ClickHouse Cloud Production Readiness Guide

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/guides/production-readiness.md)

For organizations who have completed the quick start guide and have an active service with data flowing

TL;DR

This guide helps you transition from quick start to enterprise-ready ClickHouse Cloud deployments. You'll learn how to:

- Establish separate dev/staging/production environments for safe testing
- Integrate SAML/SSO authentication with your identity provider
- Automate deployments with Terraform or the Cloud API
- Connect monitoring to your alerting infrastructure (Prometheus, PagerDuty)
- Validate backup procedures and document disaster recovery processes

## Introduction[​](#introduction "Direct link to Introduction")

You have ClickHouse Cloud running successfully for your business workloads. Now you need to mature your deployment to meet enterprise production standards—whether triggered by a compliance audit, a production incident from an untested query, or IT requirements to integrate with corporate systems.

ClickHouse Cloud's managed platform handles infrastructure operations, automatic scaling, and system maintenance. Enterprise production readiness requires connecting ClickHouse Cloud to your broader IT environment through authentication systems, monitoring infrastructure, automation tools, and business continuity processes.

Your responsibilities for enterprise production readiness:

- Establish separate environments for safe testing before production deployment
- Integrate with existing identity providers and access management systems
- Connect monitoring and alerting to your operational infrastructure
- Implement infrastructure-as-code practices for consistent management
- Establish backup validation and disaster recovery procedures
- Configure cost management and billing integration

This guide walks you through each area, helping you transition from a working ClickHouse Cloud deployment to an enterprise-ready system.

## Environment strategy[​](#environment-strategy "Direct link to Environment strategy")

Establish separate environments to safely test changes before impacting production workloads. Most production incidents trace back to untested queries or configuration changes deployed directly to production systems.

Note

**In ClickHouse Cloud, each environment is a separate service.** You'll provision distinct production, staging, and development services within your organization, each with its own compute resources, storage, and endpoint.

**Environment structure**: Maintain production (live workloads), staging (production-equivalent validation), and development (individual/team experimentation) environments.

**Testing**: Test queries in staging before production deployment. Queries that work on small datasets often cause memory exhaustion, excessive CPU usage, or slow execution at production scale. Validate configuration changes including user permissions, quotas, and service settings in staging—configuration errors discovered in production create immediate operational incidents.

**Sizing**: Size your staging service to approximate production load characteristics. Testing on significantly smaller infrastructure may not reveal resource contention or scaling issues. Use production-representative datasets through periodic data refreshes or synthetic data generation. For guidance on how to size your staging environment and scale services appropriately, refer to the [Sizing and hardware recommendations](/docs/guides/sizing-and-hardware-recommendations) and [Scaling in ClickHouse Cloud](/docs/manage/scaling) documentation. These resources provide practical advice on memory, CPU, and storage sizing, as well as details on vertical and horizontal scaling options to help you match your staging environment to production workloads.

## Private networking[​](#private-networking "Direct link to Private networking")

[Private networking](/docs/cloud/security/connectivity/private-networking) in ClickHouse Cloud allows you to connect your ClickHouse services directly to your cloud virtual network, ensuring that data doesn't traverse the public internet. This is essential for organizations with strict security or compliance requirements, or for those running applications in private subnets.

ClickHouse Cloud supports private networking through the following mechanisms:

- [AWS PrivateLink](/docs/manage/security/aws-privatelink): Enables secure connectivity between your VPC and ClickHouse Cloud without exposing traffic to the public internet. It supports cross-region connectivity and is available in the Scale and Enterprise plans. Setup involves creating a PrivateLink endpoint and adding it to your ClickHouse Cloud organization and service allow list. More details and step-by-step instructions are available in the documentation here.
- [GCP Private Service Connect](/docs/manage/security/gcp-private-service-connect) (PSC): Allows private access to ClickHouse Cloud from your Google Cloud VPC. Like AWS, it is available in Scale and Enterprise plans and requires explicit configuration of service endpoints and allow lists here.
- [Azure Private Link](/docs/cloud/security/azure-privatelink): Provides private connectivity between your Azure VNet and ClickHouse Cloud, supporting cross-region connections. The setup process involves obtaining a connection alias, creating a private endpoint, and updating allow lists here.

If you need more technical details or step-by-step setup instructions, the linked documentation for each provider contains comprehensive guides.

## Enterprise authentication and user management[​](#enterprise-authentication "Direct link to Enterprise authentication and user management")

Moving from console-based user management to enterprise authentication integration is essential for production readiness.

### SSO and social authentication[​](#sso-authentication "Direct link to SSO and social authentication")

[SAML SSO](/docs/cloud/security/saml-setup): Enterprise tier ClickHouse Cloud supports SAML integration with identity providers including Okta, Azure Active Directory, and Google Workspace. SAML configuration requires coordination with ClickHouse support and involves providing your IdP metadata and configuring attribute mappings.

[Social SSO](/docs/cloud/security/manage-my-account): ClickHouse Cloud also supports social authentication providers (Google, Microsoft, GitHub) as an equally secure alternative to SAML SSO. Social SSO provides faster setup for organizations without existing SAML infrastructure while maintaining enterprise security standards.

Important limitation

Users authenticated through SAML or social SSO are assigned the "Member" role by default and must be manually granted additional roles by an admin after their first login. Group-to-role mapping and automatic role assignment aren't currently supported.

### Access control design[​](#access-control-design "Direct link to Access control design")

ClickHouse Cloud uses organization-level roles (Admin, Developer, Billing, Member) and service/database-level roles (Service Admin, Read Only, SQL console roles). Design roles around job functions applying the principle of least privilege:

- **Application users**: Service accounts with specific database and table access
- **Analyst users**: Read-only access to curated datasets and reporting views
- **Admin users**: Full administrative capabilities

Configure quotas, limits, and settings profiles to manage resource usage for different users and roles. Set memory and execution time limits to prevent individual queries from impacting system performance. Monitor resource usage through audit, session, and query logs to identify users or applications that frequently hit limits. Conduct regular access reviews using ClickHouse Cloud's audit capabilities.

### User lifecycle management limitations[​](#user-lifecycle-management "Direct link to User lifecycle management limitations")