Databricks GCP Platform Architect

Administration begins with who is allowed to change what. You set up account and workspace administrators, connect sign-in to your identity provider, and use workspace settings and cluster policies to keep use in bounds.

• Account console and administrator roles
• Sign-in with your identity provider
• Users, groups and service principals
• Workspace settings and feature controls
• Cluster policies and cost visibility

You build An administration plan that names roles, groups and settings for one organization.

Repeatable platforms are built from code. You drive account-level configuration through the API, authenticate with a service principal, and create network, credential and workspace objects the same way every time.

• What the account API configures
• Service principals and OAuth for automation
• Credential and network configurations
• Creating a workspace programmatically
• Terraform for the same setup
• Reading errors from a failed creation

You build A script or Terraform module that creates a workspace from its configuration objects.

A network you own gives you control over addressing and routing. You plan subnets and ranges, write the firewall rules clusters need, and decide how workloads reach the internet and Google services.

• Why use your own VPC
• Subnet and IP range planning
• Firewall rules for cluster traffic
• Egress with Cloud NAT and controlled routes
• Private Google Access for Google services
• Checking a network before creating a workspace

You build A VPC plan with subnets, ranges and firewall rules ready for a workspace.

Private paths between users, clusters and the control plane keep traffic off the public internet. You configure Private Service Connect for both directions and limit who can reach the workspace in the first place.

• Front-end and back-end private connectivity
• Private Service Connect endpoints and attachments
• Private access settings on the workspace
• IP access lists
• Testing that traffic uses the private path

You build A private connectivity design with the checks that confirm traffic stays off the internet.

Your data already sits in Cloud Storage buckets. You grant Databricks access through Google service accounts, register storage credentials and external locations in Unity Catalog, and keep each grant as small as possible.

• Buckets for workspace data and for your data
• Service accounts and their roles
• Storage credentials in Unity Catalog
• External locations and volumes
• Access errors and how to trace them

You build A bucket connected through a service account and an external location with minimal roles.

Workloads on Databricks use other Google services every day. You connect to BigQuery and message streams, and give clusters access through service accounts instead of keys saved in notebooks.

• Service accounts for clusters
• Reading from and writing to BigQuery
• Consuming events from Pub/Sub
• Keeping secrets out of notebooks
• Auditing calls to other services

You build A workspace reading from BigQuery and a message stream with no stored credentials.

When an organization insists on holding its keys, the platform has to respect that. You apply customer-managed keys to the data Databricks stores for you, set the permissions that make it work and plan rotation and revocation.

• What data Databricks encrypts and where
• Key rings, keys and their permissions
• Applying keys to a workspace
• Rotation and the effect of disabling a key
• Testing encryption in a sandbox workspace

You build A key configuration for one workspace with a documented rotation and revocation plan.

You design and deploy one workspace with everything combined: projects, API-driven setup, a customer-managed VPC, private connectivity, governed storage and managed keys. Then you check it against a security review.

• Turning requirements into a design
• Building network, storage and keys first
• Creating the workspace through automation
• Testing isolation and access paths
• Handing the design to a review team

You build An automated, documented Google Cloud workspace deployment with private access.