Private connectivity to the per-warehouse Console endpoint

The VeloDB Console is the browser interface for VeloDB Cloud. Console operations use separate control-plane and per-warehouse data-plane endpoints. This guide covers private connectivity for the per-warehouse Console data-plane endpoint only.

Console data plane and control plane

Plane	What it includes	Where it runs	Private connectivity
Console data plane	Operations that read, write, or inspect a warehouse's data. These operations include SQL execution and analysis in SQL Editor, including query profiles, plus Add Catalog, Import Data, Migration, Sessions, Query Audit, Log Explorer, and Warehouse Users and Roles.	A per-warehouse endpoint located in the warehouse's region: the console hostname (`<warehouse-id>-studio.<region>.<provider>.velodb.cloud`).	Covered by this guide.
Console control plane	Managing the warehouse and organization: creating, deleting, and scaling a warehouse, warehouse settings, members, billing, and sign-in.	A shared VeloDB Cloud endpoint.	Not covered. Stays on the public path.

Private connectivity routes the console data plane through the cloud provider's private network instead of the public internet. The provider-specific guides in this section currently cover AWS, Google Cloud, and Azure. Control-plane operations are not affected and remain reachable over the public network.

Because the two planes use separate endpoints, restricting or disabling public access to a warehouse's data plane makes the corresponding Console features unavailable from the public network, while control-plane functions stay reachable.

This is separate from the Public Access Allowlist, which restricts, but does not privatize, the public access path. Configuring private connectivity does not automatically disable the public path.

How private connectivity works

Each warehouse's Console data-plane operations are reached at a per-warehouse console hostname. To establish private connectivity:

Create a private endpoint in your cloud network.
Connect it to the regional endpoint service published by VeloDB Cloud.
If approval is required, wait for VeloDB Cloud to accept the connection.
Configure private DNS so that the console hostname resolves to the private endpoint. If the private DNS zone covers a regional VeloDB Cloud suffix, add a record for every warehouse hostname in that region that clients need to resolve.
Verify Console data-plane access from the private network.

User or application
        |
        | HTTPS (TCP 443)
        v
<warehouse-id>-studio.<region>.<provider>.velodb.cloud
        |
        | Private DNS
        v
Private endpoint in your VPC or VNet
        |
        | Private cloud network
        v
Per-warehouse Console data-plane endpoint

Important

Continue to use the original console hostname in browsers and clients. Do not use the endpoint's private IP address or the DNS name that the cloud provider generates for the endpoint. The original hostname is required for TLS certificate validation and request routing.

Find your per-warehouse Console hostname

The console hostname is the host part of the URL you see when you open the warehouse in the VeloDB Console. It has this format:

<warehouse-id>-studio.<region>.<provider>.velodb.cloud

Open the warehouse in the VeloDB Console and read the hostname from the browser address bar. The provider and the region are part of the hostname. For example:

Item	Value
Console URL	`https://awvadbgl-studio.us-east-1.aws.velodb.cloud/webui_api/api/data/catalogs`
Console hostname	`awvadbgl-studio.us-east-1.aws.velodb.cloud`
Provider	AWS
Region	`us-east-1`

Your private endpoint and the VeloDB Cloud endpoint service must be in the same region as the console hostname.

General requirements

Before you begin:

Confirm that the VeloDB Cloud warehouse is running.
Select a VPC or VNet that console users can reach.
Ensure that you can create private endpoints, firewall rules, and private DNS records.
Allow HTTPS traffic on TCP port 443 between clients and the endpoint.
Enable DNS resolution in the client network.
If users connect from on-premises, establish private connectivity to the cloud VPC or VNet through VPN, Direct Connect, Interconnect, or ExpressRoute.

Scope

These guides privately route the warehouse's console data plane, served on the console hostname. Control-plane operations and the VeloDB Cloud sign-in flow use additional hostnames on the public path. If client devices have no public internet access, contact VeloDB Support for the hostname allowlist required by your authentication and network configuration.

Creating a private endpoint does not automatically disable the public path. Contact VeloDB Support if you need public access to the warehouse's Console data-plane operations disabled or restricted. Do this only after private access works from every required location.

Select your cloud provider

Cloud provider	Private connectivity service	Configuration guide
AWS	AWS PrivateLink	Configure private connectivity on AWS
Google Cloud	Private Service Connect	Configure private connectivity on Google Cloud
Azure	Azure Private Link	Configure private connectivity on Azure

Console data plane and control plane​

How private connectivity works​

Find your per-warehouse Console hostname​

General requirements​

Scope​

Select your cloud provider​

Related resources​