Network Configuration

A Network configuration references a credential and defines where the warehouse runs: the subnets, the security group, and an optional VPC endpoint for private connectivity. In the console you create it with Add Network and choose Single-AZ or Multi-AZ. After you enter the network name, credential, subnets, security group, and any VPC endpoint, click Confirm.

You can reuse an existing network (VPC, subnets, and security group). Make sure it meets VeloDB Cloud's requirements, described in the sections below.

VPC and subnets

A VPC that matches VeloDB Cloud's network requirements is a prerequisite for the Existing VPC and Custom Infrastructure options. For Existing VPC, you select the prepared VPC in the creation flow. For Custom Infrastructure, you register its subnets through Add Network. For New VPC, the template creates the VPC and subnets for you.

Multi-AZ deployment is available in every option and is determined by the subnets the warehouse uses. Multi-AZ is recommended for greater resilience.

• Multi-AZ (recommended): use three subnets, each in a different availability zone. In the Existing VPC and Custom Infrastructure options you provide the three subnets. In Custom Infrastructure, you also enable Multiple Availability Zones in Add Network.
• Single-AZ: use one subnet.

We recommend a public and a private subnet in each availability zone, with VeloDB deployed in the private subnets.

1. Sign in to the AWS VPC Console as an administrator.

2. Select the target region and click Create VPC.

3. Resources to create: VPC and more.

4. Adjust these fields (keep other defaults):

   Field	Value
   Name tag	e.g. velodb-vpc
   IPv4 CIDR block	Your preferred starting IP and size.
   Number of Availability Zones	3 for Multi-AZ (default), or 1 for Single-AZ
   Number of public subnets	1 per availability zone
   Number of private subnets	1 per availability zone
   NAT gateways	1 per availability zone
   VPC Endpoints	S3 Gateway (reduces NAT charges; access S3 privately)

5. Click Create VPC, then View VPC when the workflow completes.

We recommend the VPC and more option because it provisions the subnets, NAT gateways, and endpoints together. Selecting S3 Gateway under VPC Endpoints creates the S3 gateway endpoint as part of this workflow, so you can skip the standalone step below.

Security groups

A security group is a virtual firewall that controls traffic to its associated AWS resources. You typically need two security groups for BYOC:

• EC2 security group: you provide this one to the VeloDB Cloud console as the Security Group ID in your network configuration. VeloDB Cloud attaches it to the EC2 instances it creates for the warehouse.
• VPC-endpoint security group: you attach this one to the private endpoint to VeloDB.

For EC2

1. In the VPC Console, go to Security groups → Create security group.
2. Name it (for example, velodb-server-sg) and select the VPC.
3. Add inbound rules:
   • Rule 1: Type All TCP, Source this security group.
   • Rule 2: Type Custom TCP, Port range 8000-10000, Source the CIDR of the VPCs that need to reach the warehouse.
4. Leave outbound rules as the default (all outbound allowed).
5. Click Save rules and copy the Security group ID for the VeloDB console.

For VPC endpoints

1. In the VPC Console, go to Security groups → Create security group.
2. Name it (for example, velodb-endpoint-sg) and select the VPC.
3. Add the same inbound rules as above:
   • Rule 1: Type All TCP, Source this security group.
   • Rule 2: Type Custom TCP, Port range 8000-10000, Source the CIDR of the VPCs that need to reach the warehouse.
4. Leave outbound rules as the default.
5. Click Save rules.

Private endpoint to VeloDB

To keep BYOC traffic on the AWS backbone, create a private endpoint so your warehouse connects to the VeloDB Cloud service over PrivateLink instead of the public internet.

1. In the VPC Console, go to Endpoints → Create endpoint.

2. Fill in:

   Field	Value
   Name	e.g. vpce-for-velodb
   Service category	PrivateLink Ready partner services
   Service name	Copy the VeloDB PrivateLink service name for the warehouse region from AWS PrivateLink for VeloDB Services. Click Verify service: you should see "Service name verified".
   VPC	The VPC to create the endpoint in.
   Subnets	The private subnets for the endpoint's network interfaces.
   Security group	The VPC-endpoint security group you created above (e.g. velodb-endpoint-sg).
   Policy	Full access (typical).

3. Click Create endpoint.

S3 gateway endpoint

An S3 gateway endpoint gives instances in your VPC private connectivity to S3, avoiding the public internet and reducing NAT-gateway charges when S3 traffic would otherwise use a NAT gateway.

注記

If you selected S3 Gateway while creating the VPC with VPC and more, this endpoint already exists and you can skip this section.

1. In the VPC Console, go to Endpoints → Create endpoint.

2. Fill in:

   Field	Value
   Name	e.g. vpce-for-s3-gateway
   Service category	AWS services
   Services	Search S3, pick com.amazonaws.{region}.s3 with type Gateway.
   VPC	The VPC to create the endpoint in.
   Route tables	The route tables associated with your private subnets.
   Policy	Full access or Custom.

3. Click Create endpoint.