TiDB Cloud BYOC Public Preview: Fully Managed Distributed SQL in Your AWS Account

Teams running distributed SQL in production face a trade-off. A managed service removes the work of upgrades, scaling, and backups, and it moves the database into the vendor’s cloud account. Self-managing TiDB keeps the database in your account and leaves every upgrade, backup, and incident to your team.

Today, we are announcing the public preview of TiDB Cloud BYOC (Bring Your Own Cloud) on AWS. TiDB Cloud BYOC runs managed distributed SQL inside your AWS account, and TiDB Cloud handles deployment and ongoing database operations. BYOC is one of several TiDB Cloud updates announced at SCaiLE 2026.

The split is simple. Your organization controls the cloud environment and the data boundary. TiDB Cloud manages the database lifecycle through operational access you authorize.

핵심 요약

• Run your TiDB data plane in your own AWS account. TiDB Cloud BYOC handles deployment and ongoing operations.
• Keep control of access. TiDB Cloud uses scoped permissions, data is encrypted, and every operational session is audited.
• Scale on TiDB X. BYOC adds elastic scaling, workload isolation, and efficient native backup and recovery.
• Apply your existing AWS discounts to eligible infrastructure, because BYOC resources bill through your AWS account.
• Request your preferred AWS Region. Availability depends on instance types and Availability Zone requirements.

What Is TiDB Cloud BYOC?

TiDB Cloud BYOC is a deployment option that separates database management from workload execution. The data plane runs in your AWS account. The control plane, managed by PingCAP, runs orchestration and lifecycle management through TiDB Cloud.

The data plane includes database compute, storage, and networking. Your organization controls the cloud account, network policies, IAM permissions, and encryption keys.

The control plane handles deployment and lifecycle operations. Applications connect to the database’s SQL endpoint for reads and writes, and the control plane never sits in that application traffic path.

Figure: The TiDB Cloud BYOC data plane runs in your AWS account. The TiDB Cloud control plane performs authorized deployment and lifecycle operations.

BYOC brings TiDB’s MySQL compatibility, distributed ACID transactions, and horizontal scalability into your environment. Applications grow without application-level sharding. Built on TiDB X, BYOC pairs these database capabilities with cloud-native elasticity and resource efficiency.

Why Do Teams Choose TiDB Cloud BYOC Over Self-Managed TiDB?

Teams choose BYOC when policy requires production data in their own cloud account and they do not want to staff database operations. Their security policies govern network boundaries, access permissions, encryption keys, and data placement. Their cloud agreements shape how infrastructure is purchased and paid for.

Self-managed TiDB meets these requirements. It also hands the team upgrades, scaling, backups, monitoring, and incident response. That workload grows with every terabyte and every new service on the cluster.

TiDB Cloud BYOC removes that trade-off. Teams keep control of their cloud account and data boundary, keep using eligible AWS discounts, and let TiDB Cloud run the database lifecycle. Several pilot customers already use BYOC ahead of public preview.

For background on the model itself, see bring your own cloud explained.

What Do You Get with TiDB Cloud BYOC?

TiDB Cloud BYOC gives you control over your AWS environment and fully managed database operations. The four areas below cover data placement, access, operations, and cost.

Your Data and Infrastructure Stay in Your AWS Account

Database compute, storage, and networking run in your AWS account. You apply your existing policies for VPCs, IAM, encryption keys, and cloud governance. Database deployment then follows the same security and data residency rules as the rest of your stack.

Governed Access and Built-In Security

TiDB Cloud performs management operations with scoped permissions that follow the principle of least privilege. PingCAP personnel need your authorization to access the environment for troubleshooting and support, and you can revoke it. Every such session is authenticated, and connections, commands, and data access are fully audited.

Encryption protects data in transit, at rest, and in backups. Customer-managed encryption keys are available in supported configurations.

Managed Operations on TiDB X

TiDB Cloud handles deployment, monitoring, scaling, backups, upgrades, troubleshooting, and lifecycle management.

TiDB X adds three operational gains:

• Auto-scaling. Compute capacity adjusts as demand changes.
• Workload isolation. Dedicated elastic compute runs index creation and large data imports apart from online traffic, which keeps application performance predictable.
• Efficient backups. Backup tasks use fewer compute resources, which lowers the cost of routine data protection.

Your team handles growth and maintains the database with less operational effort.

More Value from Your AWS Investment

Infrastructure costs appear directly in your AWS account, so your team tracks them in existing billing and cost management tools. Eligible enterprise discounts, Savings Plans, Reserved Instances, and other committed-use benefits may apply to covered resources under your AWS agreements.

BYOC deploys on request in your preferred AWS Region. Feasibility depends on instance type availability and Availability Zone requirements. You place the database next to your applications and inside your data residency boundary.

Who Is TiDB Cloud BYOC For?

TiDB Cloud BYOC fits organizations that want managed database operations while production data and infrastructure stay in their own AWS accounts. Four profiles benefit most:

• Large-scale TiDB users. Teams that want to cut operational effort and improve infrastructure efficiency as data volumes grow.
• Organizations with strict data-control requirements. Teams with rules on cloud-account ownership, network boundaries, IAM, or encryption keys.
• Enterprises with established AWS governance and commercial agreements. Teams that need the database to fit existing security, procurement, and cost management processes.
• Applications with variable demand. Workloads that need elastic capacity for traffic spikes, seasonal peaks, and growth.

How Is TiDB Cloud BYOC Priced?

TiDB Cloud BYOC pricing has three components. You pay AWS for infrastructure and PingCAP for the managed service and support.

Total BYOC cost = AWS infrastructure cost + PingCAP BYOC service fee + PingCAP support fee

• AWS infrastructure. You pay AWS directly for EC2, EBS, S3, networking, and other resources. Eligible discounts apply under your AWS agreements.
• BYOC service fee. PingCAP charges by provisioned vCPU capacity, metered per minute and billed hourly. Rates are the same across AWS Regions.
• Support fee. BYOC requires the Enterprise support plan or higher. The fee depends on your plan.

Separate line items let your team evaluate infrastructure consumption and the managed service independently. Contact the PingCAP team for a quote based on your capacity and support requirements.

How to Join the TiDB Cloud BYOC Public Preview

Public preview onboarding runs jointly with the PingCAP team. You prepare a dedicated AWS account. Together, you configure networking and DNS, IAM permissions, certificates, secure maintenance access, and observability, then validate the deployment. The TiDB Cloud BYOC documentation walks through each phase.

Run TiDB Cloud BYOC in your own AWS account. Share your workload, preferred AWS Region, and security requirements, and the PingCAP team will scope a public preview deployment with you. Talk to the TiDB Cloud BYOC team →