Setup PrivateLink for Databricks Unity Catalog Connector¶
Applies to Trust3AI Cloud connectors only
This page applies only to connectors that run entirely inside Trust3AI Cloud — where Trust3 hosts and operates the connector for you. If your connector runs in your own Kubernetes cluster (Self-Managed or runtime plane in your account), private connectivity is configured in your own network and this page does not apply.
Overview¶
By default, the Trust3 Databricks Unity Catalog connector reaches your workspace over its public endpoint. With AWS PrivateLink, that traffic stays inside AWS private networking and never traverses the public internet.
This requires a Databricks workspace on AWS.
Trust3 provisions and operates all AWS networking on its side. Your part is the steps below, in your Databricks account.
This page covers PrivateLink setup only
These steps establish the private network path. They do not create or configure the connector itself. Once PrivateLink is active, continue to the Databricks Unity Catalog connector documentation to set it up.
Step 1: Request PrivateLink from Trust3¶
Follow How to Get Support to raise a ticket, and include:
| Item | Description |
|---|---|
| Connector type | Databricks Unity Catalog |
| Your Trust3 account ID | Shown in the profile menu at the top right of the Trust3 portal |
| Workspace URL | The workspace URL you want to configure with the Trust3 connector, e.g. yourworkspace.cloud.databricks.com |
| AWS region | The region your workspace runs in, e.g. us-west-2 |
Step 2: Receive the VPC endpoint ID from Trust3¶
Trust3 creates a VPC interface endpoint for your workspace region and shares the VPC endpoint ID (vpce-…) with you on the ticket.
Step 3: Authorize the endpoint in your Databricks account console¶
As a Databricks account admin, follow Databricks' own Enable private connectivity using AWS PrivateLink documentation to:
- Register the VPC endpoint from Step 2.
- Create a private access settings object and attach it to your workspace.
Both parts are required. Registering the endpoint alone does not enable private connectivity — the private access settings object attached to the workspace is what does.
Use these values:
| Field | Value |
|---|---|
| VPC endpoint ID | The vpce-… ID from Step 2 |
| Region | Your workspace's region |
| Public access | True |
| Private access level | ACCOUNT |
Public access must stay True
Setting Public access to False immediately locks out every connection to the workspace — including the Databricks account console itself. Leave it True unless you have separately planned and tested private connectivity for your own users.
Step 4: Confirm on the ticket¶
Reply on the support ticket once Step 3 is done. Trust3 completes the DNS configuration, verifies the private path, and confirms on the ticket when it is ready to use.
Next: Set up the connector¶
With the private path in place, go to Databricks Unity Catalog for the connector's prerequisites and setup steps.
Use your existing workspace URL during connector setup — it does not change for PrivateLink.