Skip to main content

Network Configuration

A Network configuration references a credential and defines where the warehouse runs: the subnets, the security group, and an optional VPC endpoint for private connectivity. In the console you create it with Add Network and choose Single-AZ or Multi-AZ. After you enter the network name, credential, subnets, security group, and any VPC endpoint, click Confirm.

You can reuse an existing network (VPC, subnets, and security group). Make sure it meets VeloDB Cloud's requirements, described in the sections below.

VPC and subnets​

A VPC that matches VeloDB Cloud's network requirements is a prerequisite for the Existing VPC and Custom Infrastructure options. For Existing VPC, you select the prepared VPC in the creation flow. For Custom Infrastructure, you register its subnets through Add Network. For New VPC, the template creates the VPC and subnets for you.

Multi-AZ deployment is available in every option and is determined by the subnets the warehouse uses. Multi-AZ is recommended for greater resilience.

  • Multi-AZ (recommended): use three subnets, each in a different availability zone. In the Existing VPC and Custom Infrastructure options you provide the three subnets. In Custom Infrastructure, you also enable Multiple Availability Zones in Add Network.
  • Single-AZ: use one subnet.

We recommend a public and a private subnet in each availability zone, with VeloDB deployed in the private subnets.

  1. Sign in to the AWS VPC Console as an administrator.

  2. Select the target region and click Create VPC.

  3. Resources to create: VPC and more.

  4. Adjust these fields (keep other defaults):

    FieldValue
    Name tage.g. velodb-vpc
    IPv4 CIDR blockYour preferred starting IP and size.
    Number of Availability Zones3 for Multi-AZ (default), or 1 for Single-AZ
    Number of public subnets1 per availability zone
    Number of private subnets1 per availability zone
    NAT gateways1 per availability zone
    VPC EndpointsS3 Gateway (reduces NAT charges; access S3 privately)

  5. Click Create VPC, then View VPC when the workflow completes.

We recommend the VPC and more option because it provisions the subnets, NAT gateways, and endpoints together. Selecting S3 Gateway under VPC Endpoints creates the S3 gateway endpoint as part of this workflow, so you can skip the standalone step below.

create-vpc-overview

create-vpc-overview2

view-vpc

Security groups​

A security group is a virtual firewall that controls traffic to its associated AWS resources. You typically need two security groups for BYOC:

  • EC2 security group: you provide this one to the VeloDB Cloud console as the Security Group ID in your network configuration. VeloDB Cloud attaches it to the EC2 instances it creates for the warehouse.
  • VPC-endpoint security group: you attach this one to the private endpoint to VeloDB.

For EC2​

  1. In the VPC Console, go to Security groups → Create security group.
  2. Name it (for example, velodb-server-sg) and select the VPC.
  3. Add inbound rules:
    • Rule 1: Type All TCP, Source this security group.
    • Rule 2: Type Custom TCP, Port range 8000-10000, Source the CIDR of the VPCs that need to reach the warehouse.
  4. Leave outbound rules as the default (all outbound allowed).
  5. Click Save rules and copy the Security group ID for the VeloDB console.

For VPC endpoints​

  1. In the VPC Console, go to Security groups → Create security group.
  2. Name it (for example, velodb-endpoint-sg) and select the VPC.
  3. Add the same inbound rules as above:
    • Rule 1: Type All TCP, Source this security group.
    • Rule 2: Type Custom TCP, Port range 8000-10000, Source the CIDR of the VPCs that need to reach the warehouse.
  4. Leave outbound rules as the default.
  5. Click Save rules.

Private endpoint to VeloDB​

To keep BYOC traffic on the AWS backbone, create a private endpoint so your warehouse connects to the VeloDB Cloud service over PrivateLink instead of the public internet.

  1. In the VPC Console, go to Endpoints → Create endpoint.

  2. Fill in:

    FieldValue
    Namee.g. vpce-for-velodb
    Service categoryPrivateLink Ready partner services
    Service nameCopy the VeloDB PrivateLink service name for the warehouse region from AWS PrivateLink for VeloDB Services. Click Verify service: you should see "Service name verified".
    VPCThe VPC to create the endpoint in.
    SubnetsThe private subnets for the endpoint's network interfaces.
    Security groupThe VPC-endpoint security group you created above (e.g. velodb-endpoint-sg).
    PolicyFull access (typical).

  3. Click Create endpoint.

S3 gateway endpoint​

An S3 gateway endpoint gives instances in your VPC private connectivity to S3, avoiding the public internet and reducing NAT-gateway charges when S3 traffic would otherwise use a NAT gateway.

note

If you selected S3 Gateway while creating the VPC with VPC and more, this endpoint already exists and you can skip this section.

  1. In the VPC Console, go to Endpoints → Create endpoint.

  2. Fill in:

    FieldValue
    Namee.g. vpce-for-s3-gateway
    Service categoryAWS services
    ServicesSearch S3, pick com.amazonaws.{region}.s3 with type Gateway.
    VPCThe VPC to create the endpoint in.
    Route tablesThe route tables associated with your private subnets.
    PolicyFull access or Custom.

  3. Click Create endpoint.