Skip to main content

​
Overview

Bring Your Own Cloud (BYOC) empowers you to deploy ClickHouse services and store your data directly within your own cloud accounts, rather than relying on the default ClickHouse Cloud infrastructure. This approach is particularly well-suited for organizations with stringent security policies or regulatory compliance requirements that demand complete control and sovereignty over their data. At a high level, BYOC separates the ClickHouse control plane, which runs in the ClickHouse VPC and is managed by ClickHouse Cloud, from the data plane, which runs entirely in your cloud account and contains your ClickHouse clusters, data, and backups. For a detailed view of the components involved and how traffic flows between them, see the Architecture page.
If you would like access, please contact us. Refer to our Terms of Service for additional information.
BYOC is designed specifically for large-scale deployments, and requires customers to sign a committed contract.
Supported Cloud Service Providers:
  • AWS (GA)
  • GCP (GA)
  • Azure (GA)
Supported Cloud Regions: All public regions listed in our supported regions documentation are available for BYOC deployments. Private regions aren’t currently supported.

​
Prerequisites

The following requirements are fundamental to how BYOC is built and operated. They apply to every deployment and cannot be waived or worked around:
  • A supported region. BYOC deploys only into the public regions listed in the supported regions documentation. AWS Local Zones and single-zone regions are not supported. If the region you need isn’t listed, talk to your ClickHouse representative before planning a deployment.
  • Three availability zones. Every BYOC infrastructure spans three availability zones — this is how high availability is provided for ClickHouse servers and ClickHouse Keeper. Regions with fewer than three zones cannot host BYOC, and single-zone or two-zone deployments are not offered.
  • The onboarding artifacts, applied verbatim. The CloudFormation template or Terraform module must be applied exactly as provided — the resource names (such as the ClickHouseManagementRole IAM role) and the documented baseline permissions are hard-coded into ClickHouse’s automation. Any modification requires ClickHouse’s explicit approval; supported customizations are exposed as template parameters. See standard onboarding.
  • A ClickHouse-managed Kubernetes cluster. The EKS/GKE/AKS cluster is created and fully operated by ClickHouse. Installing into an existing Kubernetes cluster is not supported, and cluster-wide admission controllers or policy engines must not be installed on it.
  • Network basics. Working DNS resolution and outbound internet access (directly or via NAT) are required in every setup. For a ClickHouse-managed VPC/VNet, the CIDR range must be at least /23 — and /23 is the floor, not a recommendation: every replica consumes IP addresses, so larger deployments need a larger range. Customer-managed VPCs have their own per-cloud subnet requirements — see the AWS and GCP customization guides.

​
Features

​
Supported features

  • SharedMergeTree: ClickHouse Cloud and BYOC use the same binary and configuration. Therefore all features from ClickHouse core are supported in BYOC such as SharedMergeTree.
  • Shared Catalog
  • Console access for managing service state:
    • Supports operations such as start, stop, and terminate.
    • View services and status.
  • Managed backup and restore
  • Manual vertical and horizontal scaling.
  • Auto Idling/Wake up
  • Warehouses: Compute-Compute Separation
  • Zero Trust Network via Tailscale.
  • Monitoring:
    • Prometheus scraping for centralized monitoring with Prometheus, Grafana, and Datadog. See the BYOC Observability for setup instructions.
  • VPC Peering
  • Secure S3
  • AWS PrivateLink
  • GCP Private Service Connect
  • Azure Private Link
  • Integrations: See the full list on this page.

​
Planned features (currently unsupported)

The following features have limitations or are not fully supported in Bring Your Own Cloud (BYOC) deployments.
  • SQL Console: The standard SQL console is not available for BYOC deployments, but is on our roadmap.
  • ClickPipes Support: Currently available in private preview with streaming integrations such as Kafka, Kinesis supported. Additional integrations (CDC, object storage etc.) are on the roadmap.
  • Autoscaling: On the roadmap to add to future releases.
  • MySQL interface
  • AWS KMS aka CMEK (customer-managed encryption keys)
  • Advanced Dashboard: The client-only UI that requires your browser to have direct access and be able to connect directly to your ClickHouse server using its endpoint. If your VPC network policies restrict inbound browser access to the ClickHouse endpoint, the advanced dashboard will not function.
  • Monitoring Dashboards: Currently, only memory allocation metrics are available in the monitoring dashboard. Support for additional metrics is in progress and expected to be available in a future release.
Last modified on August 3, 2026