Architecture

These permissions are granted through a cross-account IAM role (AWS) or service account (GCP) that you create during the initial onboarding process. The role follows the principle of least privilege, with permissions scoped to only what's necessary for BYOC operations.

For detailed information about the specific permissions required, see the [BYOC Privilege Reference](/docs/cloud/reference/byoc/reference/privilege).

### Tailscale Private Network Connection[​](#tailscale-private-network "Direct link to Tailscale Private Network Connection")

Tailscale provides a secure, zero-trust private network connection between ClickHouse Cloud's management services and your BYOC deployment. This connection enables:

- **Continuous monitoring**: ClickHouse engineers can access the Prometheus monitoring stack deployed in your BYOC VPC to monitor service health and performance
- **Proactive maintenance**: Engineers can perform routine maintenance, upgrades, and troubleshooting operations
- **Emergency support**: In case of service issues, engineers can quickly access your environment to diagnose and resolve problems
- **Infrastructure management**: Management services can coordinate with your BYOC infrastructure for automated operations

The Tailscale connection is **outbound-only** from your BYOC VPC—no inbound connections are required, reducing your security exposure. All access is:

- **Approved and audited**: Engineers must request access through an internal approval system
- **Time-bound**: Access automatically expires after a set period
- **Restricted**: Engineers can only access system tables and infrastructure components, never customer data
- **Encrypted**: All communication is encrypted end-to-end

For detailed information about how Tailscale works in BYOC and security controls, see the [Network Security documentation](/docs/cloud/reference/byoc/reference/network_security#tailscale-private-network).

### Why These Requirements Matter[​](#why-requirements-matter "Direct link to Why These Requirements Matter")

Together, these two components enable ClickHouse Cloud to:

- **Maintain reliability**: Proactively monitor and maintain your deployment to prevent issues
- **Ensure security**: Use least-privilege access with full auditability
- **Simplify operations**: Automate infrastructure management while you maintain control
- **Provide support**: Quickly respond to and resolve issues when they occur

All customer data remains within your cloud account and is never accessed or transmitted through these management channels.

**Additional recommendations and considerations:**

- Ensure that network CIDR ranges for your BYOC VPC doesn't overlap with any existing VPCs you plan to peer with.
- Tag your resources clearly to simplify management and support.
- Plan for adequate subnet sizing and distribution across availability zones for high availability.
- Consult the [security playbook](https://clickhouse.com/docs/cloud/security/audit-logging/byoc-security-playbook) to understand shared responsibility and best practices when ClickHouse Cloud operates within your environment.
- Review the full onboarding guide for step-by-step instructions on initial account setup, VPC configuration, network connectivity (for example, VPC peering), and IAM role delegation.

If you have unique requirements or constraints, contact ClickHouse Support for guidance on advanced network configurations or custom IAM policies.

- [Key concepts](#key-concepts)- [Glossary](#glossary)- [Technical architecture](#architecture)
      - [Data Storage](#data-storage)- [Control Plane communication](#control-plane-communication)- [Key Requirements for BYOC](#key-requirements)
        - [Cross-account IAM permissions](#cross-account-iam-permissions)- [Tailscale Private Network Connection](#tailscale-private-network)- [Why These Requirements Matter](#why-requirements-matter)

Was this page helpful?