Secure Databricks Lakeflow data replication from Azure to AWS databases using Cato SASE as a unified inspection and enforcement backbone. Traffic flows from Azure Databricks through Cato Socket, Cato PoP, and Cato Cloud Routing Fabric to an IPsec-compliant gateway protecting PostgreSQL and MySQL in AWS, with NSGs and security groups enforcing deny-by-default policies. This architecture eliminates direct internet exposure, centralizes policy enforcement across cloud boundaries, and ensures only authenticated Lakeflow CDC traffic reaches databases via encrypted IPsec tunnels. Fork and customize this diagram on Diagrams.so to model your own multi-cloud data governance topology with SASE overlay networks. The design demonstrates zero-trust principles by blocking all unapproved routes and requiring cryptographic verification at every hop.