ClickHouse Cloud Production Readiness Guide

- **Application users**: Service accounts with specific database and table access
- **Analyst users**: Read-only access to curated datasets and reporting views
- **Admin users**: Full administrative capabilities

Configure quotas, limits, and settings profiles to manage resource usage for different users and roles. Set memory and execution time limits to prevent individual queries from impacting system performance. Monitor resource usage through audit, session, and query logs to identify users or applications that frequently hit limits. Conduct regular access reviews using ClickHouse Cloud's audit capabilities.

### User lifecycle management limitations[​](#user-lifecycle-management "Direct link to User lifecycle management limitations")

ClickHouse Cloud doesn't currently support SCIM or automated provisioning/deprovisioning via identity providers. Users must be manually removed from the ClickHouse Cloud console after being removed from your IdP. Plan for manual user management processes until these features become available.

Learn more about [Cloud Access Management](/docs/cloud/security/cloud_access_management) and [SAML SSO setup](/docs/cloud/security/saml-setup).

## Infrastructure as code and automation[​](#infrastructure-as-code "Direct link to Infrastructure as code and automation")

Managing ClickHouse Cloud through infrastructure-as-code practices and API automation provides consistency, version control, and repeatability for your deployment configuration.

### Terraform Provider[​](#terraform-provider "Direct link to Terraform Provider")

Configure the ClickHouse Terraform provider with API keys created in the ClickHouse Cloud console:

```
terraform {
  required_providers {
    clickhouse = {
      source  = "ClickHouse/clickhouse"
      version = "~> 2.0"
    }
  }
}

provider "clickhouse" {
  environment     = "production"
  organization_id = var.organization_id
  token_key       = var.token_key
  token_secret    = var.token_secret
}
```

The Terraform provider supports service provisioning, IP access lists, and user management. For features not covered by the provider, manage them through the console or contact ClickHouse support.

For comprehensive examples including service configuration and network access controls, see [Terraform example on how to use Cloud API](/docs/knowledgebase/terraform_example).

### Cloud API integration[​](#cloud-api-integration "Direct link to Cloud API integration")

Organizations with existing automation frameworks can integrate ClickHouse Cloud management directly through the Cloud API. The API provides programmatic access to service lifecycle management, user administration, backup operations, and monitoring data retrieval.

Common API integration patterns:

- Custom provisioning workflows integrated with internal ticketing systems
- Automated scaling adjustments based on application deployment schedules
- Programmatic backup validation and reporting for compliance workflows
- Integration with existing infrastructure management platforms

API authentication uses the same token-based approach as Terraform. For complete API reference and integration examples, see [ClickHouse Cloud API](/docs/cloud/manage/api/api-overview) documentation.

## Monitoring and operational integration[​](#monitoring-integration "Direct link to Monitoring and operational integration")

Connecting ClickHouse Cloud to your existing monitoring infrastructure ensures visibility and proactive issue detection.

### Built-in monitoring[​](#built-in-monitoring "Direct link to Built-in monitoring")

ClickHouse Cloud provides an advanced dashboard with real-time metrics including queries per second, memory usage, CPU usage, and storage rates. Access via Cloud console under Monitoring → Advanced dashboard. Create custom dashboards tailored to specific workload patterns or team resource consumption.

Common production gaps

Lack of proactive alerting integration with enterprise incident management systems and automated cost monitoring. Built-in dashboards provide visibility but automated alerting requires external integration.

### Production alerting setup[​](#production-alerting "Direct link to Production alerting setup")

**Built-in Capabilities**: ClickHouse Cloud provides notifications for billing events, scaling events, and service health via email, UI, and Slack. Configure delivery channels and notification severities through the console notification settings.

**Enterprise Integration**: For advanced alerting (PagerDuty, custom webhooks), use the Prometheus endpoint to export metrics to your existing monitoring infrastructure:

```
scrape_configs:
  - job_name: "clickhouse"
    static_configs:
      - targets: ["https://api.clickhouse.cloud/v1/organizations/<org_id>/prometheus"]
    basic_auth:
      username: <KEY_ID>
      password: <KEY_SECRET>
```

For comprehensive setup including detailed Prometheus/Grafana configuration and advanced alerting, see the [ClickHouse Cloud Observability Guide](/docs/use-cases/observability/cloud-monitoring#prometheus).

## Business continuity and support integration[​](#business-continuity "Direct link to Business continuity and support integration")

Establishing backup validation procedures and support integration ensures your ClickHouse Cloud deployment can recover from incidents and access help when needed.

### Backup strategy assessment[​](#backup-strategy "Direct link to Backup strategy assessment")

ClickHouse Cloud provides automatic backups with configurable retention periods. Assess your current backup configuration against compliance and recovery requirements. Enterprise customers with specific compliance requirements around backup location or encryption can configure ClickHouse Cloud to store backups in their own cloud storage buckets (BYOB). Contact ClickHouse support for BYOB configuration.

### Validate and test recovery procedures[​](#validate-test-recovery "Direct link to Validate and test recovery procedures")

Most organizations discover backup gaps during actual recovery scenarios. Establish regular validation cycles to verify backup integrity and test recovery procedures before incidents occur. Schedule periodic test restorations to non-production environments, document step-by-step recovery procedures including time estimates, verify restored data completeness and application functionality, and test recovery procedures with different failure scenarios (service deletion, data corruption, regional outages). Maintain updated recovery runbooks accessible to on-call teams.

Test backup restoration at least quarterly for critical production services. Organizations with strict compliance requirements may need monthly or even weekly validation cycles.

### Disaster recovery planning[​](#disaster-recovery-planning "Direct link to Disaster recovery planning")

Document your recovery time objectives (RTO) and recovery point objectives (RPO) to validate that your current backup configuration meets business requirements. Establish regular testing schedules for backup restoration and maintain updated recovery documentation.

**Cross-region backup storage**: Organizations with geographic disaster recovery requirements can configure ClickHouse Cloud to export backups to customer-owned storage buckets in alternate regions. This provides protection against regional outages but requires manual restoration procedures. Contact ClickHouse support to implement cross-region backup exports. Future platform releases will provide automated multi-region replication capabilities.

### Production support integration[​](#production-support "Direct link to Production support integration")

Understand your current support tier's SLA expectations and escalation procedures. Create internal runbooks defining when to engage ClickHouse support and integrate these procedures with your existing incident management processes.

Learn more about [ClickHouse Cloud backup and recovery](/docs/cloud/manage/backups/overview) and [support services](/docs/about-us/support).

## Next steps[​](#next-steps "Direct link to Next steps")