📣
TiDB Cloud Premium is now in public preview. Unlimited growth, instant elasticity, advanced security for enterprise workloads. Try it out →

TiDB Cloud BYOC Onboarding Overview



TiDB Cloud BYOC (Bring Your Own Cloud) is an enterprise solution that lets you run the data plane in your own cloud environment while retaining the fully managed experience of TiDB Cloud.

The TiDB Cloud BYOC deployment process is a collaborative effort between your organization and the TiDB Cloud team. The process includes secure infrastructure preparation, automated provisioning, and comprehensive validation. To start BYOC onboarding, contact Sales.

Deployment phases

PhaseResponsibilityDescription
Phase 1: Environment preparationCustomerPrepare the AWS foundation required for deployment. This includes creating a dedicated AWS account, configuring a public or private Route 53 hosted zone for TiDB, and setting up the private certificate authority (PCA).
Phase 2: IAM bootstrappingCustomerExecute the provided bootstrapping scripts to install the necessary IAM roles and policies. This authorizes the TiDB Cloud Control Plane to securely manage resources within your AWS account.
Phase 3: Automated region deploymentTiDB CloudOnce IAM permissions are verified, TiDB Cloud automatically provisions the VPC, EKS clusters, and control plane resources. Note: This process is fully automated and requires no customer intervention.
Phase 4: Service initializationCustomerCreate a resource pool and then create your TiDB instance in the resource pool via the console. After that, configure a bastion host and authentication scripts to establish secure maintenance channels (Tailscale) and observability pipelines. Note: You may also choose to establish maintenance channels using your own custom methods.
Phase 5: ValidationJointBoth teams collaborate to validate connectivity, verify metric collection, and confirm system health to ensure the BYOC environment is ready for use.

Architecture overview

TiDB Cloud BYOC uses a split-plane architecture. The TiDB Cloud control plane is managed by PingCAP, while the TiDB data plane runs in your own cloud account.

Before you begin the onboarding process, review the TiDB Cloud BYOC architecture to understand the BYOC control plane, data plane, network connectivity model, and high availability options.

Was this page helpful?