ContextQMD
Back to Reflex

Bring Your Own Cloud

docs/ai_builder/organization/cloud_providers.md

0.9.8a13.7 KB
Original Source

Bring Your Own Cloud

python
import reflex as rx

By default, apps run on Reflex's infrastructure. On the Enterprise plan, you can connect your organization's own cloud account instead, so apps run on infrastructure you control and are billed directly by your provider. This is often required by security, procurement, or data-residency policies.

You connect a cloud account once from Cloud Providers in the organization sidebar. The whole organization can then deploy to it.

md
# Who can connect a cloud provider
Only organization admins can connect, view, or remove cloud provider accounts. Connecting is an Enterprise feature; [contact sales](https://reflex.dev/pricing/) to enable it.

Supported managed provider

The organization-managed connection on this page currently supports Google Cloud. AWS and Azure cannot be connected from Cloud Providers yet.

md
# Managed connection and self-service deployment are different
An organization admin can connect GCP once so members deploy to it through the normal managed Reflex workflow. Separately, Enterprise customers can run `reflex cloud deploy --gcp`, `--aws`, or `--azure` from their own machine. The self-service commands use the operator's local cloud credentials and do not create an organization-level connection.

Connecting Google Cloud

Connecting Google Cloud takes two steps:

  1. Run the setup. Reflex provides a script that prepares your Google Cloud project and creates the credentials it needs. Select Copy agent setup to copy a prompt you can hand to an AI coding agent to run the steps for you.
  2. Enter the details. Select Connect GCP and paste the values the setup produced:
    • the service account key (the contents of the key file),
    • the project number,
    • the Cloud Run region where apps should run, and
    • optionally, an Artifact Registry repository name.

Reflex validates the details and marks the provider connected.

python
rx.image(
    src="https://web.reflex-assets.dev/docs-preview/organization/cloud-providers/connect_gcp.webp",
    alt="The Connect your GCP account dialog with fields for the service account key, project number, and region",
    class_name="rounded-md h-auto mb-4",
)
md
# Your credentials are kept safe
The service account key is stored encrypted and used only to deploy and manage your organization's apps.

Once connected, the tab shows the account's status, project, region, and repository.

Removing a connection

To disconnect, open the connected provider and select Remove connection. Two effects:

  • New deployments to that cloud fail until an admin reconnects an account.
  • Apps already running there keep running, but Reflex can't manage them.

Deploying to your own cloud

Connecting an account here lets your organization's apps target managed GCP. For self-service cloud deployment and a detailed GCP walkthrough, see:

Workload isolation and namespaces

Each organization's apps run in their own isolated space on the underlying infrastructure, separate from other organizations. With bring-your-own-cloud, that isolation is inside your account.

This separation is called a namespace. Reflex sets it up and manages it; you don't configure it yourself. Enterprise customers with specific isolation requirements can discuss custom arrangements with the Reflex team.