How-to | Secure data connections through Azure Private Link#
For certain plans, Dataiku enables Launchpad administrators to protect access to certain data sources through Azure Private Link.
Azure Private Link provides private connectivity between your Dataiku instance and supported Azure services without exposing your traffic to the public internet. Once activated, Dataiku Cloud will only connect to your data using a private endpoint.
Important
Azure Private Link is not available in all Dataiku plans. You may need to reach out to your Dataiku Account Manager or Customer Success Manager.
Dataiku only supports one Private Link per storage account.
If you run into any error, please contact our support team.
Azure Blob Storage#
To configure Azure Private Link for an Azure Blob Storage data source:
Ensure your Azure region is available in Dataiku Cloud#
In the Dataiku Cloud Launchpad, navigate to the Extensions panel.
Click + Add an Extension.
Select Azure storage endpoint.
Select the Azure Storage Account region. If the region you need is not available, please contact our support team to enable it.
Fill out the Azure Storage endpoint form#
Retrieve the storage account name, the resource group, and the subscription id from your Azure Storage Account page.
Accept the Private Link request on Azure#
Navigate to the Private Link Center in your Azure account and then to the Pending Connections to accept the two connection requests. Private Link functionality will be only enabled after you accept these requests.
Create the Azure Blob Storage connection#
You can now use the endpoint you created both in new and existing Azure Blob Storage connections:
In the Dataiku Cloud Launchpad, navigate to the Connections panel.
Select + Add a Connection.
Select Azure Blob Storage and fill the form.
An Azure-hosted Snowflake database#
To configure Azure Private Link for a Snowflake database hosted on Azure:
Ensure your Snowflake region is available in Dataiku Cloud#
In the Dataiku Cloud Launchpad, navigate to the Extensions panel.
Click + Add an Extension.
Select Azure Snowflake endpoint.
Select the Azure region of your Snowflake account. If the region you need is not available, please contact our support to enable it.
Keep this page open, and continue to the next step in the Snowflake console.
Retrieve the PrivateLink config from Snowflake#
Having completed the above set of instructions, in Snowflake, create a new SQL worksheet.
Run the following SQL commands with the
ACCOUNTADMIN
role:alter account set ENABLE_INTERNAL_STAGES_PRIVATELINK = true; select SYSTEM$GET_PRIVATELINK_CONFIG();
Click on the output to open a new panel on the right.
Click on the Click to Copy icon to copy the JSON result.
Create the Azure Snowflake endpoint extension in the Dataiku Cloud Launchpad#
Return to the Extensions tab of the Dataiku Cloud Launchpad.
If not still open from the first section, click + Add an Extension, and select Azure Snowflake endpoint.
Provide any string as the endpoint name. It will be helpful if it is a unique identifier.
Select your Snowflake Azure region; it should be available by now.
Paste the JSON you copied from the above set of instructions into the Snowflake PrivateLink config input.
Click Add.
You can close this page while Dataiku creates the underlying infrastructure. This operation usually takes 10 minutes.
Once the infrastructure is created, refresh the page, click on the endpoint from the list, and then click View Details. It should look like this:
Ask Snowflake support to allow Azure Private Link from Dataiku’s Azure account#
In the Snowflake console, go to the Support section in the left panel.
Create a new support case by clicking on Support Case in the top right corner.
Fill the title with something meaningful, for example
Enable Azure Private Link
.In the details section of your Snowflake support case, request the approval of the previous endpoint. The endpoint resource ID can be found in the previous View Details message.
In the Where did the issue occur? section, select Azure Private Link, leave the severity to Sev-4, and click on Create Case.
Wait for Snowflake support to enable Private Link before continuing to the next set of instructions.
Use the Azure Snowflake endpoint in your Snowflake connections#
You can now use the endpoint you created both in new and existing Snowflake connections. To do that:
In the Dataiku Cloud Launchpad, navigate to a new or existing Snowflake connection.
For the host value, fill the value of the host from the previous View Details message.
Note
Your Snowflake connection may use an Azure Blob fast-write connection. In that case, you have to setup Private Link for it as described in Azure Blob Storage if you also want that traffic to go through Private Link.
An Azure SQL database#
Administrators can leverage Azure Private Link for the following Azure SQL databases: PostgreSQL, MySQL or SQLServer.
Note
Private Links are available only for servers that have public access networking. They can’t be created for servers that have private access (VNET integration).
Ensure your Azure region is available in Dataiku Cloud#
In the Dataiku Cloud Launchpad, navigate to the Extensions panel.
Click + Add an Extension.
Select Azure SQL endpoint.
Select the Azure SQL region. If the region you need is not available, please contact our support team to enable it.
Fill out the Azure SQL endpoint form#
Retrieve the resource group, the subscription id, the SQL type and the SQL server name from your Azure Storage Account page.
Note
Enpoint name is the name you want to give to your extension on Dataiku Cloud.
SQL type is the type of the SQL database you created on Azure. Only Azure Database for PostgreSQL flexible servers, Azure Database for PostgreSQL servers, Azure Database for MySQL servers, Azure Database for MySQL flexible servers, and Azure SQL Database are supported.
SQL server name is the name of the SQL server you created on Azure.
Accept the Private Link request on Azure#
Navigate to the networking tab of your Database to accept the connection requests. Private Link functionality will only be enabled after you accept this request.
Create the SQL connection#
You can now use the endpoint you created both in new and existing Azure Blob Storage connections:
In the Dataiku Cloud Launchpad, navigate to the Connections panel.
Select + Add a Connection.
Select PostgreSQL, MySQL or SQLServer depending on the connection you want to use and fill the form. The value for the host param is the host you can find on your Azure Database.