> ## Documentation Index
> Fetch the complete documentation index at: https://private-7c7dfe99-home-button.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# BYOC privilege

> Deploy ClickHouse on your own cloud infrastructure

<h2 id="aws-iam-roles">
  AWS IAM roles
</h2>

<h3 id="bootstrap-iam-role">
  Bootstrap IAM role
</h3>

The bootstrap IAM role has the following permissions:

* **EC2 and VPC operations**: Required for setting up VPC and EKS clusters.
* **S3 operations (e.g., `s3:CreateBucket`)**: Needed to create buckets for ClickHouse BYOC storage.
* **IAM operations (e.g., `iam:CreatePolicy`)**: Needed for controllers to create additional roles (see the next section for details).
* **EKS operations**: Limited to resources with names starting with the `clickhouse-cloud` prefix.

<h3 id="additional-iam-roles-created-by-the-controller">
  Additional IAM roles created by the controller
</h3>

In addition to the `ClickHouseManagementRole` created via CloudFormation, the controller will create several additional roles.

These roles are assumed by applications running within the customer's EKS cluster:

* **State Exporter Role**
  * ClickHouse component that reports service health information to ClickHouse Cloud.
  * Requires permission to write to an SQS queue owned by ClickHouse Cloud.
* **Load-Balancer Controller**
  * Standard AWS load balancer controller.
  * EBS CSI Controller to manage volumes for ClickHouse services.
* **External-DNS**
  * Propagates DNS configurations to Route 53.
* **Cert-Manager**
  * Provisions TLS certificates for BYOC service domains.
* **Cluster Autoscaler**
  * Adjusts the node group size as needed.

**K8s-control-plane** and **k8s-worker** roles are meant to be assumed by AWS EKS services.

Lastly, **`data-plane-mgmt`** allows a ClickHouse Cloud Control Plane component to reconcile necessary custom resources, such as `ClickHouseCluster` and the Istio Virtual Service/Gateway.