byoc: update onboarding content

TOC-tidb-cloud-byoc.md

@@ -34,7 +34,7 @@
   - [Onboarding Overview](/tidb-cloud/byoc/byoc-onboarding-overview.md)
   - [Prepare AWS Environment](/tidb-cloud/byoc/byoc-prepare-environment-aws.md)
   - [Configure IAM Permissions](/tidb-cloud/byoc/byoc-configure-iam-permissions.md)
-  - [Automated Deployment](/tidb-cloud/byoc/byoc-automated-deployment.md)
+  - [Automated Region Deployment](/tidb-cloud/byoc/byoc-automated-deployment.md)
   - [Initialize Service](/tidb-cloud/byoc/byoc-initialize-service.md)
   - [Configure a Bastion Host](/tidb-cloud/byoc/byoc-configure-bastion-host.md)
   - [Joint Validation](/tidb-cloud/byoc/joint-validation.md)

tidb-cloud/byoc/_index.md

@@ -41,11 +41,11 @@ summary: TiDB Cloud is a fully-managed Database-as-a-Service (DBaaS) that brings
 
 [Prepare AWS Environment](https://docs.tidb.io/tidbcloud/byoc-prepare-environment-aws/?plan=byoc)
 
-[Configure IAM Permissions](https://docs.tidb.io/tidbcloud/byoc-iam-configuration/?plan=byoc)
+[Configure IAM Permissions](https://docs.tidb.io/tidbcloud/byoc-configure-iam-permissions/?plan=byoc)
 
-[Automated Deployment](https://docs.tidb.io/tidbcloud/byoc-automated-deployment/?plan=byoc)
+[Automated Region Deployment](https://docs.tidb.io/tidbcloud/byoc-automated-deployment/?plan=byoc)
 
-[Service Initialization](https://docs.tidb.io/tidbcloud/byoc-service-initialization/?plan=byoc)
+[Initialize the Service](https://docs.tidb.io/tidbcloud/byoc-initialize-service/?plan=byoc)
 
 [Joint Validation](https://docs.tidb.io/tidbcloud/joint-validation/?plan=byoc)
 

tidb-cloud/byoc/byoc-automated-deployment.md

@@ -1,51 +1,89 @@
 ---
-title: TiDB Cloud BYOC Automated Deployment
-summary: This document outlines the automated deployment process for TiDB Cloud BYOC on AWS.
+title: TiDB Cloud BYOC Automated Region Deployment
+summary: This document outlines the automated region deployment process for TiDB Cloud BYOC on AWS.
 ---
 
-# TiDB Cloud BYOC Automated Deployment
+# TiDB Cloud BYOC Automated Region Deployment
 
 With the AWS environment prepared and IAM permissions established, the TiDB Cloud team will initiate the automated provisioning process.
 
 > **Note:**
 >
-> This phase is fully managed by TiDB Cloud. No customer action is required until you receive the completion notification.
+> This phase is managed by TiDB Cloud and normally requires no customer action. If the deployment is blocked by customer-managed policies, AWS service quotas, or network restrictions, the TiDB Cloud team will contact you for assistance.
 
-## Deployment process
+## Deployment overview
 
-The deployment consists of two automated steps:
+The automated region deployment consists of the following stages:
 
-### Step 1: Image synchronization (approx. 1-2 hours)
+1. Synchronize container images to your AWS account.
+2. Deploy the regional management plane.
+3. Deploy customer-side observability and supporting infrastructure.
+4. Register and validate the new BYOC region.
 
-* **Customer action:** Select the AWS Region where the BYOC deployment will be created and provide the Region information to your TiDB Cloud representative.
-* **What happens:** Database container images are synchronized from the TiDB Cloud central repository to your AWS account's region.
+The deployment creates resources in both a TiDB Cloud-managed AWS account and your AWS account. This phase prepares the BYOC region for subsequent resource pool and instance creation, but does **not** create any TiDB resource pools or instances.
 
-> **Note:**
->
-> This step is time-intensive only for the **first BYOC deployment** in a new region. Subsequent deployments in the same region will reuse the existing images and complete significantly faster.
+## Step 1: Image synchronization
 
-### Step 2: Infrastructure provisioning (approx. 3 hours)
+The image synchronization step takes approximately 1-2 hours.
 
-**Action**: The system automatically provisions dedicated resources within your AWS account, including:
+**Customer action:**
 
-* **Network Environment (VPC & Networking):** Creates an isolated VPC to provide a secure network foundation for the database cluster.
+Select the AWS Region for the BYOC deployment and provide the Region information to your TiDB Cloud representative.
 
-* **Control Plane Initialization:** Deploys essential management components responsible for the database's full lifecycle management. This includes automated resource provisioning, service scheduling, elastic scaling, and failure recovery—all executed automatically with no manual intervention required.
+**What happens:**
 
-* **Compute Resource Provisioning:** Creates two EKS clusters serving the following purposes:
+TiDB Cloud synchronizes the required container images from its central image repository to an Amazon ECR registry in your AWS account.
 
-    * Deploy Observability Services: Hosts components such as Prometheus and Grafana to collect monitoring metrics and logs.
-    * Deploy Data Plane Management Nodes: Hosts components (such as the TiDB Operator) to provide the runtime environment for the subsequent creation of TiDB compute and storage nodes.
+The first deployment in a new AWS Region can take longer because it must synchronize all required images. Subsequent deployments in the same Region reuse the synchronized images and typically complete faster.
 
-## Deployment completion
+## Step 2: Deploy the regional management plane
+
+TiDB Cloud deploys a regional management plane in a TiDB Cloud-managed AWS account.
+
+The regional management plane includes infrastructure and services used to manage the lifecycle of your BYOC environment, such as:
+
+- A dedicated VPC and Amazon EKS cluster
+- Regional management and API services
+- Configuration and metadata services
+- Components for instance provisioning, scheduling, scaling, and recovery
+- Integration with the TiDB Cloud global control plane
+
+The regional management plane does not store your TiDB application data.
+
+## Step 3: Deploy customer-side supporting infrastructure
+
+TiDB Cloud assumes the IAM roles created during account bootstrapping and deploys the required supporting resources in your AWS account.
 
-Once the automation completes:
+These resources include:
 
-1. **Notification**: You will be notified by the TiDB Cloud Team that the BYOC Region is ready.
+- An isolated VPC for the observability environment
+- A dedicated Amazon EKS cluster for observability services
+- Metrics, logging, and alerting components
+- Supporting storage, load balancers, API endpoints, DNS records, and certificates
+- Audit-log and service-level indicator resources
+- Secure connectivity between the customer-side environment and the regional management plane
+
+> **Note:**
+>
+> The Amazon EKS cluster created in this step hosts observability and other supporting services. It is **not** the TiDB data plane for a TiDB instance. The TiDB data plane is initialized when you create your first BYOC instance in the TiDB Cloud console.
+
+## Step 4: Register and validate the BYOC region
+
+After the infrastructure and services are deployed, TiDB Cloud:
+
+- Registers the BYOC region with the TiDB Cloud global control plane.
+- Verifies that regional management services are healthy.
+- Verifies connectivity to the customer-side observability environment.
+- Confirms that metrics and logs can flow through the expected paths.
+- Confirms that the region is ready for TiDB instance creation.
+
+## Deployment completion
 
-2. **Billing Activation:**
+After the automated region deployment completes:
 
-    **AWS Invoice:** You will begin seeing charges from AWS for the underlying resources (EC2, NAT Gateways, EKS).
+- The TiDB Cloud team notifies you that the BYOC region is ready.
+- The new BYOC region becomes available for instance creation.
+- AWS starts charging your account for the customer-owned resources created during deployment, such as Amazon EKS, EC2, NAT Gateway, load balancers, and storage.
 
 ## What's next
 

tidb-cloud/byoc/byoc-configure-iam-permissions.md

@@ -53,4 +53,4 @@ After execution, the script will output the ARNs of the created IAM roles.
 
 ## What's next
 
-After TiDB Cloud verifies the IAM roles, continue with [TiDB Cloud BYOC Automated Deployment](/tidb-cloud/byoc/byoc-automated-deployment.md). TiDB Cloud will trigger the automated deployment.
+After TiDB Cloud verifies the IAM roles, continue with [TiDB Cloud BYOC Automated Region Deployment](/tidb-cloud/byoc/byoc-automated-deployment.md). TiDB Cloud will trigger the automated region deployment.

tidb-cloud/byoc/byoc-onboarding-overview.md

@@ -17,7 +17,7 @@ The TiDB Cloud BYOC deployment process is a collaborative effort between your or
 | :---- | :---- | :---- |
 | [Phase 1: Environment preparation](/tidb-cloud/byoc/byoc-prepare-environment-aws.md) | Customer | Prepare the AWS foundation required for deployment. This includes creating a dedicated AWS account, configuring Route 53 hosted zones, and setting up the private certificate authority (PCA). |
 | [Phase 2: IAM bootstrapping](/tidb-cloud/byoc/byoc-configure-iam-permissions.md) | Customer | Execute the provided bootstrapping scripts to install the necessary IAM roles and policies. This authorizes the TiDB Cloud Control Plane to securely manage resources within your AWS account. |
-| [Phase 3: Automated deployment](/tidb-cloud/byoc/byoc-automated-deployment.md) | TiDB Cloud | Once IAM permissions are verified, TiDB Cloud automatically provisions the VPC, EKS clusters, and control plane resources. Note: This process is **fully automated** and requires no customer intervention. |
+| [Phase 3: Automated region deployment](/tidb-cloud/byoc/byoc-automated-deployment.md) | TiDB Cloud | Once IAM permissions are verified, TiDB Cloud automatically provisions the VPC, EKS clusters, and control plane resources. Note: This process is **fully automated** and requires no customer intervention. |
 | [Phase 4: Service initialization](/tidb-cloud/byoc/byoc-initialize-service.md) | Customer | Create your TiDB instance via the console. Subsequently, [configure a Bastion Host](/tidb-cloud/byoc/byoc-configure-bastion-host.md) and authentication scripts to establish secure maintenance channels (Tailscale) and observability pipelines. Note: You may also choose to establish maintenance channels using your own custom methods. |
 | [Phase 5: Validation](/tidb-cloud/byoc/joint-validation.md) | Joint | Both teams collaborate to validate connectivity, verify metric collection, and confirm system health to ensure the BYOC environment is ready for use. |
 

tidb-cloud/byoc/byoc-prepare-environment-aws.md

@@ -90,15 +90,17 @@ TiDB Cloud utilizes the AWS private certificate authority (PCA) service to issue
 
 To meet compliance requirements, TiDB Cloud BYOC integrates with a customer-provided PCA to issue identity certificates for data nodes using your enterprise's own domain. This ensures that the Root of Trust for all encrypted communications remains strictly within your organization's control.
 
-Therefore, you must prepare a valid Subordinate CA in the deployment region. Please follow the steps below:
+Therefore, you must prepare a valid subordinate CA in the deployment region. The CA ARN that you provide to TiDB Cloud must be the ARN of the subordinate CA. To create and activate the subordinate CA, you need an active root CA to sign its certificate.
 
-1. **Create a CA.** Follow [Create a private CA in AWS Private CA](https://docs.aws.amazon.com/privateca/latest/userguide/create-CA.html).
+The subordinate CA certificate must be valid for at least **20 years**. Make sure that the root CA used to sign the subordinate CA certificate supports this validity period.
 
-    Configuration: Ensure the validity period is set to at least **20 years**.
+Perform the following steps:
 
-2. **Install the CA certificate.** Follow [Installing the CA certificate](https://docs.aws.amazon.com/privateca/latest/userguide/PCACertInstall.html).
+1. **Create a subordinate CA.** Follow [Create a private CA in AWS Private CA](https://docs.aws.amazon.com/privateca/latest/userguide/create-CA.html).
 
-    Prerequisite: You must have an active Root CA.
+    Configuration: select **Subordinate CA** as the CA type. Do not provide a root CA ARN to TiDB Cloud.
+
+2. **Install the subordinate CA certificate.** Follow [Installing the CA certificate](https://docs.aws.amazon.com/privateca/latest/userguide/PCACertInstall.html).
 
 3. **Record ARN.** Copy the **Subordinate CA ARN**.
 
@@ -139,7 +141,7 @@ When planning the CIDR ranges, ensure that:
 
 3. **Cross-Cluster Replication (Critical):** If you plan to deploy multiple TiDB clusters (whether in the same region or across different regions) and eventually want to **replicate data between them** (for example, using TiCDC for Disaster Recovery or data consolidation), their respective TiDB Cluster CIDR ranges **must be de-conflicted**.
 
-Provide the planned CIDR ranges to your TiDB Cloud representative before the automated deployment starts.
+Provide the planned CIDR ranges to your TiDB Cloud representative before the automated region deployment starts.
 
 ## Summary: Required information
 
@@ -156,13 +158,13 @@ Fill out the table below with the information gathered in steps above and share
 | **Subordinate CA ARN** | AWS ACM Private CA ARN | `arn:aws:acm-pca:us-west-2:123456789012:ca/abcd-1234` | Step 5. The ARN can be shared across multiple regions. |
 | **Hosted Zone Names & Host Zone ID** | TiDB Cluster Zone, Observability (O11Y) Zone | **Hosted TiDB cluster zone name:** `clusters.byoc-0929.pingcap.net`; **Hosted TiDB cluster zone ID:** `Z1039122VAY4T8UNWR8E`. **Hosted O11Y zone name:** `o11y.byoc-0929.pingcap.net`; **Hosted O11Y zone ID:** `Z10389823CTXFNM7VG79P`. | Step 4. The zone names and IDs can be shared across multiple regions. |
 | **CIDR** | Customer-planned CIDR range for the TiDB cluster, Customer-planned CIDR range for the O11Y cluster | **TiDB cluster CIDR:** `10.10.0.0/16`; **O11Y cluster CIDR:** `10.20.0.0/16` | Step 6 |
-| **Image Sync Region** | Region ID chosen for image synchronization | `us-west-2` | Refer to [image synchronization](/tidb-cloud/byoc/byoc-automated-deployment.md#deployment-process) for details. |
+| **Image Sync Region** | Region ID chosen for image synchronization | `us-west-2` | Refer to [image synchronization](/tidb-cloud/byoc/byoc-automated-deployment.md#step-1-image-synchronization) for details. |
 
 ## Review and increase AWS service quotas
 
 AWS service quota requirements vary by customer environment. The required quota values depend on factors such as your workload size, target capacity, selected AWS region, availability mode, and expected scaling range.
 
-During environment preparation, work with TiDB Cloud Support or your TiDB Cloud representative to calculate the required quota values for your deployment. If your current AWS service quotas are lower than the calculated requirements, request quota increases before the automated deployment starts.
+During environment preparation, work with TiDB Cloud Support or your TiDB Cloud representative to calculate the required quota values for your deployment. If your current AWS service quotas are lower than the calculated requirements, request quota increases before the automated region deployment starts.
 
 ### Quota categories to review
 
@@ -183,4 +185,4 @@ Review the following quota categories in each target AWS region:
 
 ## What's next
 
-After you have prepared the AWS environment and shared the required information with your TiDB Cloud representative, continue with [TiDB Cloud BYOC IAM Configuration](/tidb-cloud/byoc/byoc-configure-iam-permissions.md) to configure the IAM permissions required for automated deployment.
+After you have prepared the AWS environment and shared the required information with your TiDB Cloud representative, continue with [TiDB Cloud BYOC IAM Configuration](/tidb-cloud/byoc/byoc-configure-iam-permissions.md) to configure the IAM permissions required for automated region deployment.