Create a BYOC Warehouse on AWS
When you create a BYOC warehouse on AWS, you choose one of three deployment options. They differ in how much of the network and infrastructure the template creates for you versus how much you prepare yourself, and in whether you can bring your own encryption key.
| Option | Who creates the infrastructure | Best for |
|---|---|---|
| New VPC | You run a VeloDB-provided template that creates a new VPC and the other resources the warehouse needs, configured for you with recommended security settings. | Your first BYOC deployment, or fast setup when you have no VPC to reuse. |
| Existing VPC | You select an existing VPC and subnets, and the template creates the remaining resources in your network. | Reusing an existing VPC and networking for production workloads. |
| Custom Infrastructure | You provide and manage the infrastructure (VPC, subnets, security group, IAM roles, S3 bucket, and optional KMS keys). | Existing cloud infrastructure, customer-managed networking and security, and full customization. |
Custom Infrastructure is available only on AWS. It is also the only option that lets you bring your own encryption key (CMK for TDE and CMK for EBS).
Choose a deployment option
- Use Deploy in a New VPC when you want the fastest path and are comfortable letting VeloDB Cloud create the VPC.
- Use Deploy in an Existing VPC when you already have a VPC and subnets you want the warehouse to run in.
- Use Custom Infrastructure when you manage your own network and security, or when you need customer-managed encryption keys.
Before you start
BYOC resources run in your own AWS account, so complete this preparation before you begin:
- An AWS account with permissions to create the required resources. The New VPC and Existing VPC options launch an AWS CloudFormation stack, which needs sufficient IAM permissions. If you lack them, you can copy the CloudFormation URL and send it to your AWS administrator.
- For Existing VPC, a VPC and subnets in the target region. The selected VPC and subnet must have internet access (through a NAT gateway or internet gateway) to reach AWS services.
- For Custom Infrastructure, the network, IAM roles, storage, and any KMS keys must exist in advance. See Cloud resource preparation.
Related documentation
- Cloud resource preparation: the AWS resources a BYOC warehouse needs and how to create them.
- Warehouse Encryption: Transparent Data Encryption (TDE) and EBS encryption with customer-managed keys.