Databricks App Security

The Honeycomb Maps app was designed from the ground-up around the security requirements of large enterprise deployments.

We utilize a shared responsibility model, where key components of our secure solution are provided by running on trusted Databricks infrastructure. We follow Databricks Partner Well-Architected Framework and all best practices.

Authentication: On-Behalf-Of and Service Principal

Honeycomb Maps always runs SQL queries against Databricks tables using on-behalf-of (OBO) user authentication. This best practice means that all queries that Honeycomb runs to fetch data to show users are tied to the identity of the requesting user.

Role-based access control policies that are configured in Unity Catalog are applied in Honeycomb Maps automatically.

Honeycomb uses Service Principal authentication to access certain resources, including storing metadata in Lakebase and uploaded files in Unity Catalog volumes.

No data persisted or moved

Honeycomb Maps is designed as a lens through which you view your data, not a service to store data in. Each time a map loads in Honeycomb Maps, data is fetched from the underlying connection to Databricks (using user-based authentication)

This design means that the Honeycomb application does not persist any data from customer Databricks tables. The only data persisted is metadata relating to the configuration of maps (titles, coloring, map layers, etc.) No data is cached. Existing Databricks access controls like RBAC are always in place.

Enforced SSO

Databricks Apps run behind a Databricks-managed reverse proxy, which authenticates all incoming requests and enforces SSO. Each user to the application must authenticate, or use an existing databricks or IdP SSO session.

It is structurally not possible to access the running application without authenticating. This means that public map-sharing links are not available in the Databricks App version of Honeycomb Maps. If this is a requirement, you can self-host Honeycomb Maps and connect to Databricks using workload identity federation or a programmatic access token (PAT).

Internal map sharing

By default, maps and data sources are only visible to their creator. Maps can be shared with individuals using the email associated with their Databricks account, or with all users within an organization.

To have a map shared with them, a user must have logged into the Honeycomb Maps app at least once.