Prepare Cloud Resources for an AWS BYOC Warehouse
Prepare cloud resources before you create a VeloDB Cloud BYOC warehouse with the Custom Infrastructure option. You create the AWS resources, then register their identifiers as configurations on the Cloud Resources page in the VeloDB Cloud console.
1. Choose a deployment option
The resources you prepare depend on the AWS deployment option.
| Deployment option | What you prepare |
|---|---|
| New VPC | No cloud resources. The VeloDB Cloud-provided CloudFormation template creates the VPC and all required resources. You need AWS permissions to create the stack. |
| Existing VPC | An existing VPC and subnets that meet the network requirements. The CloudFormation template creates the remaining resources. |
| Custom Infrastructure | All required AWS resources, registered as a Credential configuration, a Network configuration, and, optionally, an Encryption key configuration. Continue with this page. |
Only the Custom Infrastructure option requires you to prepare and register cloud resources. The other options create the required resources in a new or existing VPC.
2. Before you begin
Before creating configurations for Custom Infrastructure, make these decisions and confirm your access:
- You must be an organization administrator to open the Cloud Resources page.
- Select the AWS region for the warehouse. The S3 bucket, VPC, subnets, security group, VPC endpoint, and any KMS key must be in this region.
- Choose Single-AZ or Multi-AZ. Multi-AZ requires three subnets in different availability zones.
- Decide whether the warehouse needs private connectivity. If it does, create a VPC endpoint to VeloDB Cloud.
- Decide whether the warehouse needs customer-managed encryption. An EBS encryption key must be selected during warehouse creation and cannot be changed later. You can change a TDE encryption key after creation.
3. Prepare Custom Infrastructure resources
Create the underlying resources in the AWS console, then register them in the VeloDB Cloud console. The configuration pages provide the exact AWS policies, console fields, and validation steps.
| Configuration | What VeloDB Cloud needs | You create in the AWS console | You enter in the VeloDB Cloud console |
|---|---|---|---|
| Credential | Storage for warehouse data, plus permission to access it and to deploy compute | An S3 bucket, a data-access IAM role, and a cross-account IAM role | Bucket Name, Instance Profile ARN, and Cross-Account Role ARN |
| Network | Where the warehouse runs, and its network firewall | A VPC and subnets, a security group, and, for private connectivity, a PrivateLink endpoint | Subnet ID (one, or three for Multi-AZ), Security Group ID, and VPC Endpoint ID (optional) |
| Encryption keys (optional) | A customer-managed key for TDE, EBS encryption, or both | A KMS key with a key policy that grants VeloDB Cloud access | AWS Key ARN |
4. Create and register cloud resources
You can register each configuration in advance from the Cloud Resources page or while creating a warehouse deployed on Custom Infrastructure. Configurations are saved and can be reused by other warehouses.
Create cloud resources in advance
The console has two navigation scopes, each with its own left-hand menu:
- An organization view
- A warehouse view
To create cloud resources in advance, open Cloud Resources in the organization view:
- Log in to the VeloDB Cloud console.
- In the upper-left corner, click the organization name to open the Organization Overview page.
- In the left navigation pane, click Cloud Resources.
- View existing configurations on the Credential Configuration, Network Configuration, and Encryption Keys Configuration tabs. To add a configuration, click Add New Configuration, then select its type from the dropdown menu.
For details on creating each configuration, see the following pages:
Create cloud resources during warehouse creation
You can also create the cloud resources while creating a warehouse deployed on Custom Infrastructure. For more information, see the Custom Infrastructure page.