Access VeloDB Cloud from Your VPC on AWS

Before you begin, read Access VeloDB Cloud from your VPC for the connection direction, ownership model, and network-control scope. This procedure applies to SaaS warehouses and uses AWS PrivateLink to create an interface endpoint in your virtual private cloud (VPC).

Make sure that you can create VPC endpoints, select subnets and security groups, and configure private DNS in the AWS account that contains the client applications.

For encrypted connections, newly created warehouses must run VeloDB Core 26.1.3 or later. For an existing warehouse, upgrade to 26.1.3 or later, then submit a support ticket to request TLS enablement before following the private DNS steps below. See TLS availability.

1. Log in to the VeloDB Cloud console. In the upper-left corner, select the warehouse that you want to use, then click Connect in the left navigation pane. Select Private Endpoint > Access VeloDB from Your VPC, and then click Set up Connection.

2. Click Set up one or more endpoints to open the AWS VPC console and create an endpoint.

3. In the AWS VPC console, switch to the AWS Region that matches the warehouse region. AWS PrivateLink is region-scoped. On Endpoints, click Create endpoint to open the form.

   

   Note:

   Log in to AWS with a principal that is allowed to access the VeloDB Cloud endpoint service. Otherwise, service-name verification fails.

4. Fill in the endpoint form:

   

   

   Parameter	Description
   Name tag	Optional. Tag with key Name and a value of your choice.
   Service category	Required. Select Endpoint services that use NLBs and GWLBs.
   Service name	Required. Copy the Endpoint Service Name from the Supporting Information section of the VeloDB Cloud console, paste it here, and click Verify service.
   VPC	Required. The VPC to create the endpoint in.
   Subnets	Required. Select one or more suitable subnets in Availability Zones supported by the VeloDB Cloud endpoint service.
   Security groups	Required. The rules must allow the protocol and port used by the warehouse and the source IP of your application.
   Tags	Optional.

   After completing the form, click Create endpoint to submit it.

5. Wait for the endpoint status to change from Pending to Available. If the endpoint service requires approval, it remains pending until VeloDB Cloud accepts the connection. The connection is ready only after the status is Available.

   

6. Return to VeloDB Cloud. If the Set up Connection dialog is closed, open Connect > Private Endpoint > Access VeloDB from Your VPC, and then click Set up Connection. Under Endpoint Information, enter the Endpoint ID. Optionally enter a Description, and then click Save.

7. Refresh the page, then open Connect > Private Endpoint > Access VeloDB from Your VPC. Locate the row by its Endpoint ID, and verify the Endpoint DNS Name.

8. In the endpoint row, select the connection option for your client, and then copy the connection details from the dialog.

9. Configure private DNS for encrypted connections.

   Note:

   If Transport Layer Security (TLS) is Required for MySQL CLI or JDBC, or if the Stream Load endpoint uses HTTPS, configure private DNS before connecting. Otherwise, skip this step. MySQL-protocol TLS is supported in version 26.0.5 and later in the 26.0.x release series, and version 26.1.2 and later in the 26.1.x release series.

   The server certificate is issued for the VeloDB Cloud domain shown in Warehouse Private Domain, rather than the AWS-generated *.vpce.amazonaws.com domain. Connecting directly to the AWS endpoint DNS name causes Transport Layer Security (TLS) certificate validation to fail because the domain names do not match. Configure private DNS to map the VeloDB Cloud domain to the PrivateLink endpoint, and use the VeloDB Cloud domain in client connections.

   9.1. In AWS, search for Route 53 and open Hosted zones. Click Create hosted zone. From the complete Warehouse Private Domain shown in the VeloDB Cloud console, enter the DNS suffix in Domain name. Select Private hosted zone as the type, associate it with the VPC that contains the endpoint, and then click Create hosted zone.

   

   

   9.2. On the hosted zone page, click Create record. Enter a Record name that, together with the hosted zone name, forms the complete Warehouse Private Domain. Select CNAME as the record type, and enter the endpoint DNS Name in Value.

   

   

   Note:

   • VeloDB Cloud uses two independent account systems: Console accounts (used to log in to the VeloDB Cloud console) and warehouse accounts (used to connect to the warehouse). This section covers warehouse accounts.
   • For the first connection, use the admin user. If you no longer have its password, click Reset password under Connection Details, or open Warehouse Settings > Security and click Change Password.

10. Configure your client with the copied connection details.

After the endpoint is ready, use Connection Methods to connect an application.

See also

• Access VeloDB Cloud from Your VPC
• Connection Methods
• Private connectivity to the warehouse-specific console endpoint