Securing API Calls on OTFs | VantageCloud Lake - Securing API Calls on OTFs - Teradata Vantage

Teradata® Open Table Format for Apache Iceberg and Delta Lake User Guide

Deployment
VantageCloud
VantageCore
Edition
VMware
Enterprise
IntelliFlex
Lake
Product
Teradata Vantage
Release Number
20.00
Published
October 2025
ft:locale
en-US
ft:lastEdition
2025-10-25
dita:mapPath
qrj1749167830193.ditamap
dita:ditavalPath
lli1749584660955.ditaval
dita:id
bsr1702324250454

Teradata configures VantageCloud so that it uses HTTPS by default to secure API calls.

However, if you need to access an OTF table hosted in a bucket in a different Cloud Service Provider than the one where you currently have your Lake instance, OTF requests will gateway through the Valtix-controlled egress/ingress, which may represent a bottleneck.

For more information, go through the following table:

Cloud Service Provider Connections Lake uses to send OTF traffic through the CSP backbone Lake accessing same region buckets Lake accessing cross-region buckets
AWS AWS Gateway VPC Endpoints The API calls run through the AWS backbone. The API calls run through the public Internet.
Azure Virtual Network service endpoints The API calls run through the Azure backbone. The API calls run through the public Internet.
Google Cloud Private Google Access The API calls run through the Google backbone. The API calls run through the Google backbone.
  • These connections are already included in the Lake account by default.
  • In Azure, Teradata CloudOps enables a Global Storage Endpoint during provisioning on Lake systems. Hence if you create a storage virtual network using the Lake tenant information, such as Azure tenant id and subnet, the traffic does not leave the Microsoft backbone independently from where data is read during the deployment. On Enterprise 3.0, you need to create a support ticket to enable a Global Storage Endpoint.