Skip to content

Customer-Controlled BYOC Governance

Customers retain control over the access your generated control plane has to their BYOC infrastructure. They can restrict permissions in AWS BYOC accounts or revoke and restore the agent connection to a BYOC On-Premise cluster. These controls govern operational access to the customer environment, rather than user access to your SaaS product.

AWS BYOC

For AWS BYOC accounts, the customer account owner manages control plane access through the customer-owned AccountConfigSetup CloudFormation stack. Changes to these controls are recorded in the account's CloudFormation history.

The available controls include:

  • AWS infrastructure mutation: Allow the permissions required for normal provisioning and lifecycle operations, or apply an explicit deny to non-read AWS actions while preserving read-only inspection.
  • Dataplane Kubernetes permissions: For BYOC PrivateLink host clusters, grant the dataplane agent administrative access for normal lifecycle operations or restrict it to read-only access.
  • Kubernetes debug access: For BYOC PrivateLink host clusters, enable or disable the network path the control plane uses for Kubernetes debug access.
  • Targeted enforcement: Apply the Kubernetes permission and debug-access controls across all supported host clusters, within selected AWS regions, or to individual host clusters.

Restricting infrastructure mutation or Kubernetes write access can block provisioning, updates, scaling, repairs, and deletion operations that require those permissions. For parameter values, targeting formats, update instructions, and verification, see AWS CloudFormation Account Controls. For the private connectivity model, see BYOC PrivateLink.

BYOC On-Premise

For BYOC On-Premise, the customer controls control plane access through the dataplane agent Helm release in their Kubernetes cluster. The agent initiates an outbound connection to your generated control plane; customers do not need to expose the Kubernetes API server publicly.

  • Revoke access: Uninstall the dp-agent Helm release from the dataplane-agent namespace. This disconnects the agent without uninstalling the customer's product workloads, but the control plane can no longer monitor or perform lifecycle operations in the cluster.
  • Grant or restore access: Generate a fresh install kit for the customer onboarding instance and run the Helm install command included in the kit. The generated values.yaml contains the account-specific agent configuration, so use the kit for the intended account and cluster.

For the commands and verification steps, see Control Plane Access.