BYOC security and permissions¶
BYOC has three distinct authorization layers. Configure each for its own purpose.
| Layer | Identity | Purpose |
|---|---|---|
| NebulaGraph Cloud | Cloud account with organization/project roles | Operate the organization, project, data plane, and databases |
| AWS IAM | Local AWS deployment identity; Deployment and Runtime roles | Create authorization locally; allow platform AWS resource operations |
| Database | Database user and graph privileges | Authenticate and execute database operations through SDKs |
A Cloud role does not grant AWS administrator permissions. An AWS role ARN is not a database password.
Platform operation roles¶
| Operation | Required Cloud role |
|---|---|
| Create the organization's project | Organization Owner |
| Deploy, retry, rename, or delete the data plane | Organization Owner or Project Admin |
| Create or manage BYOC databases and configure network access | Organization Owner or Project Admin |
An Organization Admin role alone is insufficient for these project deployment operations; the user must also have Project Admin where required. See Account user management to manage membership. Database users have their own permissions; see Database user management.
AWS authorization¶
Run the official IAM template with a local identity allowed to create the required IAM resources. The template creates two roles:
- Deployment Role: authorizes data plane infrastructure deployment and cleanup.
- Runtime Role: authorizes database-related AWS resource operations after deployment.
Both roles trust the supplied Principal and require sts:ExternalId to match the data plane ID. Copy these values from Credential Settings. Review the template's policies with your AWS administrator; AWS Organizations service control policies (SCPs) and permissions boundaries can still block actions allowed by a role policy. The template includes region and resource constraints for its permitted operations; do not substitute unrestricted administrator policies to bypass an error.
AWS access keys and session tokens stay in your local AWS authentication setup. Only the two role ARNs are entered in the platform. Keep Terraform state and local authorization files secure. Retain the roles until data plane cleanup is complete.
Operational responsibilities¶
| Area | Customer action | Platform action |
|---|---|---|
| AWS account and authorization | Maintain the account, local AWS authentication, and reviewed IAM authorization | Assume the authorized roles for deployment and resource operations |
| Data plane lifecycle | Submit configuration, monitor progress, and verify AWS cleanup before revoking authorization | Orchestrate deployment and expose status, timeline, and logs |
| Database capacity | Select capacity within the license; arrange renewal or more quota | Validate configuration and available license capacity |
| Application access | Configure approved network sources/endpoints and database user privileges | Provide network configuration and connection interfaces |
| Infrastructure costs | Track resources and AWS bills in the customer account | Provide the managed operation workflow |
Refer to your BYOC agreement for service availability, support access, and compliance commitments. Coordinate with support before changing platform-managed AWS resources outside the documented workflow.