byoc: add onboarding docs and diagram (#23256)

Author: lilin90

TOC-tidb-cloud-byoc.md

@@ -29,7 +29,16 @@
 
 - [Select Your Plan](/tidb-cloud/select-cluster-tier.md)
 - [Manage TiDB Cloud Resources and Projects](/tidb-cloud/manage-projects-and-resources.md)
-- Manage {{{ .premium }}} Instances
+- Deploy BYOC
+  - [Onboarding Overview](/tidb-cloud/byoc/byoc-onboarding-overview.md)
+  - [Prepare AWS Environment](/tidb-cloud/byoc/byoc-prepare-environment-aws.md)
+  - [Configure IAM Permissions](/tidb-cloud/byoc/byoc-iam-configuration.md)
+  - [Automated Deployment](/tidb-cloud/byoc/byoc-automated-deployment.md)
+  - [Service Initialization](/tidb-cloud/byoc/byoc-service-initialization.md)
+  - [Joint Validation](/tidb-cloud/byoc/joint-validation.md)
+  - [Security Hardening](/tidb-cloud/byoc/security-hardening.md)
+  - [Multi-Region Deployment](/tidb-cloud/byoc/multi-region-deployment.md)
+- Manage Instances
   - [Create a {{{ .premium }}} Instance](/tidb-cloud/premium/create-tidb-instance-premium.md)
   - Connect to Your {{{ .premium }}} Instance
     - [Connection Overview](/tidb-cloud/premium/connect-to-tidb-instance.md)

media/tidb-cloud/byoc-architecture.png

@@ -19,6 +19,7 @@ const CLOUD_TOC_FILES = [
   "TOC-tidb-cloud-premium.md",
   "TOC-tidb-cloud-starter.md",
   "TOC-tidb-cloud-essential.md",
+  "TOC-tidb-cloud-byoc.md",
 ];
 
 const PREFIX_TO_TOC = [

scripts/verify-internal-links-in-toc.js

@@ -35,6 +35,22 @@ summary: TiDB Cloud is a fully-managed Database-as-a-Service (DBaaS) that brings
 
 </LearningPath>
 
+<LearningPath label="Deploy" icon="deploy">
+
+[BYOC Onboarding Overview](https://docs.tidb.io/tidbcloud/byoc-onboarding-overview/?plan=byoc)
+
+[Prepare AWS Environment](https://docs.tidb.io/tidbcloud/byoc-prepare-environment-aws/?plan=byoc)
+
+[Configure IAM Permissions](https://docs.tidb.io/tidbcloud/byoc-iam-configuration/?plan=byoc)
+
+[Automated Deployment](https://docs.tidb.io/tidbcloud/byoc-automated-deployment/?plan=byoc)
+
+[Service Initialization](https://docs.tidb.io/tidbcloud/byoc-service-initialization/?plan=byoc)
+
+[Joint Validation](https://docs.tidb.io/tidbcloud/joint-validation/?plan=byoc)
+
+</LearningPath>
+
 <LearningPath label="Maintain" icon="cloud7">
 
 [Create a {{{ .premium }}} Instance](https://docs.tidb.io/tidbcloud/create-tidb-instance-premium/?plan=byoc)

tidb-cloud/byoc/_index.md

@@ -0,0 +1,50 @@
+---
+title: TiDB Cloud BYOC Automated Deployment
+summary: This document outlines the automated deployment process for TiDB Cloud BYOC on AWS.
+---
+
+# TiDB Cloud BYOC Automated Deployment
+
+With the AWS environment prepared and IAM permissions established, the TiDB Cloud team will initiate the automated provisioning process.
+
+> **Note:**
+>
+> This phase is fully managed by TiDB Cloud. No customer action is required until you receive the completion notification.
+
+## Deployment process
+
+The deployment consists of two automated steps:
+
+### Step 1: Image synchronization (approx. 1-2 hours)
+
+* **Customer action:** Select the AWS Region where the BYOC deployment will be created and provide the Region information to your TiDB Cloud representative.
+* **What happens:** Database container images are synchronized from the TiDB Cloud central repository to your AWS account's region.
+
+> **Note:**
+>
+> This step is time-intensive only for the **first BYOC deployment** in a new region. Subsequent deployments in the same region will reuse the existing images and complete significantly faster.
+
+### Step 2: Infrastructure provisioning (approx. 3 hours)
+
+**Action**: The system automatically provisions dedicated resources within your AWS account, including:
+
+* **Network Environment (VPC & Networking):** Creates an isolated VPC to provide a secure network foundation for the database cluster.
+
+* **Control Plane Initialization:** Deploys essential management components responsible for the database's full lifecycle management. This includes automated resource provisioning, service scheduling, elastic scaling, and failure recovery—all executed automatically with no manual intervention required.
+
+* **Compute Resource Provisioning:** Creates two EKS clusters serving the following purposes:
+
+    * Deploy Observability Services: Hosts components such as Prometheus and Grafana to collect monitoring metrics and logs.
+    * Deploy Data Plane Management Nodes: Hosts components (such as the TiDB Operator) to provide the runtime environment for the subsequent creation of TiDB compute and storage nodes.
+
+## Deployment completion
+
+Once the automation completes:
+
+1. **Notification**: You will be notified by the TiDB Cloud Team that the BYOC Region is ready.
+
+2. **Billing Activation:**
+
+    **AWS Invoice:** You will begin seeing charges from AWS for the underlying resources (EC2, NAT Gateways, EKS).
+
+**Status:** Your BYOC region is now fully operational. You may proceed to [**BYOC service initialization**](/tidb-cloud/byoc/byoc-service-initialization.md) to create your first TiDB instance.

tidb-cloud/byoc/byoc-automated-deployment.md

@@ -0,0 +1,54 @@
+---
+title: TiDB Cloud BYOC IAM Configuration
+summary: This document outlines the IAM configuration required for TiDB Cloud BYOC controller access.
+---
+
+# TiDB Cloud BYOC IAM Configuration
+
+Once the AWS environment is prepared, you must authorize the TiDB Cloud Control Plane to manage resources within your account. This is achieved by executing a bootstrapping script that establishes the necessary IAM Roles based on the Principle of Least Privilege.
+
+## Preparation
+
+Before executing the script, ensure you have the following:
+
+1. **AWS CLI installed:** The CLI must be configured with an Access Key that has permissions to create IAM roles and policies.
+2. **TiDB Cloud account info:** Contact your TiDB Cloud support representative to obtain the **Control Plane Account ID** and **Clinic Account ID**.
+
+## Gather parameters
+
+Use the table below to map the required parameters for the script:
+
+| Parameter | Source | Description |
+| :---- | :---- | :---- |
+| `<ControlPlaneAccountId>` | **TiDB Support** | The AWS Account ID of the TiDB Control Plane. |
+| `<ClinicAccountId>` | **TiDB Support** | The AWS Account ID for the TiDB Clinic service. |
+| `<TidbHostedZoneId>` | [Required information](/tidb-cloud/byoc/byoc-prepare-environment-aws.md#summary-required-information) | The ID of the TiDB Cluster Hosted Zone you created. |
+| `<O11yHostedZoneId>` | [Required information](/tidb-cloud/byoc/byoc-prepare-environment-aws.md#summary-required-information) | The ID of the Observability Hosted Zone you created. |
+| `<TidbPCAArn>` | [Required information](/tidb-cloud/byoc/byoc-prepare-environment-aws.md#summary-required-information) | The ARN of the Private CA you created. |
+
+## Execute bootstrapping script
+
+1. Download the script from the [PingCAP GitHub repository](https://github.com/tidbcloud/byoc-account-setup/tree/main).
+
+2. In your terminal, run the following command. Note to replace the placeholders with your actual values.
+
+    ```bash
+    sh tidbcloud-byoc-setup.sh \
+        --control-plane-id <ControlPlaneAccountId> \
+        --clinic-id <ClinicAccountId> \
+        --tidb-hz-id <TidbHostedZoneId> \
+        --o11y-hz-id <O11yHostedZoneId> \
+        --pca-arn <TidbPCAArn>
+    ```
+
+3. Monitor the process. Upon execution, the script initiates AWS CloudFormation to provision and update resources. You can observe a log stream in the terminal displaying status messages such as `waiting for changeset to be created` and `successfully created/updated stack`.
+
+<!--To confirm: whether to add image-->
+
+## Verification
+
+After execution, the script will output the ARNs of the created IAM roles.
+
+* **Action required:** Share the **execution result/log** with your TiDB Cloud representative.
+
+* **Next step:** Once TiDB Cloud verifies the roles, the [automated deployment](/tidb-cloud/byoc/byoc-automated-deployment.md) will be triggered.

tidb-cloud/byoc/byoc-iam-configuration.md

@@ -0,0 +1,36 @@
+---
+title: TiDB Cloud BYOC Onboarding Overview
+summary: Overview of the TiDB Cloud BYOC onboarding process, detailing the responsibilities and steps for both the customer and TiDB Cloud team.
+---
+
+# TiDB Cloud BYOC Onboarding Overview
+
+TiDB Cloud BYOC (Bring Your Own Cloud) is an enterprise solution that lets you run the data plane in your own cloud environment while retaining the fully managed experience of TiDB Cloud.
+
+The TiDB Cloud BYOC deployment process is a collaborative effort between your organization and the TiDB Cloud team. The process includes secure infrastructure preparation, automated provisioning, and comprehensive validation.
+
+<!--TO confirm: might need to state that currently only AWS is supported and the word AWS is not used in title for future content scale.-->
+
+## Deployment phases
+
+| Phase | Responsibility | Description |
+| :---- | :---- | :---- |
+| [**Phase 1: Environment preparation**](/tidb-cloud/byoc/byoc-prepare-environment-aws.md) | **Customer** | Prepare the AWS foundation required for deployment. This includes creating a dedicated AWS account configuring Route 53 Hosted Zones setting up the private certificate authority (PCA). |
+| [**Phase 2: IAM bootstrapping**](/tidb-cloud/byoc/byoc-iam-configuration.md) | **Customer** | Execute the provided bootstrapping scripts to install the necessary IAM roles and policies. This authorizes the TiDB Cloud Control Plane to securely manage resources within your AWS account. |
+| [**Phase 3: Automated deployment**](/tidb-cloud/byoc/byoc-automated-deployment.md) | **TiDB Cloud** | Once IAM permissions are verified, TiDB Cloud automatically provisions the VPC, EKS clusters, and control plane resources. Note: This process is **fully automated** and requires no customer intervention. |
+| [**Phase 4: Service initialization**](/tidb-cloud/byoc/byoc-service-initialization.md) | **Customer** | Create your TiDB instance via the console. Subsequently, deploy the Bastion Host and authentication scripts to establish secure maintenance channels (Tailscale) and observability pipelines. Note: You may also choose to establish maintenance channels using your own custom methods. |
+| [**Phase 5: Validation**](/tidb-cloud/byoc/joint-validation.md) | **Joint** | Both teams collaborate to validate connectivity, verify metric collection, and confirm system health to ensure the BYOC environment is ready for use. |
+
+> **Note:**
+>
+> Each phase requires timely coordination between teams. We recommend assigning dedicated resources from both organizations to ensure smooth progression through all stages.
+
+## Architecture overview
+
+TiDB Cloud BYOC employs a strict separation between the Control Plane and the Data Plane. Your data remains entirely within your AWS account. The Control Plane connects to your VPC exclusively via AWS PrivateLink. No public internet exposure is required for database nodes.
+
+> **Note:**
+>
+> This architecture defaults to a Multi-AZ deployment for production high availability, but also supports a Single-AZ deployment for Proof of Concept (POC) or cost optimization scenarios.
+
+![TiDB Cloud BYOC Architecture](/media/tidb-cloud/byoc-architecture.png)