Access VeloDB from Your VPC on AWS

Before you begin, read Access VeloDB from your VPC for the connection direction, ownership model, and network-control scope.

1. On the target warehouse, open the Connection page, select the Private Link tab, and click Set up Connection under Connect Your VPC to VeloDB.

   

2. Click Set up one or more endpoints to open AWS PrivateLink and create an endpoint.

   

3. In the AWS PrivateLink console, verify that the region matches the VeloDB warehouse region. PrivateLink is region-scoped. Then click Create endpoint.

   

   Note Sign in to AWS with a principal that is allowed to access the VeloDB endpoint service. Otherwise, service-name verification fails.

4. Fill in the endpoint form:

   

   

   Parameter	Description
   Name tag	Optional. Tag with key Name and a value of your choice.
   Service category	Required. Select Endpoint services that use NLBs and GWLBs.
   Service name	Required. Copy the Service Name from the Endpoint Service information panel in VeloDB Cloud, paste it here, and click Verify service.
   VPC	Required. The VPC to create the endpoint in.
   Subnets	Required. Select a suitable subnet in the same Availability Zone as the VeloDB endpoint service, as required by PrivateLink.
   Security groups	Required. The rules must allow the protocol and port used by the warehouse and the source IP of your application.
   Tags	Optional.

5. When the endpoint status changes from Pending to Available, the PrivateLink connection is ready.

   

6. Refresh the VeloDB Cloud Connection page. The endpoint list shows the connection details.

   

   

   Note Click Find DNS Name to open the endpoint details page in AWS. Copy the DNS Name and use it to access the warehouse.

7. Applications can connect to the warehouse through that DNS name using MySQL or HTTP. The Connection Examples popover on the Connection page provides connection snippets.

   

8. Configure private DNS for HTTPS.

   Note This step is required only if TLS is enabled for your warehouse. TLS is supported in version 26.0.5 and later in the 26.0.x release series, and version 26.1.2 and later in the 26.1.x release series. If your warehouse runs an earlier version or TLS is not enabled, skip this step.

   The server certificate is issued for the VeloDB domain, such as *.aws.velodb.cloud, rather than the AWS-generated *.vpce.amazonaws.com domain. Connecting directly to the AWS endpoint DNS name causes TLS certificate validation to fail because the domain names do not match. Configure private DNS to map the VeloDB domain to the PrivateLink endpoint, and use the VeloDB domain in client connections.

   8.1. In AWS, search for Route 53 and open Hosted zones. Click Create hosted zone. Enter the appropriate suffix of the domain provided by VeloDB in Domain name, and select Private hosted zone as the type. Select your VPC and its region, then click Create hosted zone.

   

   

   8.2. On the hosted zone page, click Create record. Enter a Record name that, together with the hosted zone name, forms the complete VeloDB domain. Select CNAME as the record type, and enter the endpoint DNS Name in Value.

   

   

   Note

   • VeloDB Cloud uses two independent account systems: Console accounts (used to sign in to the VeloDB Console) and warehouse accounts (used to connect to the warehouse). This section covers warehouse accounts.
   • For the first connection, use the admin user. You can initialize or reset its password from the Settings page.

After the endpoint is ready, use Connection information and examples to connect an application.