Connection
Reaching a warehouse involves two kinds of traffic, and they are configured separately:
- Direct warehouse connections from applications, MySQL-compatible clients, JDBC and ODBC drivers, BI tools, and HTTP clients.
- Console data-plane operations, which are VeloDB Console actions that require warehouse connectivity, such as running queries in SQL Editor, importing data through Import Data, and viewing query activity in Query Audit.
The paths available to you depend on the warehouse type:
| Warehouse type | Direct warehouse connections | Console data-plane operations |
|---|---|---|
| SaaS | Public Link over the public internet, or PrivateLink from inside your VPC. | Reached over the public network and restricted by the Public Link IP allowlist, or routed privately through the per-warehouse Console endpoint. |
| BYOC | Through your own cloud network. VeloDB does not expose a separate public endpoint for the warehouse. | Reached over the public network and restricted by the Public Access Allowlist, or routed privately through the per-warehouse Console endpoint. |
Configuring one path does not configure the others. Private access to a warehouse does not privatize Console data-plane operations, and restricting the Console path does not change how applications connect directly.
Public Link
SaaS warehouses only. Public Link exposes the warehouse over the public internet. An IP allowlist controls which source IP addresses can connect to the warehouse and perform Console data-plane operations.
The default allowlist entry is 0.0.0.0/0, which allows access from anywhere, so narrowing it to your real source IPs is the first thing to do after enabling this path.
See Public Link.
PrivateLink
SaaS warehouses only. PrivateLink connects your VPC and VeloDB Cloud over the cloud provider's private network, without crossing the public internet. The IP allowlist does not apply to this path. You control access through VPC endpoints, security groups, and other private-network controls in your own cloud environment.
Every PrivateLink connection has an Endpoint Service on the publisher side and an Endpoint on the consumer side. Which side you own depends on the direction:
| Direction | You own | VeloDB Cloud owns | Use it when |
|---|---|---|---|
| Access VeloDB from Your VPC | The Endpoint in your VPC | The Endpoint Service | Applications in your VPC query the warehouse. |
| Grant VeloDB Access to Your VPC | The Endpoint Service in your VPC | The Endpoint | VeloDB Cloud reads a data source in your VPC. |
VeloDB Cloud does not charge extra for PrivateLink. For the inbound direction, you pay the cloud provider for endpoint instances and traffic.
PrivateLink is region-scoped. The cloud-provider region must match the warehouse region.
Access VeloDB from Your VPC
Use this direction to let reporting tools, BI, log-analytics jobs, and other applications inside your VPC reach the warehouse over a private network.
See Access VeloDB from Your VPC for the AWS and Azure guides.
Grant VeloDB Access to Your VPC
Use this direction when VeloDB Cloud needs to read from resources in your VPC, such as a MySQL or PostgreSQL database, a Hive Metastore, or another data source behind a catalog.
See Grant VeloDB Access to Your VPC for the AWS and Azure guides.
Public Access Allowlist
BYOC warehouses only. A BYOC warehouse runs in your own cloud account and VPC, so your cloud network provides direct warehouse connectivity. The Public Access Allowlist covers the remaining path: it restricts the source IP addresses from which users can perform Console data-plane operations.
The allowlist does not affect control-plane operations such as creating, deleting, or scaling resources, and it does not configure network controls in your cloud account.
See Connect to a BYOC Warehouse.
Private Connectivity to the Per-warehouse Console Endpoint
Console data-plane operations reach a per-warehouse console hostname. You can route that traffic through a private endpoint in your own network instead of the public internet, on AWS, Google Cloud, and Azure.
Console control-plane operations, including sign-in, warehouse management, members, and billing, use a shared VeloDB Cloud endpoint and stay on the public path.
See Private connectivity to the per-warehouse Console endpoint.
Connection Information and Examples
After the network path is in place, the Connection Info panel and the Connection Examples popover give you the host, ports, credentials, and ready-made client snippets.
See Connection Information and Examples.