Skip to main content
With Bring Your Own Cloud (BYOC) on AWS, all the components interacting with private data are deployed on the customer infrastructure on AWS and managed by the Cube Control Plane via the Cube Operator. This document provides step-by-step instructions for deploying Cube BYOC on AWS.
Available on the Enterprise plan. Contact us for details. For private API access from your applications and BI tools, see Private API Connectivity.

​
Prerequisites

The bulk of provisioning work will be done remotely by Cube automation. However, to get started, you’ll need to provide Cube with the necessary access along with some additional information that includes:
  • AWS Account ID: The AWS account ID of the target deployment account the AWS Console.
  • AWS Region: The AWS region where the BYOC resources should be deployed.
In addition to that, you’ll need to make sure you have sufficient access to create the CubeCloudBYOC IAM role that would allow Cube to:
  • Create and manage a VPC
  • Create one or more EKS clusters
  • Create and maintain necessary IAM roles and policies
  • Configure VPC networking
  • Run ec2 instances
  • Manage ec2 autoscaling
  • Manage S3 buckets
  • Manage CloudWatch Logs
  • Create and manage RDS PostgreSQL instances
Restrictive SCPs may block RDS provisioning. Amazon RDS needs a service-linked role named AWSServiceRoleForRDS in the account. The policy below grants iam:CreateServiceLinkedRole for rds.amazonaws.com, so Cube creates it during provisioning — but if your organization’s SCPs deny IAM writes, the grant is present in the policy without being effective in the account, and provisioning fails with a message that names a parameter rather than a permission:
To rule this out, run the following once in the target account before granting Cube access. InvalidInput: ... has been taken in this account means the role already exists and no action is needed.
If the command itself is denied by an SCP, the same denial will block Cube during provisioning — ask your AWS organization administrator to permit iam:CreateServiceLinkedRole for rds.amazonaws.com in this account.

​
Provisioning access

​
Create a CubeCloudBYOC policy

Navigate to IAM->Policies and create a new policy called CubeCloudBYOC with the following JSON content. Please substitute AWS_ACCOUNT_ID with your actual account ID.

​
Creating a role

Navigate to IAM->Roles and create a new Role called CubeCloudBYOC. Select AWS Account as the Trusted entity. Type and enter arn:aws:iam::307491255751:root, which is the Cube BYOC provisioner account. On the Add permissions page, find and select the CubeCloudBYOC policy you created earlier. On the final Review and create page, edit the Trust Policy to make it look like this.
Make sure to include "sts:ExternalId": "cube-cloud-byoc" in the Condition section.

​
Deployment

The actual deployment will be done by Cube automation. All that’s left to do is notify your Cube contact point that access has been granted, and pass along your Region/AWS Account ID information.