Dedicated Infrastructure on AWS

On AWS, Cube offers single-tenant Dedicated Infrastructure operated by Cube, and Bring Your Own Cloud (BYOC) operated inside your own AWS account. Both options support private network connectivity so that data source traffic — and, optionally, Cube API traffic — never traverses the public internet.

Backend connectivity (Cube → your network)

Use these options to give Cube private access to your data sources, auth providers, BI APIs targeted by Semantic Layer Sync, and anything else Cube needs to query. See Backend and frontend connectivity for the full picture.

• AWS PrivateLink — let Cube reach data sources (your own services, Snowflake, Databricks, etc.) over PrivateLink endpoint services you expose.
• VPC Peering — establish a VPC peering connection between the Cube VPC and your own VPC for access to internal data sources.

Frontend connectivity (your clients → Cube)

Use this option to expose Cube's APIs to your applications, browsers, BI tools, embedded analytics clients, and Semantic Layer Sync-generated configs over a private network. Public endpoints can be disabled entirely on request.

• Private API Connectivity — expose Cube's HTTP and SQL APIs over AWS PrivateLink.

Bring Your Own Cloud

If you'd like the entire Cube data plane to live inside your own AWS account, see Bring Your Own Cloud on AWS.