---
title: Share data behind a firewall with SecureConnect | Databricks on AWS
source: https://docs.databricks.com/aws/en/delta-sharing/secureconnect-provider
ingestedAt: "2026-06-18T08:05:46.793Z"
---

This page describes how providers set up OpenSharing SecureConnect to share data from cloud storage that is behind a firewall or private endpoint, without needing to allowlist each recipient's network.

## How SecureConnect works[​](#how-secureconnect-works "Direct link to how-secureconnect-works")

Before enabling SecureConnect on a Databricks account, a provider makes a one-time configuration. This configuration allows Databricks recipients to access the provider's storage behind a firewall or private endpoint. Databricks then routes recipient requests through a managed proxy, so the provider does not need to update their storage firewall when adding a new recipient.

Recipients access shared data using their existing OpenSharing setup:

*   Databricks recipients on serverless compute access shares with no per-provider firewall changes.
*   Databricks recipients on classic compute and open recipients allowlist a single set of Databricks control plane IPs for the provider's region.

Without SecureConnect, a provider must add each recipient's network identifier to their storage firewall, coordinating with the recipient and a cloud platform administrator for every new recipient.

## Requirements[​](#requirements "Direct link to Requirements")

*   The **OpenSharing SecureConnect** preview in the **Account Console** must be enabled. See [Manage Databricks previews](https://docs.databricks.com/aws/en/admin/workspace-settings/manage-previews).

## Set up SecureConnect as a provider[​](#set-up-secureconnect-as-a-provider "Direct link to set-up-secureconnect-as-a-provider")

Setting up SecureConnect involves configuring your storage firewall to allow access and enabling SecureConnect for your metastores and recipients.

### Step 1: Configure your storage firewall[​](#step-1-configure-your-storage-firewall "Direct link to step-1-configure-your-storage-firewall")

For the lowest networking costs, keep the region of your shared assets the same as your provider metastore region.

The following instructions assume that your shared assets and provider metastore are in the same region.

SecureConnect accesses your storage through the serverless data plane. Configure your S3 bucket policies to include the VPCE OrgPath. See [S3 bucket access using VPCE OrgPath](https://docs.databricks.com/aws/en/security/network/serverless-network-security/serverless-firewall-config#s3-bucket-access-using-vpce-orgpath).

#### (Optional) Configure private connectivity with a network connectivity configuration (NCC)[​](#optional-configure-private-connectivity-with-a-network-connectivity-configuration-ncc "Direct link to optional-configure-private-connectivity-with-a-network-connectivity-configuration-ncc")

If your shared storage is behind a private endpoint and is not reachable from the public network, an account admin must configure a network connectivity configuration (NCC) and attach it to the metastore that hosts your shared data. For more about NCCs, see [What is a network connectivity configuration (NCC)?](https://docs.databricks.com/aws/en/security/network/serverless-network-security/#ncc).

An NCC attached to a workspace can't be attached to a metastore. An NCC applied to a metastore for OpenSharing applies to all shares attached to the metastore.

warning

AWS PrivateLink to S3 is not compatible with FIPS endpoints, which Databricks uses by default in all US regions. If your provider metastore is in a US region, contact your Databricks account team.

For more information, see the [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#privatelink-limitations).

Create an NCC and a private endpoint rule for your S3 bucket but do not attach the NCC to a workspace. See [Configure private connectivity to AWS-managed resources](https://docs.databricks.com/aws/en/security/network/serverless-network-security/pl-aws-resources) for NCC and PrivateLink setup.

Attach the NCC to your OpenSharing metastore:

1.  As a Databricks account administrator, go to the [account console](https://accounts.cloud.databricks.com/).
2.  In the sidebar, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog**.
3.  Click the name of the OpenSharing metastore to open its details.
4.  Under **OpenSharing Network connectivity configuration (NCC)** click **Edit**.
5.  Search for and select the NCC you created for OpenSharing.
6.  Click **Save**.

important

If you are unable to attach an NCC to a metastore, contact your Databricks account team to enable private connectivity for OpenSharing SecureConnect using an NCC.

### Step 2: Enable SecureConnect on a metastore[​](#step-2-enable-secureconnect-on-a-metastore "Direct link to step-2-enable-secureconnect-on-a-metastore")

A metastore administrator can configure the metastore so new recipients automatically use SecureConnect. By default, new and existing recipients are not enrolled in SecureConnect. You must configure existing recipients separately. See [Step 3: Enable SecureConnect for individual recipients](#step-3).

To enable SecureConnect on a metastore:

1.  In your Databricks workspace, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog** to open Catalog Explorer.
    
2.  At the top of the **Catalog** pane, click the ![Gear icon.](data:image/svg+xml;base64,[encoded data, 5356 characters]) gear icon and select **OpenSharing**.
    
    Alternatively, in the upper-right corner, click **Share > OpenSharing**.
    
3.  Click **Settings** in the upper-right corner.
    
4.  Turn on the setting for **Enable SecureConnect for new recipients**.
    
5.  Click **Save**.
    

### Step 3: Enable SecureConnect for individual recipients[​](#step-3-enable-secureconnect-for-individual-recipients "Direct link to step-3-enable-secureconnect-for-individual-recipients")

Recipient owners, and users with the `USE_RECIPIENT` privilege, toggle SecureConnect on or off for each recipient. SecureConnect is disabled on a recipient by default, unless the metastore was set to enable it for all new recipients when the recipient was created.

To configure SecureConnect on a recipient:

1.  In your Databricks workspace, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog**.
    
2.  At the top of the **Catalog** pane, click the ![Gear icon.](data:image/svg+xml;base64,[encoded data, 5356 characters]) gear icon and select **OpenSharing**.
    
    Alternatively, in the upper-right corner, click **Share > OpenSharing**.
    
3.  On the **Shared by me** tab, click the **Recipients** tab.
    
4.  Turn on **SecureConnect** for each desired recipient.
    

### (Optional) Step 4: Restrict open recipient access with IP ACLs[​](#optional-step-4-restrict-open-recipient-access-with-ip-acls "Direct link to optional-step-4-restrict-open-recipient-access-with-ip-acls")

For open recipients, you can restrict which client IP addresses are allowed to reach SecureConnect using IP access lists. IP ACLs apply only to open recipients.

With SecureConnect, IP ACLs apply to both OpenSharing endpoint access and storage access. Without SecureConnect, IP ACLs restrict only OpenSharing endpoint access; storage URLs remain reachable from any client IP.

For setup instructions, see [Restrict OpenSharing recipient access using IP access lists (Databricks-to-Open sharing)](https://docs.databricks.com/aws/en/delta-sharing/access-list).

note

IP ACL changes for SecureConnect-enabled open recipients can take up to 10 minutes to take effect.

## Supported sharing scenarios[​](#supported-sharing-scenarios "Direct link to supported-sharing-scenarios")

SecureConnect supports sharing to AWS, Azure, and GCP.

mTLS to SecureConnect is supported for only serverless recipient clusters.

### Feature support[​](#feature-support "Direct link to Feature support")

\* OIDC sharing does not currently work when the recipient is also on Databricks.

\*\* Cloud token optimization is not available for SecureConnect.

## Limitations[​](#limitations "Direct link to limitations")

*   Your assets can't be backed by Cloudflare R2 storage.

*   SecureConnect is not available on AWS GovCloud.
*   AWS PrivateLink to S3 is not compatible with FIPS endpoints, which Databricks uses by default in all US regions. If you use SecureConnect with PrivateLink in a US region, contact your Databricks account team.

For recipient-side limitations, such as mTLS support and Databricks-to-Open sharing restrictions, see [Limitations](https://docs.databricks.com/aws/en/delta-sharing/secureconnect-recipient#limitations).

## Billing[​](#billing "Direct link to billing")

Providers are billed for data transfer through SecureConnect. See [Data transfer and connectivity pricing](https://www.databricks.com/product/pricing/data-transfer-connectivity).

Per-recipient usage is attributed through the `recipient_id` field in the billing system table, so providers can break down billable SecureConnect usage by recipient. See [Billable usage system table reference](https://docs.databricks.com/aws/en/admin/system-tables/billing).

The following query returns the list cost of SecureConnect data egress for each recipient over the last 7 days:

SQL

    SELECT  usage_records.usage_metadata.recipient_id,  SUM(usage_records.usage_quantity * list_prices.pricing.default) AS list_costFROM system.billing.usage usage_recordsINNER JOIN system.billing.list_prices ON  usage_records.cloud = list_prices.cloud AND  usage_records.sku_name = list_prices.sku_name AND  usage_records.usage_start_time >= list_prices.price_start_time AND  (usage_records.usage_end_time <= list_prices.price_end_time OR list_prices.price_end_time IS NULL)WHERE  usage_records.billing_origin_product = 'NETWORKING'  AND usage_records.usage_metadata.recipient_id IS NOT NULL  AND usage_records.usage_date >= CURRENT_DATE() - INTERVAL 7 DAYSGROUP BY  usage_records.usage_metadata.recipient_idORDER BY  list_cost DESC

## Additional resources[​](#additional-resources "Direct link to Additional resources")

*   [Set up OpenSharing for your account (for providers)](https://docs.databricks.com/aws/en/delta-sharing/set-up)
*   [OpenSharing recipient firewall configuration for SecureConnect](https://docs.databricks.com/aws/en/delta-sharing/secureconnect-recipient)
