How a Serverless e6data deployment on AWS works - managed compute in e6data’s account, your data read in place via a cross-account IAM role.
In a Serverless deployment, e6data runs and manages the compute for you. You grant e6data scoped, read-only access to your data; everything else - provisioning clusters, scaling, upgrades - is handled by the platform.
Your data stays in your AWS account. e6data does not copy or move it. When a query runs, the engine reads directly from your S3 buckets and resolves table metadata from your catalog (for example, AWS Glue). e6data holds read-only access and cannot create, update, or delete your objects.
e6data’s compute runs in e6data’s AWS account. To read your data, it assumes a cross-account IAM role that you create in your own account. The role’s trust policy names the e6data principal and is limited to sts:AssumeRole and sts:TagSession; its permissions grant read-only access to the specific S3 buckets - and, if you use Glue, the Glue catalog - that you choose.You stay in control of this access at all times. Narrow it to specific buckets or prefixes, and revoke it whenever you want by removing the role or editing its trust policy.
The shared e6data Console where you manage your organization, workspaces, account, and billing.
Compute Plane
The per-workspace environment (opened with Open) where you manage catalogs and clusters, write queries in the SQL Editor, and view run history. The compute itself is managed by e6data.
When you run a query, e6data authenticates the caller, the cluster reads metadata from your catalog and data from your S3 buckets through the cross-account role, executes the query, and returns results. No data is persisted in the e6data account beyond what is needed to serve the query.
