Secure Databricks with cnspec

Scan your Databricks accounts and workspaces to find security risks before they become incidents. cnspec evaluates cluster data security modes, disk encryption, personal access token hygiene, IP access lists, Unity Catalog grants, Delta Sharing scope, and dozens of other Databricks controls.

If you're new to cnspec, start with the Quickstart. For an overview of every SaaS service cnspec can scan, see the SaaS scanning overview.

Prerequisites

To scan Databricks with cnspec, you must have:

• cnspec installed on your workstation
• A Databricks account or workspace
• Credentials with permission to read account or workspace configuration (see below)

Authenticate

cnspec can connect at two levels:

• Account scans account-level configuration and discovers every workspace in the account. Connect with an OAuth machine-to-machine (M2M) service principal by passing --account-id, --client-id, and --client-secret.
• Workspace scans a single workspace directly. Connect with a personal access token by passing --host (the workspace URL) and --token.

To create an OAuth service principal, see Authenticate access to Databricks with a service principal using OAuth. To create a personal access token, see Databricks personal access token authentication.

You can pass credentials on the command line or export them as environment variables:

# Account (OAuth service principal)
export DATABRICKS_ACCOUNT_ID=YOUR_ACCOUNT_ID
export DATABRICKS_CLIENT_ID=YOUR_CLIENT_ID
export DATABRICKS_CLIENT_SECRET=YOUR_CLIENT_SECRET

# Workspace (personal access token)
export DATABRICKS_HOST=https://YOUR_WORKSPACE.cloud.databricks.com
export DATABRICKS_TOKEN=YOUR_TOKEN

When connecting to an account, cnspec defaults to the AWS account console host (accounts.cloud.databricks.com). For Azure or GCP, set --host (or DATABRICKS_HOST) to accounts.azuredatabricks.net or accounts.gcp.databricks.com.

Connection options

Verify with a quick Databricks check

Confirm that cnspec can reach Databricks by opening a cnspec shell. For an account:

cnspec shell databricks --account-id YOUR_ACCOUNT_ID --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET

For a single workspace:

cnspec shell databricks --host https://YOUR_WORKSPACE.cloud.databricks.com --token YOUR_TOKEN

If cnspec connects and shows a prompt, you're ready to scan.

Scan Databricks

Scan an account (this also discovers and scans every workspace):

cnspec scan databricks --account-id YOUR_ACCOUNT_ID --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET

Scan a single workspace:

cnspec scan databricks --host https://YOUR_WORKSPACE.cloud.databricks.com --token YOUR_TOKEN

When a scan completes, cnspec prints a summary of all the checks it ran, grouped by policy, along with a risk score from 0 (no risk) to 100 (highest risk). Failed checks include remediation guidance to help you fix issues. To learn more about reading scan results, read Understand cnspec Results.

Scan with the Mondoo Databricks Security policy

Mondoo maintains an out-of-the-box Databricks Security policy that checks cluster data security modes, disk encryption, personal access token hygiene, IP access lists, Unity Catalog isolation, and more.

Mondoo Platform users: Enable the policy in your space. In the Mondoo App, go to Findings > Policies, search for "Databricks", and add the policy. To learn more, read Manage policies in Mondoo Platform.

Open source users: Pass the policy bundle URL directly to cnspec:

cnspec scan databricks --host https://YOUR_WORKSPACE.cloud.databricks.com --token YOUR_TOKEN \
  --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-databricks-security.mql.yaml

You can also create your own policies to meet your specific requirements.

Explore and test checks interactively

Open a cnspec shell to discover resources and try out checks.

List all workspaces

cnspec> databricks.workspaces { name workspaceId cloud }

List all clusters

cnspec> databricks.clusters { clusterName dataSecurityMode state }

List all users

cnspec> databricks.users { userName active }

List personal access tokens

cnspec> databricks.tokens { comment createdByUsername expiryTime }

Example security checks

Ensure personal access tokens have an expiration

A null expiryTime means the token never expires:

cnspec> databricks.tokens.all(expiryTime != null)
[ok] value: true

Ensure clusters don't run without Unity Catalog isolation

The NONE data security mode disables Unity Catalog access controls:

cnspec> databricks.clusters.none(dataSecurityMode == "NONE")
[ok] value: true

Ensure clusters encrypt local disks

cnspec> databricks.clusters.all(localDiskEncryptionEnabled == true)
[ok] value: true

Ensure clusters auto-terminate when idle

cnspec> databricks.clusters.all(autoterminationMinutes > 0)
[ok] value: true

Ensure IP access lists are enabled for the workspace

cnspec> databricks.workspaceSettings.ipAccessListsEnabled == true
[ok] value: true

Ensure enhanced security monitoring is enabled

cnspec> databricks.workspaceSettings.enhancedSecurityMonitoringEnabled == true
[ok] value: true

Ensure metastores don't allow external Delta Sharing

cnspec> databricks.metastores.none(deltaSharingScope == "INTERNAL_AND_EXTERNAL")
[ok] value: true

Ensure SQL warehouses auto-stop when idle

cnspec> databricks.warehouses.all(autoStopMinutes > 0)
[ok] value: true

Learn more

• Databricks Resource Pack Reference: every Databricks resource and field cnspec can query
• Write Effective MQL: guide to authoring checks and queries