Document customer-managed executors on Sourcegraph Cloud

docs/admin/executors/index.mdx

@@ -42,7 +42,9 @@ The following steps configure a self-hosted Sourcegraph instance to accept conne
 	Sourcegraph Cloud includes Sourcegraph-managed executor infrastructure by
 	default. Cloud customers using these managed executors do not need to
 	configure executor authentication or deploy their own executor
-	infrastructure.
+	infrastructure. To run executors in your own Google Cloud or AWS account
+	instead, see
+	[customer-managed executors](/cloud#customer-managed-executors).
 </Callout>
 
 If you operate a self-hosted Sourcegraph instance, complete the steps below and then follow the [self-hosted deployment guide](/self-hosted/executors) to choose a deployment method and install executors on your infrastructure.

docs/cloud/index.mdx

@@ -118,6 +118,24 @@ For unsupported private connectivity methods, Sourcegraph offers connectivity vi
 
 - [Private Resources exposed via alternate public load balancers](/cloud/private-connectivity-public-lb)
 
+### Customer-managed executors
+
+Sourcegraph Cloud runs the [executors](/admin/executors) for [server-side Batch Changes](/batch-changes/server-side) and [precise auto-indexing](/code-navigation/auto-indexing) for you, in your instance's dedicated network. You don't need to deploy or configure executor infrastructure.
+
+If your organization needs to run executors in its own Google Cloud or AWS account instead, ask your Sourcegraph account team about customer-managed executors. The Sourcegraph Cloud team reviews each request with you before enabling it. Customer-managed executors are separate from [Private Connectivity](#private-connectivity), which connects your instance to private code hosts and other resources.
+
+Customer-managed executors use the same Terraform modules as self-hosted Sourcegraph instances. Follow the deployment guide for [Google Cloud](/self-hosted/executors/deploy-executors-terraform-gcp) or [AWS](/self-hosted/executors/deploy-executors-terraform-aws).
+
+When customer-managed executors are enabled:
+
+- Sourcegraph exposes a dedicated executor hostname for your instance behind an external load balancer. The load balancer denies all traffic by default and accepts only your executors' egress IP addresses. It routes only the executor API (`/.executors/`) on port 443 and the executor container registry on port 5000.
+- Sourcegraph emails your administrator the values to use for the `executor_sourcegraph_external_url` and `executor_sourcegraph_executor_proxy_password` Terraform variables. Use these values instead of changing your instance's advanced configuration as the deployment guides describe.
+
+Availability of customer-managed executors is a shared responsibility. Your organization:
+
+- Deploys, upgrades, and maintains the executors, keeping them [compatible with your instance's version](/self-hosted/executors#prepare-to-deploy-executors).
+- Provides Sourcegraph with the executors' static egress IP addresses, and contacts [Sourcegraph Support](mailto:support@sourcegraph.com) before those addresses change.
+
 ### Health monitoring, support, and SLAs
 
 - Our on-call engineers monitor instance performance and health.

docs/self-hosted/executors/deploy-executors-terraform-aws.mdx

@@ -3,6 +3,8 @@
 A [Terraform module](https://github.com/sourcegraph/terraform-aws-executors) is provided to
 provision machines running executors on AWS.
 
+Sourcegraph Cloud instances with [customer-managed executors](/cloud#customer-managed-executors) also use this module.
+
 See also: [Deploying on Google Cloud](/self-hosted/executors/deploy-executors-terraform-gcp)
 
 ## How it works

docs/self-hosted/executors/deploy-executors-terraform-gcp.mdx

@@ -3,6 +3,8 @@
 A [Terraform module](https://github.com/sourcegraph/terraform-google-executors) is provided to
 provision machines running executors on Google Cloud.
 
+Sourcegraph Cloud instances with [customer-managed executors](/cloud#customer-managed-executors) also use this module.
+
 See also: [Deploying on AWS](/self-hosted/executors/deploy-executors-terraform-aws)
 
 ## How it works

docs/self-hosted/executors/deploy-executors-terraform.mdx

@@ -1,7 +1,8 @@
 # Deploying Sourcegraph executors using Terraform
 
 [Terraform modules](https://learn.hashicorp.com/tutorials/terraform/module-use?in=terraform/modules) are provided to
-provision machines running executors on AWS and Google Cloud. Choose your cloud provider:
+provision machines running executors on AWS and Google Cloud, for self-hosted Sourcegraph instances and for Sourcegraph Cloud
+instances that use [customer-managed executors](/cloud#customer-managed-executors). Choose your cloud provider:
 
 -   **AWS** — [Deployment guide](/self-hosted/executors/deploy-executors-terraform-aws) · [Module source](https://github.com/sourcegraph/terraform-aws-executors)
 -   **Google Cloud** — [Deployment guide](/self-hosted/executors/deploy-executors-terraform-gcp) · [Module source](https://github.com/sourcegraph/terraform-google-executors)

docs/self-hosted/executors/index.mdx

@@ -4,6 +4,8 @@ Executors run resource-intensive or untrusted jobs for precise code navigation a
 
 For feature concepts, Sourcegraph configuration, connected instance management, and executor secrets, see [Administer executors](/admin/executors).
 
+Sourcegraph Cloud instances that use [customer-managed executors](/cloud#customer-managed-executors) deploy them with the Terraform modules for [AWS](/self-hosted/executors/deploy-executors-terraform-aws) or [Google Cloud](/self-hosted/executors/deploy-executors-terraform-gcp).
+
 ## Prepare to deploy executors
 
 Complete these prerequisites before deploying executor infrastructure: