Console Data-Plane Access Control
VeloDB Cloud BYOC separates administrative control-plane operations from production query execution. Warehouse compute, data access, and query processing run inside the customer-managed BYOC environment, while the VeloDB Cloud control plane provides deployment, lifecycle management, monitoring, support, and platform administration.
In this guide, Console data-plane operations are actions in the VeloDB Cloud Console that require communication with a warehouse to read, write, or inspect data. Examples include running queries in SQL Editor, importing data through Import Data, and viewing query activity in Query Audit. This control is broader than SQL Editor alone.
Govern console data-plane access
| Your goal | Recommended next step |
|---|---|
| Limit Console data-plane operations over the public access path to trusted source IP addresses. | Open Warehouse Settings > Security. In the Public IP Allowlist row, click Edit IP Allowlist, select Specific IP addresses, enter the trusted IP addresses or CIDR blocks, and click Save changes. |
| Disable Console data-plane operations across the organization. | Contact VeloDB Cloud Support. This is not a self-service setting. |
| Govern who can access a warehouse. | Review Identity and Access. |
| Govern direct private connections. | Use the private-network controls applicable to your deployment. The Public IP Allowlist does not apply to direct private connections. |
| Discuss a non-standard deployment requirement. | Contact VeloDB Cloud Support. Deployment-specific arrangements are evaluated case by case and are not part of the standard product offering. |
BYOC does not expose a separate public endpoint for direct warehouse connections. The Public IP Allowlist restricts the source IP addresses from which users can perform Console data-plane operations. It does not affect control-plane operations, such as creating, deleting, or scaling resources. It also does not apply to direct private connections.
Selecting No public access blocks Console data-plane operations through the public access path. If no private access path is configured, Console features that require warehouse connectivity cannot reach the warehouse. This setting does not disable those operations across the organization or affect direct private connections.
To request organization-wide disablement, contact VeloDB Cloud Support. Organization-wide disablement blocks the Console-to-warehouse data channel used by SQL Editor, Import Data, Query Audit, and other Console features that require warehouse connectivity. Control-plane operations remain available.
For the full connection workflow, see Connect to a BYOC Warehouse. For the deployment-level network model, see BYOC Network Security.
Control plane and query execution
In a BYOC deployment, the VeloDB Cloud control plane manages operational workflows such as provisioning, scaling, upgrades, monitoring, alerting, and support coordination. VeloDB Cloud services deployed in the customer's cloud account execute production queries.
This separation means:
- Query processing occurs in the customer-managed BYOC environment.
- Data access and result generation occur in the customer data plane.
- Control-plane services manage administrative and operational workflows.
- SQL access can be controlled separately from administrative access to the Console.
This model keeps production data under the customer's cloud-account controls while providing centralized operations through the VeloDB Cloud control plane.