📣

TiDB Cloud Premium is now in public preview. Unlimited growth, instant elasticity, advanced security for enterprise workloads. Try it out →

Configure TiDB Cloud BYOC IAM Permissions

Once the AWS environment is prepared, you must authorize the TiDB Cloud Control Plane to manage resources within your account. This is achieved by executing a bootstrapping script that establishes the necessary IAM Roles based on the Principle of Least Privilege.

Preparation

Before executing the script, ensure you have the following:

AWS CLI installed: The CLI must be configured with an Access Key that has permissions to create IAM roles and policies.
TiDB Cloud account info: Contact your TiDB Cloud support representative to obtain the Control Plane Account ID and Clinic Account ID.

Gather parameters

Use the table below to map the required parameters for the script:

Parameter	Source	Description
`<ControlPlaneAccountId>`	TiDB Support	The AWS Account ID of the TiDB Control Plane.
`<ClinicAccountId>`	TiDB Support	The AWS Account ID for the TiDB Clinic service.
`<TidbHostedZoneId>`	Required information	The ID of the TiDB Cluster Hosted Zone you created.
`<TidbPCAArn>`	Required information	The ARN of the Private CA you created.

Execute bootstrapping script

Download the script from the PingCAP GitHub repository.

In your terminal, run the following command. Note to replace the placeholders with your actual values.

sh tidbcloud-byoc-setup.sh \
    --control-plane-id <ControlPlaneAccountId> \
    --clinic-id <ClinicAccountId> \
    --tidb-hz-id <TidbHostedZoneId> \
    --pca-arn <TidbPCAArn>

Monitor the process. Upon execution, the script initiates AWS CloudFormation to provision and update resources. You can observe a log stream in the terminal displaying status messages such as waiting for changeset to be created and successfully created/updated stack.

Verification

After execution, the script will output the ARNs of the created IAM roles.

Action required: Share the execution result/log with your TiDB Cloud representative.

What's next

After TiDB Cloud verifies the IAM roles, continue with TiDB Cloud BYOC Automated Region Deployment. TiDB Cloud will trigger the automated region deployment.