Skip to main content

Azure Preparation

Creating a BYOC warehouse on Azure involves two Azure-side tasks: preparing a VNet and subnet, and (optionally) reviewing the resource orchestration template and the Deployment Stack it creates.

Prepare a VNet and subnet​

You only need this if you deploy into an existing VNet. If no VNet and subnet meet the requirements, create them in advance.

note

If a VNet and subnet already meet the region, availability zone, and subnet requirements and you want to deploy the BYOC warehouse into them, skip the steps below. For the supported regions, see Supported Regions.

Create a VNet and subnet​

  1. In the Azure portal, open the Virtual networks service and click Create.

    vnet create 1

  2. Select the Subscription and Resource Group, enter a Virtual network name, select a supported Region, then click Next.

    vnet create 2

  3. Click + Add a subnet, then click Edit.

    vnet create 3

  4. Enter a Name, specify the subnet range, click Save, then click Next.

    note

    To allow outbound internet access, specify a NAT gateway when you create the subnet.

    vnet create 4

  5. Click Create.

    vnet create 5

Understand the template and Deployment Stack (optional)​

note

You do not need to do anything in this section. Read on only if you want to understand how the deployment works.

When you deploy the template as a Deployment Stack under your cloud account, it operates on cloud resources such as the VNet, virtual machines, and storage account, so it requires a set of IAM permissions.

Use administrator privileges to deploy the template, or ask your administrator to do it for you. Otherwise the deployment can fail because of insufficient permissions.

About the template​

The template that VeloDB provides runs under your cloud account. Its code is visible and auditable, and it does not touch your data or other environments in the VNet. You can review the template at this link:

https://onlinevelodbwestus3.blob.core.windows.net/velodb-cloud-online-westus3/public/azure-westus3-byoc-cf.json

When you deploy the template as a Deployment Stack, it creates and deploys the Agent. The Agent then establishes a private connection with VeloDB Cloud and completes the warehouse initialization.

After the deployment finishes, open the warehouse from the VeloDB Cloud console and create a compute cluster for data analysis, the same as with any other warehouse.

View Deployment Stack resources​

You can view all resources the VeloDB template created, and look up a specific resource by name, in the Deployment Stack.

note

All resources the template creates belong to your cloud account. They are used only within your VNet and are not exposed externally.

  • Virtual Machine
    • Name: VeloDBAgent
    • Purpose: Used to deploy Agent, Prometheus, FluentBit and other programs
  • Private Endpoint
    • Name: VeloDBEndpoint
    • Purpose: Establish a private network connection (PrivateLink Connection) with the VeloDB Manage service, so that you can pull control instructions and push monitoring and logs in one direction
  • Network SecurityGroup
    • Name: VeloDBSecurityGroupIngress, VeloDBSecurityGroupEgress
    • Purpose: Bound to the endpoint and all Virtual Machines created by VeloDB, and restrict inbound and outbound traffic for specific ports and sources through firewall rules
  • Storage Account
    • Name: VeloDBBucket
    • Purpose: Used to store data warehouse data
  • User-Assigned Managed Identity & Role Definition
    • Name:
      • VeloDBDataAccessIdentity (Kernel-side managed identity), VeloDBAgentIdentity (Control-side managed identity)
      • VeloDBControlPlaneRole (Custom role permissions bound to the control-side managed identity)
      • Purpose: The created user-assigned managed identity has the minimum permission policy required by the Agent, and all subsequent control operations are carried out using the identity of VeloDBAgentIdentity

Permissions of the user-assigned managed identity​

After you first deploy the template as a Deployment Stack, all management and control operations run with the permissions of the user-assigned managed identity. The following is an excerpt from the template.

  • Permission summary:

    'Microsoft.Compute/register/action'
    'Microsoft.Compute/virtualMachines/read'
    'Microsoft.Compute/virtualMachines/write'
    'Microsoft.Compute/virtualMachines/delete'
    'Microsoft.Compute/virtualMachines/start/action'
    'Microsoft.Compute/virtualMachines/powerOff/action'
    'Microsoft.Compute/virtualMachines/redeploy/action'
    'Microsoft.Compute/virtualMachines/restart/action'
    'Microsoft.Compute/virtualMachines/deallocate/action'
    'Microsoft.Compute/virtualMachines/runCommand/action'
    'Microsoft.Compute/virtualMachines/attachDetachDataDisks/action'
    'Microsoft.Compute/virtualMachines/vmSizes/read'
    'Microsoft.Compute/virtualMachines/runCommands/read'
    'Microsoft.Compute/virtualMachines/runCommands/write'
    'Microsoft.Compute/virtualMachines/instanceView/read'
    'Microsoft.Compute/virtualMachines/extensions/read'
    'Microsoft.Compute/locations/diskOperations/read'
    'Microsoft.Compute/disks/read'
    'Microsoft.Compute/disks/write'
    'Microsoft.Compute/disks/delete'
    'Microsoft.Compute/skus/read'
    'Microsoft.Compute/locations/usages/read'
    'Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/read'
    'Microsoft.Compute/locations/publishers/artifacttypes/offers/read'
    'Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/versions/read'
    'Microsoft.Compute/operations/read'
    'Microsoft.Compute/images/read'
    'Microsoft.Compute/locations/operations/read'
    'Microsoft.Compute/locations/vmSizes/read'
    'Microsoft.Compute/locations/runCommands/read'
    'Microsoft.Network/register/action'
    'Microsoft.Network/operations/read'
    'Microsoft.Network/loadBalancers/read'
    'Microsoft.Network/loadBalancers/write'
    'Microsoft.Network/loadBalancers/delete'
    'Microsoft.Network/loadBalancers/health/action'
    'Microsoft.Network/loadBalancers/backendAddressPools/queryInboundNatRulePortMapping/action'
    'Microsoft.Network/loadBalancers/backendAddressPools/updateAdminState/action'
    'Microsoft.Network/loadBalancers/backendAddressPools/health/action'
    'Microsoft.Network/loadBalancers/backendAddressPools/read'
    'Microsoft.Network/loadBalancers/backendAddressPools/write'
    'Microsoft.Network/loadBalancers/backendAddressPools/delete'
    'Microsoft.Network/loadBalancers/backendAddressPools/backendPoolAddresses/read'
    'Microsoft.Network/loadBalancers/backendAddressPools/join/action'
    'Microsoft.Network/loadBalancers/providers/Microsoft.Insights/diagnosticSettings/read'
    'Microsoft.Network/loadBalancers/providers/Microsoft.Insights/diagnosticSettings/write'
    'Microsoft.Network/loadBalancers/frontendIPConfigurations/read'
    'Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action'
    'Microsoft.Network/loadBalancers/frontendIPConfigurations/loadBalancerPools/read'
    'Microsoft.Network/loadBalancers/frontendIPConfigurations/loadBalancerPools/write'
    'Microsoft.Network/loadBalancers/frontendIPConfigurations/loadBalancerPools/delete'
    'Microsoft.Network/loadBalancers/loadBalancingRules/read'
    'Microsoft.Network/loadBalancers/loadBalancingRules/health/action'
    'Microsoft.Network/loadBalancers/networkInterfaces/read'
    'Microsoft.Network/loadBalancers/outboundRules/read'
    'Microsoft.Network/loadBalancers/virtualMachines/read'
    'Microsoft.Network/loadBalancers/probes/read'
    'Microsoft.Network/loadBalancers/probes/join/action'
    'Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read'
    'Microsoft.Network/networkInterfaces/read'
    'Microsoft.Network/networkInterfaces/write'
    'Microsoft.Network/networkInterfaces/join/action'
    'Microsoft.Network/networkInterfaces/delete'
    'Microsoft.Network/networkInterfaces/effectiveRouteTable/action'
    'Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action'
    'Microsoft.Network/networkInterfaces/ipconfigurations/read'
    'Microsoft.Network/networkInterfaces/loadBalancers/read'
    'Microsoft.Network/networkSecurityGroups/read'
    'Microsoft.Network/networkSecurityGroups/write'
    'Microsoft.Network/networkSecurityGroups/delete'
    'Microsoft.Network/networkSecurityGroups/join/action'
    'Microsoft.Network/virtualNetworks/read'
    'Microsoft.Network/virtualNetworks/joinLoadBalancer/action'
    'Microsoft.Network/virtualNetworks/subnets/read'
    'Microsoft.Network/virtualNetworks/subnets/join/action'
    'Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action'
    'Microsoft.Network/ipAllocations/read'
    'Microsoft.Network/publicIPAddresses/read'
    'Microsoft.Storage/storageAccounts/blobServices/containers/read'
    'Microsoft.Storage/storageAccounts/blobServices/containers/write'
    'Microsoft.Storage/storageAccounts/blobServices/containers/delete'

The specific permissions are divided as follows:

  • Virtual Machine permissions:

    • Manage vm instances

      'Microsoft.Compute/register/action'
      'Microsoft.Compute/virtualMachines/read'
      'Microsoft.Compute/virtualMachines/write'
      'Microsoft.Compute/virtualMachines/delete'
      'Microsoft.Compute/virtualMachines/start/action'
      'Microsoft.Compute/virtualMachines/powerOff/action'
      'Microsoft.Compute/virtualMachines/redeploy/action'
      'Microsoft.Compute/virtualMachines/restart/action'
      'Microsoft.Compute/virtualMachines/deallocate/action'
      'Microsoft.Compute/virtualMachines/runCommand/action'
      'Microsoft.Compute/virtualMachines/attachDetachDataDisks/action'
      'Microsoft.Compute/virtualMachines/vmSizes/read'
      'Microsoft.Compute/virtualMachines/runCommands/read'
      'Microsoft.Compute/virtualMachines/runCommands/write'
      'Microsoft.Compute/virtualMachines/instanceView/read'
      'Microsoft.Compute/virtualMachines/extensions/read'
      'Microsoft.Compute/locations/diskOperations/read'
      'Microsoft.Compute/disks/read'
      'Microsoft.Compute/disks/write'
      'Microsoft.Compute/disks/delete'
      'Microsoft.Compute/skus/read'
      'Microsoft.Compute/locations/usages/read'
      'Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/read'
      'Microsoft.Compute/locations/publishers/artifacttypes/offers/read'
      'Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/versions/read'
      'Microsoft.Compute/operations/read'
      'Microsoft.Compute/images/read'
      'Microsoft.Compute/locations/operations/read'
      'Microsoft.Compute/locations/vmSizes/read'
      'Microsoft.Compute/locations/runCommands/read'

  • Virtual Networks permissions:

    • Read VNet resources

      'Microsoft.Network/register/action'
      'Microsoft.Network/operations/read'
      'Microsoft.Network/virtualNetworks/read'
      'Microsoft.Network/virtualNetworks/joinLoadBalancer/action'
      'Microsoft.Network/virtualNetworks/subnets/read'
      'Microsoft.Network/virtualNetworks/subnets/join/action'
      'Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action'
      'Microsoft.Network/ipAllocations/read'
      'Microsoft.Network/publicIPAddresses/read'

    • Manage network interface and security group resources

      'Microsoft.Network/networkInterfaces/read'
      'Microsoft.Network/networkInterfaces/write'
      'Microsoft.Network/networkInterfaces/join/action'
      'Microsoft.Network/networkInterfaces/delete'
      'Microsoft.Network/networkInterfaces/effectiveRouteTable/action'
      'Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action'
      'Microsoft.Network/networkInterfaces/ipconfigurations/read'
      'Microsoft.Network/networkInterfaces/loadBalancers/read'
      'Microsoft.Network/networkSecurityGroups/read'
      'Microsoft.Network/networkSecurityGroups/write'
      'Microsoft.Network/networkSecurityGroups/delete'
      'Microsoft.Network/networkSecurityGroups/join/action'

    • Manage load balancer resources

      'Microsoft.Network/loadBalancers/read'
      'Microsoft.Network/loadBalancers/write'
      'Microsoft.Network/loadBalancers/delete'
      'Microsoft.Network/loadBalancers/health/action'
      'Microsoft.Network/loadBalancers/backendAddressPools/queryInboundNatRulePortMapping/action'
      'Microsoft.Network/loadBalancers/backendAddressPools/updateAdminState/action'
      'Microsoft.Network/loadBalancers/backendAddressPools/health/action'
      'Microsoft.Network/loadBalancers/backendAddressPools/read'
      'Microsoft.Network/loadBalancers/backendAddressPools/write'
      'Microsoft.Network/loadBalancers/backendAddressPools/delete'
      'Microsoft.Network/loadBalancers/backendAddressPools/backendPoolAddresses/read'
      'Microsoft.Network/loadBalancers/backendAddressPools/join/action'
      'Microsoft.Network/loadBalancers/providers/Microsoft.Insights/diagnosticSettings/read'
      'Microsoft.Network/loadBalancers/providers/Microsoft.Insights/diagnosticSettings/write'
      'Microsoft.Network/loadBalancers/frontendIPConfigurations/read'
      'Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action'
      'Microsoft.Network/loadBalancers/frontendIPConfigurations/loadBalancerPools/read'
      'Microsoft.Network/loadBalancers/frontendIPConfigurations/loadBalancerPools/write'
      'Microsoft.Network/loadBalancers/frontendIPConfigurations/loadBalancerPools/delete'
      'Microsoft.Network/loadBalancers/loadBalancingRules/read'
      'Microsoft.Network/loadBalancers/loadBalancingRules/health/action'
      'Microsoft.Network/loadBalancers/networkInterfaces/read'
      'Microsoft.Network/loadBalancers/outboundRules/read'
      'Microsoft.Network/loadBalancers/virtualMachines/read'
      'Microsoft.Network/loadBalancers/probes/read'
      'Microsoft.Network/loadBalancers/probes/join/action'
      'Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read'

  • Storage Account Container Permissions:

    • Manage storage account containers

      'Microsoft.Storage/storageAccounts/blobServices/containers/read'
      'Microsoft.Storage/storageAccounts/blobServices/containers/write'
      'Microsoft.Storage/storageAccounts/blobServices/containers/delete'

  • IAM permissions:

    • Assign user-assigned managed identity

      'Microsoft.ManagedIdentity/userAssignedIdentities/read'
      'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action'