BYOC Setup

BYOC (Bring Your Own Cloud) runs a LaserData-managed Apache Iggy deployment in your AWS or GCP account. Your account owns the infrastructure and application data. You pay the cloud provider for its resources.

Architecture

For AWS, LaserData assumes an IAM role, permissions that a service can temporarily use. The role covers EC2, networking, and EBS provisioning. Once the nodes run, Warden starts management connections outbound, as it does for Managed and On-Premise deployments. Your application data stays in your AWS account.

Prerequisites

For AWS setup, prepare these resources:

• An AWS account.
• A VPC, a private cloud network, in the target region. The default VPC is sufficient.
• BYOC access through a Pro or Enterprise plan.

Step 1: Generate BYOC Setup

Start a BYOC deployment in the Console and select the cloud and region. LaserData generates these items:

• An IAM trust policy that permits supervisors in the LaserData AWS Organization to assume your role. It uses aws:PrincipalOrgID and sts:ExternalId to restrict access.
• An IAM permissions policy for the resources that LaserData manages.
• An external ID that prevents another customer from misusing the service's access to your account.
• The LaserData AWS Organization ID, laserdata_org_id. Its format is o- followed by 10-32 alphanumeric characters.

Trust applies to the organization. New supervisor regions receive access without a separate trust grant from you.

Step 2: Create IAM Role

In your AWS account:

1. Open IAM, then Roles, then Create role.
2. Select Custom trust policy.
3. Paste the trust policy from LaserData.
4. Create a policy with the supplied permissions policy.
5. Attach the policy to the role.
6. Name the role, for example LaserDataByocRole.
7. Copy the Role ARN, the AWS resource identifier.

Using AWS CLI

aws iam create-role \
  --role-name LaserDataByocRole \
  --assume-role-policy-document file://trust-policy.json

aws iam put-role-policy \
  --role-name LaserDataByocRole \
  --policy-name LaserDataByocPermissions \
  --policy-document file://permissions-policy.json

Step 3: Complete Deployment

Enter your AWS Account ID, Role ARN, and external ID in the Console. The trust policy has this structure:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "*" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalOrgID": "o-xxxxxxxxxx",
          "sts:ExternalId": "your-external-id"
        }
      }
    }
  ]
}

LaserData then provisions the deployment:

1. It assumes the role through STS, the AWS service for temporary credentials.
2. It creates a subnet in your VPC and selects an available CIDR address range.
3. It creates security groups, route tables, and an internet gateway when required.
4. It starts EC2 instances with Elastic IPs.
5. It installs Warden on the nodes for outbound management connections.

IAM Scope

The role grants these permissions:

It excludes S3, Secrets Manager, CloudWatch, and SSM. LaserData receives no access to application data or secrets.

Cleanup

When you delete a BYOC deployment, LaserData removes its resources:

1. It terminates EC2 instances.
2. It releases Elastic IPs.
3. It deletes security groups, subnets, and route tables.
4. It removes IAM instance profiles and roles created for the deployment.

Internet gateways remain because other resources can share them.

GCP BYOC

GCP BYOC uses a service account, an identity for software. LaserData impersonates that account to provision resources in your project. Your application data stays in the project.

Prerequisites

For GCP setup, prepare these resources:

• A GCP project.
• A VPC network in the target region.
• BYOC access through a Pro or Enterprise plan.

Setup

1. Start a BYOC deployment in the Console and select GCP.
2. Read the generated instructions for your project.
3. Create a service account with the IAM roles below.
4. Grant LaserData roles/iam.serviceAccountTokenCreator on that account.
5. Enter your Project ID, service account email, and VPC network name.

LaserData uses the supplied account to provision the deployment in your project.

IAM Roles

Grant these roles to the service account on the project:

Grant LaserData the role needed to impersonate the account:

The permissions exclude Cloud Storage, Secret Manager, and Cloud Logging. LaserData receives no access to application data or secrets.

API Reference

Validate BYOC Credentials

curl -X POST {supervisor_url}/tenants/{tenant_id}/divisions/{division_id}/environments/{environment_id}/byoc/validate \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "cloud": "aws",
    "region": "us-west-1",
    "account_id": "123456789012",
    "identity_arn": "arn:aws:iam::123456789012:role/LaserDataByocRole",
    "external_id": "unique-external-id-123",
    "vpc_id": "vpc-12345678"
  }'

Generate BYOC Setup

curl -X POST https://api.laserdata.cloud/tenants/{tenant_id}/divisions/{division_id}/environments/{environment_id}/deployments/byoc/setup \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "cloud": "aws",
    "region": "us-west-1"
  }'

The AWS response includes laserdata_org_id, external_id, permissions_policy, and trust_policy. The organization ID uses o- followed by 10-32 alphanumeric characters. The trust policy uses aws:PrincipalOrgID and sts:ExternalId so supervisors in that organization can assume the role. The legacy field name laserdata_account_id remains an accepted alias.

Create a BYOC Deployment

curl -X POST https://api.laserdata.cloud/tenants/{tenant_id}/divisions/{division_id}/environments/{environment_id}/deployments/byoc \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "byoc-prod",
    "cloud": "aws",
    "tier": "large",
    "cluster": "cluster",
    "region": "us-west-2",
    "protected": true,
    "encrypted": true,
    "storage": {
      "type": "network_balanced",
      "size": 500
    },
    "availability_mode": "multi_az",
    "subdomain_enabled": true,
    "aws": {
      "account_id": "123456789012",
      "identity_arn": "arn:aws:iam::123456789012:role/LaserDataByocRole",
      "external_id": "your-external-id",
      "vpc_id": "vpc-0abc123def456",
      "vpc_cidr": "10.0.0.0/16"
    }
  }'

Use the Compute and Storage fields from managed deployments, plus an aws credentials object. The fields managed_tier, network_scope, and dedicated do not apply. A successful request returns 202 Accepted with ld-environment and ld-deployment headers.

Create a GCP BYOC Deployment

curl -X POST https://api.laserdata.cloud/tenants/{tenant_id}/divisions/{division_id}/environments/{environment_id}/deployments/byoc \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "byoc-gcp-prod",
    "cloud": "gcp",
    "tier": "large",
    "cluster": "cluster",
    "region": "europe-west1",
    "protected": false,
    "encrypted": false,
    "storage": {
      "type": "network_balanced",
      "size": 100
    },
    "availability_mode": "single_az",
    "public_ip_enabled": true,
    "subdomain_enabled": true,
    "gcp": {
      "project_id": "my-gcp-project-123",
      "service_account_email": "[email protected]",
      "vpc_name": "default"
    }
  }'

GCP returns the same response as AWS: 202 Accepted with ld-environment and ld-deployment headers.