Differences between Spanner and Spanner Omni

Preview

This product or feature is a preview offering subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms, and can only be used for the purposes of developing, testing, prototyping, and demonstrating software programs. It cannot be used for any data processing or commercial purposes. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

Use this document to learn about the key differences between the cloud-based, managed Spanner service and the self-managed, downloadable Spanner Omni database.

While both products share the same distributed database engine, they differ in how you deploy, scale, secure, and manage them.

Core differences and management model

The following table compares the licensing, environments, and service-level agreements (SLAs) for the two products.

Management model and environment differences

Feature	Spanner	Spanner Omni
Management model	Google Cloud fully manages the service. Google handles deployment, patching, backups, and maintenance.	You manage the database. You install, patch, back up, and maintain the hardware and software. For more information, see the Spanner Omni overview.
Deployment environment	Runs exclusively within Google Cloud infrastructure.	Runs on your own hardware, including on-premises data centers, other cloud providers, and your laptop. For more information, see the system requirements.
Installation	You access the database as a service. You don't need to install any software.	You must download and install the binaries or container images.
Updates and upgrades	Google automatically applies updates and upgrades without downtime.	You apply updates and patches manually, with no downtime for scale-out deployments. For more information, see maintain a deployment.
Service Level Agreement (SLA)	Google Cloud service level agreements (SLAs) apply. For more information, see the Spanner SLA page.	Spanner Omni doesn't have an SLA. Availability depends on your infrastructure and configuration.
Pricing	Google charges based on compute resource capacity (nodes or processing units), database storage, backup storage, replication, Data Boost, and network egress. For more information, see the Spanner pricing page (outside this documentation set).	You incur self-managed infrastructure costs. Google charges a licensing fee for Spanner Omni production and commercial usage. For more information, see the Spanner Omni pricing details.

Feature support and compatibility

Google strives for feature parity between Spanner and Spanner Omni. However, there are differences between the managed version of Spanner that runs in Google Cloud and Spanner Omni. While Spanner Omni runs the same underlying query engine, it doesn't support all of the features in the cloud-managed service. The following table lists the primary differences.

Feature support and compatibility differences

Feature	Spanner	Spanner Omni
Supported features	Provides the full Spanner feature set.	Supports core Spanner features. For more information, see the Spanner Omni overview. The following features are not supported: BigQuery integration (for example, federation, external schema, and exporting data to Spanner Omni using reverse ETL) Gemini Enterprise Agent Platform in Databases integration Data Boost Knowledge Catalog integration Geo-partitioning Full-Text Search enhanced query mode High-scale approximate nearest neighbor (ANN) search Tiered storage Incremental backups Built-in customer-managed encryption keys (CMEK) integration Automatic reconfiguration to a single region in dual-region mode Scale-up graph algorithms
Point-in-Time Recovery (PITR)	You can configure the version retention period up to seven days. For more information, see Point-in-Time Recovery.	You can configure the version retention period up to 30 days. For more information, see the timestamp bounds documentation.
TrueTime implementation	Uses Google's hardware-based synchronized atomic clocks and GPS receivers in Google Cloud data centers. For more information, see TrueTime and external consistency.	Uses a software-defined TrueTime API to maintain strong external consistency. For more information, see TrueTime and external consistency.
Client library support	Supports a wide range of programming languages. For more information, see APIs and client libraries.	Supports Java, Go, and Python. For more information, see client library support.
API protocols	Supports both gRPC and REST APIs.	Supports gRPC.

Security, authentication, and authorization

The security implementation of the self-managed model uses a shared responsibility structure. The following table outlines the security configurations and access controls.

Security, authentication, and authorization differences

Feature	Spanner	Spanner Omni
Security model	Google manages physical and infrastructure security.	You secure the compute servers, storage, network perimeter, and container environments. For more information, see authentication and authorization.
Encryption at rest	Data at rest is encrypted by default. You can configure customer-managed encryption keys (CMEK) using Cloud Key Management Service. For more information, see customer-managed encryption keys.	Built-in encryption at rest isn't provided. You must configure disk-level or file-system-level encryption (for example, block device encryption). For more information, see the security overview.
Encryption in transit	Google automatically manages and enforces TLS encryption.	You must configure TLS 1.3 for client-server connections and mutual TLS (mTLS) for server-server connections. For more information, see VM deployment encryption or Kubernetes deployment encryption.
Authentication	You authenticate using Identity and Access Management (IAM) configurations (service accounts, users, and groups). For more information, see IAM.	You authenticate using passwords (OPAQUE protocol) or client certificates. For more information, see authentication.
Authorization	You authorize actions using IAM roles and permissions. For more information, see access control with IAM.	You authorize actions using an internal, IAM-like role system (for example, roles/spanner.databaseUser) that is separate from IAM. This system doesn't support custom roles. For more information, see authorization.
Network security	Spanner integrates with Google Cloud network features, such as VPC Service Controls and private endpoints.	Depends on your firewall configurations and network architecture.
Compliance	Spanner inherits Google Cloud compliance audits and certifications.	You must meet all compliance requirements in your hosting environment.

What's next

• Read the Spanner Omni overview.

• Get started with the quickstart.

• Understand Spanner Omni key terms.