Overview

This topic walks through the complete Continuous Data for PaaS workflow — from initial cloud account setup through production data delivery to downstream development and testing teams. Individual operations are documented in detail on their respective pages.

Before beginning, ensure all requirements are met and that cloud credentials, IAM permissions, and network connectivity are configured. See Requirements and architecture.

1. Create a Cloud Account

Navigate to Home > Cloud Accounts and select + Create Cloud Account. The wizard collects the provider type, region, and authentication credentials.

Create separate Cloud Accounts for production and non-production if they use different credentials or belong to different cloud accounts. For example, create one Cloud Account pointing to your AWS production account and a second pointing to your non-production account — both in the same region.

After creation, DCT automatically discovers all PaaS Instances and PaaS DBs in the account. Discovery runs in the background and typically completes within one minute.

2. Identify the source database

Open the Cloud Account for your production environment. Navigate to the PaaS DBs tab and locate the production database. Click View to open its details page.

On the details page, review:

  • Overview tab: Verify the database name, platform, version, and JDBC URL.

  • Timeline tab: If rolling backups are enabled, confirm that automated backup history is visible and that a rolling backup window is shown. This confirms DCT has successfully reconstructed the backup timeline.

The production database is now the Root Source. All downstream provisioning will trace back to this database.

3. Provision a golden copy

From the production PaaS DB or PaaS Instance details page, select Actions > Provision Instance or Provision DB.

In the provisioning wizard:

  • Select the target Cloud Account. For the golden copy, this is typically the same production account.

  • Provide a name for the new database or instance.

  • If required by the platform, select the target instance to deploy the database to.

  • Select the provisioning point: Latest point-in-time, Specific snapshot, or Specific bookmark.

  • Review configuration and submit. Provisioning time depends on the size of the source database or instance. It could take anywhere from hours to days.

Once provisioned, the result is a DCT-managed PaaS object that serves as the golden copy. The original production database from which it was provisioned is automatically designated as the root source. Both appear in the Cloud Account PaaS lists.

4. Profile and mask (Continuous Compliance)

Navigate to the Continuous Compliance engine UI. Create a connector pointing to the golden copy database using its JDBC URL from the PaaS Instance or DB’s Overview tab.

In Continuous Compliance:

  1. Run profiling against the golden copy to identify sensitive data.

  2. Review profiling results. Do not run masking yet.

  3. Configure the masking ruleset based on profiling results.

  4. Navigate to the golden copy PaaS DB details page in DCT and execute the masking job from Actions > Execute Compliance Job.

  5. Verify masking completion in Continuous Compliance.

As of DCT 2026.2, all profiling and masking steps for new databases can also be performed directly within DCT using the Compliance tab on the PaaS DB details page. The workflow is the same as described above. Standard Continuous Compliance profiling and masking documentation applies.

5. Create a Bookmark

After masking is complete, navigate to the golden copy PaaS DB details page. Select Actions > Create Bookmark.

In the Create Bookmark wizard:

  • Name: Provide a meaningful name (e.g., "Q1-2026-masked-golden-copy").

  • Visibility: Set to Public to make this bookmark available to other accounts.

  • Retention: Set how long the bookmark should be retained before automatic deletion.

  • Tags: Optionally add tags for organization and access control.

The bookmark captures the current, validated state.

6. Deprovision the golden copy

Once the masked bookmark has been shared downstream and is no longer needed in an active state, deprovision the golden copy to release compute resources.

From the golden copy PaaS DB details page, select Actions > Deprovision. The database shuts down and its status changes to Deprovisioned. All DCT-managed snapshots and bookmarks remain preserved in DCT.

The golden copy can be reprovisioned at any time to create a new masked dataset for a future cycle. See Deprovision and Reprovision.

7. Provision downstream databases

Navigate to the non-production Cloud Account. From a PaaS Instance in that account, select Actions > Provision Instance or Provision DB.

In the provisioning wizard, select the masked Bookmark created in step 5 as the provisioning point. The provisioned database will contain masked data and is ready for developer and tester use.

Repeat as needed to provision multiple non-production environments from the same bookmark.

8. Self-service operations

Self-service users with appropriate DCT permissions can independently manage their non-production databases. Standard self-service operations available include:

  • Refresh: Restore the database to a different point in time (from parent, self, or shared bookmark).

  • Create Bookmark: Mark specific states for later use or sharing.

  • Share Bookmarks: Share bookmarks with other users or teams.

  • Deprovision: Stop the database when not in use to reduce compute costs.

  • Reprovision: Bring a stopped database back online at any point on its timeline.

Access is governed by the standard DCT RBAC model. Administrators can grant specific permissions using access groups and tags. See Access Control for configuration details.

Last updated
Oct 8, 2026