Connection
Reaching a warehouse involves two kinds of traffic, and they are configured separately:
- Warehouse service traffic reaches the backend warehouse service from applications, MySQL-compatible clients, JDBC and ODBC drivers, BI tools, and HTTP clients. It also includes traffic from the warehouse to data sources in your VPC.
- Warehouse-specific Console traffic carries data-plane requests from the frontend Console UI to a specific warehouse, such as running queries in SQL Editor, importing data through Import Data, and viewing query activity in Query Audit.
The paths available to you depend on the warehouse type:
| Warehouse type | Warehouse service (backend) | Warehouse-specific Console endpoint (frontend UI) |
|---|---|---|
| SaaS | Public Link over the public internet, or private connectivity to the warehouse from inside your VPC. | Reached over the public network and restricted by the Public Link IP allowlist, or routed privately through the warehouse-specific Console private endpoint. |
| BYOC | Through your own cloud network. VeloDB Cloud does not expose a separate public endpoint for the warehouse. | Reached over the public network and restricted by the Public IP Allowlist, or routed privately through the warehouse-specific Console private endpoint. |
Configuring one path does not configure the others. Private access to a warehouse does not privatize Console data-plane operations, and restricting the Console path does not change how applications connect directly.
Public Link
SaaS warehouses only. Public Link exposes the warehouse over the public internet. An IP allowlist controls which source IP addresses can connect to the warehouse and perform Console data-plane operations.
The default allowlist entry is 0.0.0.0/0, which allows access from anywhere, so narrowing it to your real source IPs is the first thing to do after enabling this path.
See Public Link.
Private Connectivity to a Warehouse
SaaS warehouses only. This path lets applications in your VPC connect privately to the backend service of a specific warehouse. It is separate from the warehouse-specific Console private endpoint, which carries data-plane requests from the frontend Console UI.
See Access VeloDB from Your VPC for the connection model, regional requirement, cost information, and AWS and Azure setup guides.
Private Connectivity from a Warehouse to Your VPC
SaaS warehouses only. Use this separate connection model when VeloDB Cloud needs to read from resources in your VPC, such as a MySQL or PostgreSQL database, a Hive Metastore, or another data source behind a catalog. You publish the Endpoint Service in your VPC, and VeloDB Cloud creates and manages the Endpoint that connects to it.
See Grant VeloDB Access to Your VPC for the AWS and Azure guides.
Public IP Allowlist
BYOC warehouses only. A BYOC warehouse runs in your own cloud account and VPC, so your cloud network provides direct warehouse connectivity. The Public IP Allowlist covers the remaining path: it restricts the source IP addresses from which users can perform Console data-plane operations. Configure it in Warehouse Settings > Security.
The allowlist does not affect control-plane operations such as creating, deleting, or scaling resources, and it does not configure network controls in your cloud account.
See Connect to a BYOC Warehouse.
Warehouse-Specific Console Private Endpoint
This private endpoint is for the frontend Console UI. It routes Console data-plane requests from tools such as SQL Editor, Import Data, and Query Audit through a warehouse-specific console hostname instead of the public internet. You can configure it on AWS, Google Cloud, and Azure.
Console control-plane operations, including sign-in, warehouse management, members, and billing, use a shared VeloDB Cloud endpoint and stay on the public path.
See Private connectivity to the warehouse-specific Console endpoint.
Connection Information and Examples
After the network path is in place, the Connection Info panel and the Connection Examples popover give you the host, ports, credentials, and ready-made client snippets.
See Connection Information and Examples.