This repository has been archived by the owner on Jan 29, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 51
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
2a9c2df
commit cbc0922
Showing
9 changed files
with
36 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -22,6 +22,7 @@ boolean | |
boot | ||
Bucardo | ||
business | ||
BYOC | ||
Cassandra | ||
Centrify | ||
checkpointing | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -21,6 +21,7 @@ exceptions: | |
- Boot | ||
- Business | ||
- BYOA | ||
- BYOC | ||
- Cassandra | ||
- ClickHouse | ||
- CloudWatch | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,29 +1,29 @@ | ||
Bring your own account (BYOA) | ||
============================= | ||
Bring your own cloud (BYOC) | ||
=========================== | ||
|
||
Aiven services are usually deployed on Aiven managed infrastructure, using | ||
Aiven managed security protocols, and backed by Aiven managed storage and backups. | ||
This provides the most seamless, straight forward, and de-risked approach to deploying | ||
Aiven services. However, there are cases where this approach is not appropriate, such | ||
as the need to achieve strict regulatory compliance. | ||
|
||
In cases like these, Aiven offers customers the ability to instead BYOA (Bring | ||
Your Own Account). BYOA allows customers to manage their own infrastructure, | ||
In cases like these, Aiven offers customers the ability to instead BYOC (Bring | ||
Your Own Cloud). BYOC allows customers to manage their own infrastructure, | ||
their own security posture and keep their data in their own cloud. | ||
|
||
When to consider bringing your own account | ||
------------------------------------------ | ||
When to consider bringing your own cloud | ||
---------------------------------------- | ||
|
||
There are three major reasons to utilize BYOA: | ||
There are three major reasons to utilize BYOC: | ||
|
||
1. **Compliance**: Aiven offers managed environments for several standard compliance regulations such as HIPAA, PCI DSS and GDPR. However, if you have strict regulatory requirements, or special compliance requirements, BYOA may be the best option for you. | ||
2. **Network auditing**: If you require visibility of all traffic within any VPC you operate in or need frequent auditing capabilities, BYOA is potentially a good fit. BYOA gives you the ability to audit network metadata but not the actual contents. | ||
3. **Fine grained network control**: BYOA requires only some specific network access (e.g. service management and troubleshooting), otherwise allowing you to customize your network to meet any internal requirements or requirements of your customers. | ||
1. **Compliance**: Aiven offers managed environments for several standard compliance regulations such as HIPAA, PCI DSS and GDPR. However, if you have strict regulatory requirements, or special compliance requirements, BYOC may be the best option for you. | ||
2. **Network auditing**: If you require visibility of all traffic within any VPC you operate in or need frequent auditing capabilities, BYOC is potentially a good fit. BYOC gives you the ability to audit network metadata but not the actual contents. | ||
3. **Fine grained network control**: BYOC requires only some specific network access (e.g. service management and troubleshooting), otherwise allowing you to customize your network to meet any internal requirements or requirements of your customers. | ||
|
||
Who is eligible? | ||
---------------- | ||
|
||
The BYOA setup is a bespoke service offered on a case-by-case basis, and not | ||
The BYOC setup is a bespoke service offered on a case-by-case basis, and not | ||
all cloud providers support it yet. Therefore customers must meet the following | ||
requirements: | ||
|
||
|
@@ -36,18 +36,18 @@ requirements: | |
When to use a standard Aiven deployment | ||
--------------------------------------- | ||
|
||
BYOA deployments are not automated and they add additional complexity for communicating | ||
BYOC deployments are not automated and they add additional complexity for communicating | ||
to the Aiven control plane, service management, key management and security. | ||
|
||
In most cases customers can meet their regulatory and business requirements by utilizing | ||
a standard Aiven deployment or :doc:`Enhanced Compliance Environment </docs/platform/concepts/enhanced-compliance-env>`. In fact, 99% of Aiven | ||
customers are able to meet their requirements without BYOA. If you would like to understand | ||
BYOA better or are unsure which deployment model is the best fit for you, please contact our sales department [email protected]. | ||
customers are able to meet their requirements without BYOC. If you would like to understand | ||
BYOC better or are unsure which deployment model is the best fit for you, please contact our sales department [email protected]. | ||
|
||
Pricing and billing | ||
------------------- | ||
|
||
Unlike Aiven's standard all-inclusive pricing, the BYOA setup has custom | ||
Unlike Aiven's standard all-inclusive pricing, the BYOC setup has custom | ||
pricing depending on the nature of your requirements. Customers entering this | ||
arrangement are responsible for all cloud infrastructure and network traffic | ||
charges. | ||
|
@@ -56,18 +56,18 @@ charges. | |
|
||
For a cost estimate and analysis, please contact [email protected]. | ||
|
||
Architecture of BYOA deployments | ||
Architecture of BYOC deployments | ||
-------------------------------- | ||
|
||
With BYOA, you can use any standard Aiven method (e.g. :doc:`CLI </docs/tools/cli>`, :doc:`Terraform </docs/tools/terraform>`) to manage your services and generally have the same user experience as with the regular Aiven deployment model. | ||
With BYOC, you can use any standard Aiven method (e.g. :doc:`CLI </docs/tools/cli>`, :doc:`Terraform </docs/tools/terraform>`) to manage your services and generally have the same user experience as with the regular Aiven deployment model. | ||
|
||
BYOA standard | ||
BYOC standard | ||
''''''''''''' | ||
|
||
.. image:: /images/platform/byoa-standard.png | ||
:alt: Overview architecture diagram with VPC set up | ||
|
||
A standard BYOA deployment requires the customer to create a Virtual Private Cloud (VPC) | ||
A standard BYOC deployment requires the customer to create a Virtual Private Cloud (VPC) | ||
dedicated to Aiven services within each region they want to operate. Aiven will access these | ||
VPCs via a static IP address and then route traffic through a proxy for additional security. | ||
In order to accomplish this, Aiven will utilize a bastion host, logically separated from the | ||
|
@@ -78,28 +78,28 @@ host and the service nodes will reside in a customer managed VPC, they will not | |
|
||
Depending on the service being used, Aiven will take regular backups to enable forking, | ||
Point in Time Recovery (PITR) and disaster recovery. These backups by default will not | ||
reside in the customer’s cloud account. If there is a requirement to have all backups | ||
in your own account we can do this as well. Aiven will need object storage and permissions | ||
reside in the customer’s cloud. If there is a requirement to have all backups | ||
in your own cloud, we can do this as well. Aiven will need object storage and permissions | ||
to read and write in order to accomplish this. Please bear in mind that all backups are | ||
encrypted using Aiven managed keys and that the customer will be responsible for managing | ||
object storage configurations. | ||
|
||
BYOA with IPsec ingress | ||
BYOC with IPsec ingress | ||
''''''''''''''''''''''' | ||
|
||
.. image:: /images/platform/byoa-ipsec-ingress.png | ||
:alt: Overview architecture diagram with IPsec tunnel | ||
|
||
A slight variation on a standard BYOA deployment enables Aiven to manage a customer's | ||
A slight variation on a standard BYOC deployment enables Aiven to manage a customer's | ||
services through an IPsec tunnel. This deployment can be beneficial if management over | ||
the public internet is infeasible or adds additional complexity. | ||
|
||
BYOA with direct IPsec ingress | ||
BYOC with direct IPsec ingress | ||
'''''''''''''''''''''''''''''' | ||
|
||
.. image:: /images/platform/byoa-ipsec-ingress-direct.png | ||
:alt: Overview architecture diagram with direct IPsec access | ||
|
||
Again a slight variation on a standard BYOA deployment enables Aiven to manage a customer's | ||
Again a slight variation on a standard BYOC deployment enables Aiven to manage a customer's | ||
services through a direct IPsec tunnel. This deployment can be beneficial if there is a | ||
desire to reduce the number of Aiven managed components. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters