Architecture overview
Db2® Warehouse SaaS BYOC architecture separates control and data responsibilities to ensure secure, scalable, and compliant operations.
Db2 Warehouse SaaS BYOC architecture is designed to separate control and data responsibilities between IBM and the customer, ensuring secure, scalable, and compliant operations. The architecture spans two Azure environments: one managed by IBM (Control Plane) and the other owned by the customer (Data Plane).
Trust between Control Plane and Data Plane
To enable the IBM Control Plane to interact with components in the Data Plane, specific access permissions must be established during the provisioning process. We recommend reviewing the provided ARM template prior to deploying the Data Plane to fully understand the permissions granted to IBM. These include:
- A set of resource groups that components are deployed in
- Azure Lighthouse delegation to these resource groups, allowing IBM Operations to manage the service
- A collection of managed identities and role assignments required for service functionality