Securing a Databricks deployment is a layered exercise: each layer covers a different threat surface — the network around the workspace, the identities that access it, the data within it, the detection signals that record activity, and the governance metadata that ties privilege to business intent. This landing page links the Databricks-specific deep dives that follow that same layering.
The diagram below shows the five layers of a Databricks security posture. Each layer maps to one or more dedicated pages.
Lock down inbound and outbound paths so workspace traffic never crosses the public internet. Customer-managed VPC injection, AWS PrivateLink for both front-end and back-end, and IP access lists keep the workspace reachable only from trusted networks.
Federate human identities with your IdP and use service principals for automation. Unity Catalog grants are issued to groups; SCIM keeps membership in sync.
Every byte at rest is encrypted; CMKs let you own the key material and revoke access independently of Databricks.
Capture every privileged action, ship it to a tamper-evident store, and write detection queries against the system tables.
Unity Catalog is the policy plane: it owns the privilege model, the securable hierarchy, lineage, and the tags that drive attribute-based access control.