloud.databricks.com | |
| Control plane services, including webapp | oregon.cloud.databricks.com, 44.234.192.32/28 |
SCC relay | tunnel.cloud.databricks.com | |
SCC relay for PrivateLink | tunnel.privatelink.cloud.databricks.com |
Outbound IPs from Databricks control plane
The following table list the outbound IP addresses or domain names the Databricks control plane uses for each supported region. Port 443 is used for all addresses except for the SCC relay for PrivateLink, which uses Port 6666.
Databricks Region | Service | Public IP or domain name |
|---|---|---|
| Control plane NAT IPs | 35.72.28.0/28, 18.177.16.95 |
VPC ID |
| |
| Control plane NAT IPs | 3.38.156.176/28, 54.180.50.119 |
VPC ID |
| |
| Control plane NAT IPs | 65.0.37.64/28, 13.232.248.161 |
VPC ID |
| |
| Control plane NAT IPs | 13.214.1.96/28, 13.213.212.4 |
VPC ID | vpc-01dcc0ded03337911 | |
| Control plane NAT IPs | 3.26.4.0/28, 13.237.96.217 |
VPC ID |
| |
| Control plane NAT IPs | 3.96.84.208/28, 35.183.59.105 |
VPC ID |
| |
| Control plane NAT IPs | 18.159.44.32/28, 18.159.32.64 |
VPC ID |
| |
| Control plane NAT IPs | 3.250.244.112/28, 46.137.47.49 |
VPC ID |
| |
| Control plane NAT IPs | 18.134.65.240/28,3.10.112.150 |
VPC ID |
| |
| Control plane NAT IPs | 13.39.141.128/28, 15.236.174.74 |
VPC ID |
| |
| Control plane NAT IPs | 15.229.120.16/28, 177.71.254.47 |
VPC ID |
| |
| Control plane NAT IPs | 3.237.73.224/28, 54.156.226.103 |
VPC ID |
| |
| Control plane NAT IPs | 3.128.237.208/28, 18.221.200.169 |
VPC ID |
| |
| Control plane NAT IPs | 3.30.186.128/28, 3.30.245.130 |
VPC ID |
| |
| Control plane NAT IPs | 44.234.192.32/28, 52.27.216.188 |
VPC ID | N/A | |
| Control plane NAT IPs | 44.234.192.32/28, 52.27.216.188 |
VPC ID |
|
Addresses for artifact storage, log storage, system tables, and shared datasets buckets
Databricks Region | Service | Public IP or domain name |
|---|---|---|
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket | N/A | |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket | N/A | |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
| |
| Artifact storage bucket |
|
Log storage bucket |
| |
System tables bucket |
| |
Shared datasets bucket |
|
S3 addresses
To add the global S3 bucket service to a route or allow list, use the following address and port, regardless of region: s3.amazonaws.com:443
For regional S3 buckets, AWS provides an address and port for a regional endpoint (s3.<region-name>.amazonaws.com:443). Databricks recommends that you use a VPC endpoint instead. Databricks uses VPC IDs for accessing S3 buckets in the same region as the Databricks control plane, and NAT IPs for accessing S3 buckets in different regions from the control plane. See (Recommended) Configure regional endpoints.
STS addresses
To add the global STS (AWS Security Token Service) to a route or allow list, use the following address and port, regardless of region: sts.amazonaws.com:443
For regional STS, AWS provides an address and port for a regional endpoint (sts.<region-name>.amazonaws.com:443), but Databricks recommends that you use a VPC endpoint instead. See (Recommended) Configure regional endpoints.
Kinesis addresses
For the Kinesis service, AWS provides addresses and ports for regional endpoints as shown in the table below. However, Databricks recommends that you use a VPC endpoint instead. See (Recommended) Configure regional endpoints.
VPC region | Address | Port |
|---|---|---|
| kinesis-fips.us-west-2.amazonaws.com | 443 |
All other regions | kinesis.<region-name>.amazonaws.com | 443 |
RDS addresses for legacy Hive metastore
To add the Amazon RDS services used by Databricks to a route or allow list, use the following addresses.
VPC region | Address | Port |
|---|---|---|
| mddx5a4bpbpm05.cfrfsun7mryq.ap-northeast-1.rds.amazonaws.com | 3306 |
| md1915a81ruxky5.cfomhrbro6gt.ap-northeast-2.rds.amazonaws.com | 3306 |
| mdjanpojt83v6j.c5jml0fhgver.ap-south-1.rds.amazonaws.com | 3306 |
| md1n4trqmokgnhr.csnrqwqko4ho.ap-southeast-1.rds.amazonaws.com | 3306 |
| mdnrak3rme5y1c.c5f38tyb1fdu.ap-southeast-2.rds.amazonaws.com | 3306 |
| md1w81rjeh9i4n5.co1tih5pqdrl.ca-central-1.rds.amazonaws.com | 3306 |
| mdv2llxgl8lou0.ceptxxgorjrc.eu-central-1.rds.amazonaws.com | 3306 |
| md15cf9e1wmjgny.cxg30ia2wqgj.eu-west-1.rds.amazonaws.com | 3306 |
| mdio2468d9025m.c6fvhwk6cqca.eu-west-2.rds.amazonaws.com | 3306 |
| metastorerds-dbconsolidationmetastore-asda4em2u6eg.c2ybp3dss6ua.eu-west-3.rds.amazonaws.com | 3306 |
| metastorerds-dbconsolidationmetastore-fqekf3pck8yw.cog1aduyg4im.sa-east-1.rds.amazonaws.com | 3306 |
| mdb7sywh50xhpr.chkweekm4xjq.us-east-1.rds.amazonaws.com | 3306 |
| md7wf1g369xf22.cluz8hwxjhb6.us-east-2.rds.amazonaws.com | 3306 |
| metastorerds-dbconsolidationmetastore-a62zjvlsjzzp.c40ji7ukhesx.us-gov-west-1.rds.amazonaws.com | 3306 |
| mdzsbtnvk0rnce.c13weuwubexq.us-west-1.rds.amazonaws.com | 3306 |
| mdpartyyphlhsp.caj77bnxuhme.us-west-2.rds.amazonaws.com | 3306 |
PrivateLink VPC endpoint services
To configure your workspace to use AWS PrivateLink, use the following table to determine your region’s VPC endpoint service domains. You can use any availability zone in your region.
The endpoint service identified as Workspace (including REST API) is used for both the front-end connection (user-to-workspace for web application and REST APIs) and the back-end connection (to connect to REST APIs). If you are implementing both front-end and back-end connections, use this same workspace VPC endpoint service for both use cases.
For more information, see Enable private connectivity using AWS PrivateLink.
Region | Create VPC endpoints to these regional VPC endpoint services |
|---|---|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| Workspace (including REST API):
Secure cluster connectivity relay:
|
| PrivateLink connectivity is not supported for this region. |
| Workspace (including REST API):
Secure cluster connectivity relay:
|