Create a BYOC Warehouse on AWS
Create a BYOC warehouse in your own AWS account. Choose the option that best matches how much of the AWS infrastructure you want to provide and manage.
| If you want to... | Select | Infrastructure responsibility | Encryption |
|---|---|---|---|
| Get the fastest setup without preparing a VPC. | New VPC | You provide an AWS account with permission to create a CloudFormation stack. The template creates the VPC and all required resources. | The template uses cloud-provider-managed keys. Customer-managed keys are not supported. |
| Reuse an existing VPC while letting VeloDB Cloud create the remaining resources. | Existing VPC | You provide a VPC and subnets that meet the network requirements. The template creates the remaining resources in your VPC. | The template uses cloud-provider-managed keys. Customer-managed keys are not supported. |
| Manage the AWS infrastructure yourself or use customer-managed encryption keys. | Custom Infrastructure | You provide and register the VPC, subnets, security group, IAM roles, S3 bucket, and any KMS keys. | You manage the S3 encryption policy. You can provide customer-managed keys for TDE or EBS encryption. |
Note:
Custom Infrastructure is available only on AWS. It is the only option that supports customer-managed encryption keys for TDE or EBS encryption.
Prepare for your selected option
All options require an AWS account with permission to create the required resources. The New VPC and Existing VPC options launch an AWS CloudFormation stack. If you do not have sufficient IAM permissions, copy the CloudFormation URL and ask your AWS administrator to create the stack.
- New VPC: No network preparation is required. The template creates the VPC and its resources.
- Existing VPC: Prepare a VPC and subnets in the target AWS region. The selected VPC and subnets need internet access through a NAT gateway or internet gateway to reach AWS services. For a Multi-AZ warehouse, prepare three subnets in different availability zones.
- Custom Infrastructure: Prepare and register the network, IAM roles, S3 bucket, and any KMS keys as cloud resource configurations. See Cloud resource preparation.
See also
- Select the deployment option in the preceding table to open its creation guide.
- For Custom Infrastructure, see Cloud resource preparation before opening the creation flow.
- To use customer-managed encryption, see Warehouse Encryption.