> For the complete documentation index, see [llms.txt](https://docs.console.zenlayer.com/welcome/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.console.zenlayer.com/welcome/cloud-networking/get-started/create-a-layer-2-connection/select-a-public-cloud-as-access-point.md).
# Select a Public Cloud as Access Point
The following configurations are applicable to public cloud connections. What differs between providers is which side initiates the connection.
Amazon Web Service, Tencent Cloud, Google Cloud, Alibaba Cloud, Azure Cloud, Oracle Cloud, Huawei Cloud, BytePlus Cloud, and Volcengine connection are supported for now. More public cloud providers will be supported soon.
## Two onboarding flows
What you do on zenConsole is much the same for every provider. What differs is **which side initiates the connection**:
* **Account ID flow** — AWS, Tencent Cloud, Alibaba Cloud, Oracle Cloud, Huawei Cloud, BytePlus Cloud, and Volcengine.\
You enter the cloud account identifier on zenConsole and place the order. Zenlayer then requests the connection on the cloud side, and you confirm it on the cloud console:
* AWS and Alibaba Cloud: **accept** the connection request on the cloud console, then create the virtual interface or virtual border router and establish BGP peering.
* Tencent Cloud: there is no request to accept. Take the **connection provider ID** and the **shared tunnel ID** from the connection details on zenConsole, then create a shared dedicated tunnel on Tencent Cloud and associate it with your global VPC.
* **Key flow** — Google Cloud and Azure Cloud.\
You first create the VLAN attachment or the ExpressRoute circuit on the cloud console, obtain the **pairing key** or the **service key**, and enter it on zenConsole. The nearest region is matched from the key, so you do not select a region.
Two onboarding flows for public cloud access points
## Procedures
1. Select your cloud service provider.
2. Select the location closest to your public cloud infrastructure for the best network performance.\
The key flow skips this step — the region is matched from the key you enter.
3. Label your cloud connect for identification.
4. Enter the identifier or the key that provider requires, as listed in **Configuration by provider** below.
5. Set the VLAN ID. The system assigns one by default, and you can also choose your own. Data is transmitted in the corresponding VLAN.
{% hint style="info" %} **Note**
* Some AWS, Alibaba Cloud, and Azure Cloud regions require a cloud service request first, to activate the cloud service in that region.
* If every location is too far from you, contact Zenlayer Support to create a new cloud connect.
* If your public cloud provider is not supported on zenConsole yet, contact Zenlayer Support.
{% endhint %}
## Configuration by provider
| Provider | Flow | Enter on zenConsole | VLAN ID range | Watch out for |
| -------------- | ---------- | ------------------------ | ------------- | ------------------------------------------------------------------ |
| AWS | Account ID | Cloud account ID | 2–3499 | Some regions need a cloud service request first |
| Tencent Cloud | Account ID | Cloud account ID | 2–3000 | Create the shared dedicated tunnel on Tencent Cloud after ordering |
| Google Cloud | Key | Pairing key | 2–3499 | Some Google Cloud regions do not support interconnect |
| Alibaba Cloud | Account ID | Cloud account ID | 2–3499 | Some regions need a cloud service request first |
| Azure Cloud | Key | Service key (s-key) | 2–3499 | Some regions need a cloud service request first |
| Oracle Cloud | Account ID | Resource OCID | 2–3499 | The OCID exists only after you create the resource on Oracle Cloud |
| Huawei Cloud | Account ID | Project ID | 2–3999 | — |
| BytePlus Cloud | Account ID | International account ID | 2–2999 | — |
| Volcengine | Account ID | Account ID | 2–3499 | — |
### Google Cloud pairing key
The [**pairing key**](https://cloud.google.com/network-connectivity/docs/interconnect/concepts/terminology#pairingkey) is generated by Google Cloud when you create the VLAN attachment. Zenlayer matches the nearest region from it, so make sure the format is correct. See [**Google Cloud Configuration**](/welcome/cloud-networking/get-started/validate-connection-in-public-cloud/google-cloud-configuration.md) for how to obtain it.
### Azure service key
The **service key** (s-key) is a standard GUID that uniquely identifies an ExpressRoute circuit, mapped one to one with the circuit and generated by Azure when the circuit is created. It is the only information exchanged between Zenlayer, Azure, and you — it is not a key used for security purposes. Zenlayer matches the nearest region from it, so make sure the format is correct. See [**Microsoft Azure Cloud Configuration**](/welcome/cloud-networking/get-started/validate-connection-in-public-cloud/microsoft-azure-cloud-configuration.md) for how to obtain it.
### Oracle Cloud OCID
The **OCID** (Oracle Cloud Identifier) is the unique ID Oracle assigns to a cloud resource, visible on the Oracle console and through the API. Create the resource on Oracle Cloud first to obtain the OCID, then enter it on zenConsole. See the Oracle documentation for the creation steps.
## What to Do Next
[**Validate your cloud connect**](/welcome/cloud-networking/get-started/validate-connection-in-public-cloud.md) on the corresponding console of your public cloud provider.
