Network Security
BYOC warehouses run inside your cloud environment. Your VPC or VNet provides the network path for direct warehouse connections, while VeloDB Cloud provides separate controls for Console data-plane access.
Network and Resource Placement
Warehouse compute and customer storage are deployed in your cloud environment. When you create the first BYOC warehouse, the setup flow guides you to select or create the VPC or VNet and subnets used by the warehouse. You can deploy additional warehouses into an existing supported network.
Provider-specific creation guides document the required network preparation:
| Cloud provider | Network preparation |
|---|---|
| AWS | Choose template mode or wizard mode to create or select the required cloud resources. |
| Google Cloud | Prepare a VPC and subnet as described in Create BYOC Warehouse on Google Cloud. |
| Azure | Prepare a VNet and subnet as described in Create BYOC Warehouse on Azure. |
Direct Warehouse Connectivity
Applications connect directly to a BYOC warehouse through your cloud network. VeloDB Cloud does not expose a separate VeloDB-managed public endpoint for direct warehouse connections. Use routing, security groups, firewall rules, network ACLs, and other controls in your cloud environment to govern this path.
Avoid modifying or deleting VeloDB-managed security groups, private endpoints, or other network resources unless the documentation instructs you to do so. Direct changes can make the warehouse unavailable. For broader resource-handling guidance, see BYOC Security Overview.
Public Access Allowlist for Console Operations
The Public Access Allowlist restricts the source IP addresses from which users can perform Console data-plane operations through the public access path. These operations include running queries in SQL Editor, importing data through Import Data, and viewing query activity in Query Audit.
Open the warehouse Connection page and use Public Access Allowlist > Edit IP Allowlist to configure this control.
The allowlist does not affect control-plane operations, such as creating, deleting, or scaling resources. It also does not govern direct warehouse connections through your cloud network.
Selecting Nowhere blocks Console data-plane operations through the public access path. If no private access path is configured, Console features that require warehouse connectivity cannot reach the warehouse. This is not an organization-wide disablement control. To request organization-wide disablement, contact VeloDB Support.
For the complete workflow, see Connect to a BYOC Warehouse.
Private Access for the Warehouse-Specific Console Endpoint
You can route warehouse-specific Console data-plane traffic through a private endpoint in your cloud network. This path is separate from direct connectivity to the warehouse backend and does not change your cloud network controls for direct warehouse connections.
For the supported cloud providers and configuration workflow, see Private connectivity to the warehouse-specific Console endpoint.