Google Cloud Preparation

Creating a BYOC warehouse on Google Cloud involves the following Google Cloud-side tasks:

• Prepare a VPC and subnet.
• (Optional) Review the Terraform template and the resources it creates.

Prepare an existing VPC and subnet

Use an existing VPC only when it and its subnet meet the region, availability-zone, and subnet requirements for the BYOC warehouse. If no VPC and subnet meet these requirements, create them in advance.

Note:

If a VPC and subnet already meet the region, availability zone, and subnet requirements and you want to deploy the BYOC warehouse into them, skip the steps below. For the supported regions, see Supported Regions.

Create a VPC and subnet

1. Open the Google Cloud VPC networks console.

   

2. Click VPC networks > CREATE VPC NETWORK to open the VPC creation page.

3. Enter a VPC Name and select Custom mode.

   

4. Enter a subnet Name, select a supported Region, and enter an IPv4 range. See Supported Regions.

5. Turn off Private Google Access, Flow logs, and Hybrid subnet.

   

6. Clear all checkboxes under Firewall rules.

   

7. Select Regional for Dynamic routing mode, and Legacy for Best path selection mode.

   

8. Click CREATE to finish creating the VPC and subnet.

For more information, see the Google Cloud documentation for creating and managing VPC networks.

Review the Terraform template and resources (optional)

Note:

This section is for review only and does not require you to run anything. To run the deployment command that creates a BYOC warehouse, you or the administrator who runs it need the following IAM permissions listed. Template execution fails if these permissions are missing.

The Terraform template runs in your Google Cloud project and creates or manages resources such as VPC components, Compute Engine instances, and Cloud Storage buckets. It requires the IAM permissions listed below.

Review the Terraform template

The VeloDB Cloud Terraform template runs in your Google Cloud project. Review the template before deployment to understand the resources it creates.

View the Terraform template

When you run the template in Google Cloud Shell, it deploys the Agent. The Agent establishes a private connection to VeloDB Cloud and completes warehouse initialization.

After deployment finishes, open the warehouse in the VeloDB Cloud Console and create a compute cluster for data analysis.

Review the created resources

• Compute Engine instance

  • Name: VeloDBAgent
  • Purpose: Runs the Agent, Prometheus, Fluent Bit, and related programs.

• Private Service Connect endpoint

  • Name: VeloDBEndpoint
  • Purpose: Establishes a private network connection to the VeloDB Cloud management service for control instructions and monitoring and log delivery.

• VPC firewall rules

  • Names: VeloDBSecurityGroupIngress, VeloDBSecurityGroupEgress
  • Purpose: Control traffic for VM instances created for the BYOC warehouse, including subnet traffic to port 5000 and outbound traffic.

• Cloud Storage bucket

  • Name: VeloDBBucket
  • Purpose: Stores warehouse data.

• IAM service accounts, custom role, and bucket key

  • Names:
    • VeloDBControlPlaneRole (control plane service account)
    • VeloDBControlPlaneRolePolicy (custom role policy)
    • VeloDBBucketKey (bucket key)
    • VeloDBDataAccessRole (data-access service account)
  • Purpose: The service account has the permissions required by the Agent. Subsequent control operations use this service account identity.

Review service account permissions

After the Terraform template runs for the first time, it creates a service account that manages resources required by the BYOC warehouse. The following is a list of its permissions.

• Permission summary:

  compute.addresses.create
  compute.addresses.createInternal
  compute.addresses.delete
  compute.addresses.deleteInternal
  compute.addresses.setLabels
  compute.addresses.get
  compute.addresses.list
  compute.addresses.use
  compute.addresses.useInternal
  compute.disks.create
  compute.disks.createTagBinding
  compute.disks.delete
  compute.disks.deleteTagBinding
  compute.disks.get
  compute.disks.list
  compute.disks.resize
  compute.disks.setLabels
  compute.disks.use
  compute.firewalls.create
  compute.firewalls.createTagBinding
  compute.firewalls.delete
  compute.firewalls.deleteTagBinding
  compute.firewalls.get
  compute.firewalls.list
  compute.firewalls.update
  compute.forwardingRules.create
  compute.forwardingRules.delete
  compute.forwardingRules.get
  compute.forwardingRules.setLabels
  compute.instanceGroups.create
  compute.instanceGroups.delete
  compute.instanceGroups.update
  compute.instanceGroups.use
  compute.instances.attachDisk
  compute.instances.create
  compute.instances.createTagBinding
  compute.instances.delete
  compute.instances.deleteTagBinding
  compute.instances.detachDisk
  compute.instances.get
  compute.instances.getEffectiveFirewalls
  compute.instances.list
  compute.instances.listTagBindings
  compute.instances.osAdminLogin
  compute.instances.osLogin
  compute.instances.reset
  compute.instances.resume
  compute.instances.setDiskAutoDelete
  compute.instances.setLabels
  compute.instances.setMachineType
  compute.instances.setMetadata
  compute.instances.setName
  compute.instances.setServiceAccount
  compute.instances.setTags
  compute.instances.start
  compute.instances.stop
  compute.instances.suspend
  compute.instances.update
  compute.instances.use
  compute.networks.get
  compute.networks.list
  compute.networks.updatePolicy
  compute.networks.use
  compute.regionBackendServices.create
  compute.regionBackendServices.createTagBinding
  compute.regionBackendServices.delete
  compute.regionBackendServices.deleteTagBinding
  compute.regionBackendServices.get
  compute.regionBackendServices.getIamPolicy
  compute.regionBackendServices.list
  compute.regionBackendServices.update
  compute.regionBackendServices.use
  compute.regionHealthChecks.create
  compute.regionHealthChecks.delete
  compute.regionHealthChecks.useReadOnly
  compute.subnetworks.get
  compute.subnetworks.list
  compute.subnetworks.use
  compute.zoneOperations.get

The following sections group the permissions by resource type.

• Compute Engine permissions:

  • Manage VM instances.

    compute.disks.create
    compute.disks.createTagBinding
    compute.disks.delete
    compute.disks.deleteTagBinding
    compute.disks.get
    compute.disks.list
    compute.disks.resize
    compute.disks.setLabels
    compute.disks.use
    compute.instanceGroups.create
    compute.instanceGroups.delete
    compute.instanceGroups.update
    compute.instanceGroups.use
    compute.instances.attachDisk
    compute.instances.create
    compute.instances.createTagBinding
    compute.instances.delete
    compute.instances.deleteTagBinding
    compute.instances.detachDisk
    compute.instances.get
    compute.instances.getEffectiveFirewalls
    compute.instances.list
    compute.instances.listTagBindings
    compute.instances.osAdminLogin
    compute.instances.osLogin
    compute.instances.reset
    compute.instances.resume
    compute.instances.setDiskAutoDelete
    compute.instances.setLabels
    compute.instances.setMachineType
    compute.instances.setMetadata
    compute.instances.setName
    compute.instances.setServiceAccount
    compute.instances.setTags
    compute.instances.start
    compute.instances.stop
    compute.instances.suspend
    compute.instances.update
    compute.instances.use

  • Manage firewall rules.

    compute.firewalls.create
    compute.firewalls.createTagBinding
    compute.firewalls.delete
    compute.firewalls.deleteTagBinding
    compute.firewalls.get
    compute.firewalls.list
    compute.firewalls.update

• VPC Network permissions:

  • Get VPC-related resource information.

    compute.networks.get
    compute.networks.list
    compute.networks.updatePolicy
    compute.networks.use
    compute.subnetworks.get
    compute.subnetworks.list
    compute.subnetworks.use
    compute.zoneOperations.get

  • Manage load-balancer resources.

    compute.addresses.create
    compute.addresses.createInternal
    compute.addresses.delete
    compute.addresses.deleteInternal
    compute.addresses.setLabels
    compute.addresses.get
    compute.addresses.list
    compute.addresses.use
    compute.addresses.useInternal
    compute.forwardingRules.create
    compute.forwardingRules.delete
    compute.forwardingRules.get
    compute.forwardingRules.setLabels
    compute.regionBackendServices.create
    compute.regionBackendServices.createTagBinding
    compute.regionBackendServices.delete
    compute.regionBackendServices.deleteTagBinding
    compute.regionBackendServices.get
    compute.regionBackendServices.getIamPolicy
    compute.regionBackendServices.list
    compute.regionBackendServices.update
    compute.regionBackendServices.use
    compute.regionHealthChecks.create
    compute.regionHealthChecks.delete
    compute.regionHealthChecks.useReadOnly

• Cloud Storage permissions:

  • Manage specific buckets and read and write their contents.

    roles/storage.admin

• Account permissions:

  • Allow the newly created service account to be associated with VM instances so that they can perform operations as that service account.

    roles/iam.serviceAccountUser

See also

• Create a BYOC Warehouse on Google Cloud: create a BYOC warehouse with a new or existing VPC.
• Supported Regions: select a supported Google Cloud region.