Console Data-Plane Access Control
VeloDB BYOC separates administrative control-plane operations from production query execution. Warehouse compute, data access, and query processing run inside the customer-managed BYOC environment, while the VeloDB control plane provides deployment, lifecycle management, monitoring, support, and platform administration.
In this guide, Console data-plane operations are actions in the VeloDB Console that require communication with a warehouse to read, write, or inspect data. Examples include running queries in SQL Editor, importing data through Import Data, and viewing query activity in Query Audit. This control is broader than SQL Editor alone.
Govern Console Data-Plane Access
| Your goal | Recommended next step |
|---|---|
| Limit Console data-plane operations over the public access path to trusted source IP addresses. | Open Connection. Under Public Access Allowlist, select Edit IP Allowlist, then choose Anywhere, Nowhere, or Specific Locations. |
| Disable Console data-plane operations across the organization. | Contact VeloDB Support. This is not a self-service setting. |
| Govern who can access a warehouse. | Review Identity and Access. |
| Govern direct private connections. | Use the private-network controls applicable to your deployment. The Public Access Allowlist does not apply to direct private connections. |
| Discuss a non-standard deployment requirement. | Contact VeloDB Support. Deployment-specific arrangements are evaluated case by case and are not part of the standard product offering. |
BYOC does not expose a separate public endpoint for direct warehouse connections. The BYOC Public Access Allowlist restricts the source IP addresses from which users can perform Console data-plane operations. It does not affect control-plane operations, such as creating, deleting, or scaling resources. It also does not apply to direct private connections.
Selecting Nowhere blocks Console data-plane operations through the public access path. If no private access path is configured, Console features that require warehouse connectivity cannot reach the warehouse. This setting does not disable those operations across the organization or affect direct private connections.
To request organization-wide disablement, contact VeloDB Support. Organization-wide disablement blocks the Console-to-warehouse data channel used by SQL Editor, Import Data, Query Audit, and other Console features that require warehouse connectivity. Control-plane operations remain available.
For the full connection workflow, see Connect to a BYOC Warehouse. For the deployment-level network model, see Network Security.
Control Plane and Query Execution
In a BYOC deployment, the VeloDB control plane manages operational workflows such as provisioning, scaling, upgrades, monitoring, alerting, and support coordination. VeloDB services deployed in the customer's cloud account execute production queries.
This separation means:
- Query processing occurs in the customer-managed BYOC environment.
- Data access and result generation occur in the customer data plane.
- Control-plane services manage administrative and operational workflows.
- SQL access can be controlled separately from administrative access to the Console.
This model keeps production data under the customer's cloud-account controls while providing centralized operations through the VeloDB control plane.