---
title: "Configuring Your Cloud Account for VAST Polaris"
slug: "configuring-your-cloud-account-for-vast-polaris"
updated: 2026-10-28T02:14:51Z
published: 2026-10-28T02:14:51Z
canonical: "docs.vastdata.com/configuring-your-cloud-account-for-vast-polaris"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Your Cloud Account for VAST Polaris

## Configuring GCP for VAST Polaris

The following sections describe how to configure your GCP account to host VAST on Cloud clusters.

### Prerequisites

- A GCP account with a GCP project, into which the Vast on Cloud cluster will be deployed.

### Configuring Your GCP Project for VAST Polaris Clusters

Configure the following in your GCP project, from the GCP Console.

#### Enable Google Cloud APIs

Enable these Google APIs:

- **Compute API** In **Compute/VM Instances**
- **Secret Manager API**, in **Security/Secret Manager API**

Optionally, these APIs are recommended:

- **Artifact Registry API**
- **Compute Engine API**
- **Network Management API**
- **Service Networking API**
- **Network Security API**
- **Cloud Monitoring API**
- **Cloud Logging API**

#### Set up Private Networking

In the **VPC Networks** page, configure **Private Services Access** to your VPC by **Allocating IP Ranges for Services** and **Creating Private Connections to Service**.

#### Set up NAT per Region

In **Network Services/Cloud NAT**, create a Cloud NAT Gateway with these details, for each region that has a VoC cluster:

- **Region**: the region containing the cluster
- **Router**: Create New Router
- **Network Tier Service**: Premium

#### Configure Firewall Rules

In **Network Security/Firewall**, configure firewall policies as follows.

1. Create a firewall rule for cluster traffic with these details:
  - **Direction**: ingress
  - **Action on match**: allow
  - **Target tags**: add *voc-internal* (this tag is used by the VoC cluster)
  - **Source tags:**add *voc-internal*
  - **Protocols and ports**:

| TCP | 22, 80, 111, 389, 443, 445, 636, 2049, 3128, 3268, 3269, 4000, 4001, 4100, 4101, 4200, 4201, 4420, 4520, 5000, 5200, 5201, 5551, 6000, 6001, 6126, 7000, 7001, 7100, 7101, 8000, 9090, 9092, 9093, 20048, 20106, 20107, 20108, 49001, 49002 |
| --- | --- |
| UDP | 4005, 4105, 4205, 5205-5240, 6005, 7005, 7105 |
| ICMP | enabled |

- Leave all other rule settings as the defaults.

#### Quotas and Policy Constraints

Your GCP project should have these quotas:

- **Quota for Local SSD**, This is set per region, and must allow for at least 36TB for local SSDs per ENode,
- **Note**
- Increasing the default quota to a sufficient level for a VAST cluster deployment can take some time, and is not done instantly using the GCP Console UI.
- **Quota for z3**, Allocate sufficient instances for your cluster needs. A single ENode requires 88 CPUs.
- **Quota for Static Routes per VPC Network**. This is set per VPC network, This should allow for any IPs you use to connect to the cluster.
- **Quota for static routes per peering group**. This is set per peering group (for all peered projects). Peered groups contain VPCs within the a common project, that can be connected. These connections require static routes. The quota should allow for all the connection routes between VPCs in the peering group.

To avoid problems when creating the cluster in GCP, organizational level policy constraints should not conflict with cluster requirements. For example, policies that restrict creation of z3 VMs.

## Configuring Your AWS Account for VAST Polaris Clusters

### Security Groups

Add this security groups for VAST Polaris

{ "Statement": [ { "Action": [ "ec2:DescribeVpcs", "ec2:DescribeVolumes", "ec2:DescribeTags", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribePlacementGroups", "ec2:DescribeNetworkInterfaces", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeKeyPairs", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeScalingActivities" ], "Effect": "Allow", "Resource": "*", "Sid": "DescribeResources" }, { "Action": [ "ec2:RunInstances", "ec2:CreateVolume", "ec2:CreatePlacementGroup", "ec2:CreateNetworkInterface", "ec2:CreateLaunchTemplate", "autoscaling:CreateAutoScalingGroup", "secretsmanager:TagResource", "secretsmanager:CreateSecret", "logs:TagResource", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Condition": { "StringEquals": { "aws:RequestTag/used_by": "voc_cluster" } }, "Effect": "Allow", "Resource": "*", "Sid": "CreateResources" }, { "Action": [ "ec2:TerminateInstances", "ec2:ModifyLaunchTemplate", "ec2:DetachVolume", "ec2:DetachNetworkInterface", "ec2:DeleteVolume", "ec2:DeletePlacementGroup", "ec2:DeleteNetworkInterface", "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:AttachVolume", "ec2:AttachNetworkInterface", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:DeleteAutoScalingGroup", "iam:UntagPolicy", "iam:UntagInstanceProfile", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:DeleteRole", "iam:DeletePolicy", "iam:DeleteInstanceProfile", "iam:CreatePolicyVersion", "iam:AttachRolePolicy", "iam:AddRoleToInstanceProfile", "secretsmanager:UntagResource", "secretsmanager:PutSecretValue", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", "logs:UntagResource", "logs:PutRetentionPolicy", "logs:PutLogEvents", "logs:ListTagsForResource", "logs:DeleteLogStream", "logs:DeleteLogGroup" ], "Condition": { "StringEquals": { "aws:ResourceTag/used_by": "voc_cluster" } }, "Effect": "Allow", "Resource": "*", "Sid": "ModifyResources" }, { "Action": "ec2:CreateTags", "Condition": { "StringEquals": { "aws:RequestTag/used_by": "voc_cluster" } }, "Effect": "Allow", "Resource": [ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:spot-instances-request/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:instance/*" ], "Sid": "CreateEC2ResourceTags" }, { "Action": [ "ec2:RunInstances", "ec2:CreateNetworkInterface" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "used_by" } }, "Effect": "Allow", "Resource": "*", "Sid": "CreateEC2ResourcesEnforceTagging" }, { "Action": "iam:PassRole", "Condition": { "ForAnyValue:StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } }, "Effect": "Allow", "Resource": "arn:aws:iam::*:role/voc/*", "Sid": "PassRole" }, { "Action": [ "iam:UntagRole", "iam:TagRole", "iam:PutRolePolicy", "iam:ListInstanceProfilesForRole", "iam:ListAttachedRolePolicies", "iam:GetRolePolicy", "iam:GetRole", "iam:CreateRole", "iam:AttachRolePolicy" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:role/voc/*", "Sid": "ManageIAMVocResources" }, { "Action": [ "iam:TagPolicy", "iam:SetDefaultPolicyVersion", "iam:ListPolicyVersions", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:DeletePolicyVersion", "iam:CreatePolicyVersion", "iam:CreatePolicy" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:policy/voc/*", "Sid": "ManageIAMPolicies" }, { "Action": [ "iam:TagInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:GetInstanceProfile", "iam:CreateInstanceProfile" ], "Effect": "Allow", "Resource": "arn:aws:iam::*:instance-profile/voc/*", "Sid": "ManageIAMInstanceProfiles" } ], "Version": "2012-10-17" }

### Ports

These ports need to be open in the VPC:

| TCP | 22, 80, 111, 389, 443, 445, 636, 2049, 3128, 3268, 3269, 4000, 4001, 4100, 4101, 4200, 4201, 4420, 4520, 5000, 5200, 5201, 5551, 6000, 6001, 6126, 7000, 7001, 7100, 7101, 8000, 9090, 9092, 9093, 20048, 20106, 20107, 20108, 49001, 49002 |
| --- | --- |
| UDP | 4005, 4105, 4205, 5205-5240, 6005, 7005, 7105 |
| ICMP | enabled |