jemena-shared-vpc-navigator

To configure Databricks Private Link in a shared VPC, you must deploy both Backend private endpoints for the cluster control plane and Frontend private endpoints for the user UI, ensuring traffic stays private across both planes.

Preventing cross-BU misconfigurations requires documenting strict ownership and modification permissions for shared VPC resources, ensuring teams only modify subnets and Route 53 records within their authorized scope during workspace provisioning.

Onboarding a new BU to a Databricks shared VPC involves using explicit coordination workflows and escalation paths to align with core-network and platform teams for subnet provisioning, Private Link setup, and DNS configuration across app-datahub-prod and nonprod accounts.

Databricks Private Link works with both VPN and Zscaler access, but requires different DNS workarounds and access patterns to ensure proper connectivity to the workspace frontend UI and backend control plane across the shared VPC.

Managing Route 53 DNS for Databricks Private Link across multiple AWS accounts presents challenges with cross-account PHZ association, resolver forwarding rules, and maintaining consistent DNS resolution strategies across app-datahub-prod and app-datahub-nonprod environments.

You should use a shared VPC architecture for Databricks provisioning when multiple business units require centralized network governance, standardized Private Link connectivity, and unified Route 53 DNS management to avoid fragmented network isolation.