> ## Documentation Index > Fetch the complete documentation index at: https://docs.e6data.com/llms.txt > Use this file to discover all available pages before exploring further. # Architecture > How a Serverless e6data deployment on AWS works - managed compute in e6data's account, your data read in place via a cross-account IAM role. In a **Serverless** deployment, e6data runs and manages the compute for you. You grant e6data scoped, read-only access to your data; everything else - provisioning clusters, scaling, upgrades - is handled by the platform. AWS Serverless deployment architecture ## Where your data lives Your data stays in **your AWS account**. e6data does not copy or move it. When a query runs, the engine reads directly from your S3 buckets and resolves table metadata from your catalog (for example, AWS Glue). e6data holds **read-only** access and cannot create, update, or delete your objects. ## Cross-account access e6data's compute runs in e6data's AWS account. To read your data, it assumes a **cross-account IAM role** that you create in your own account. The role's trust policy names the e6data principal and is limited to `sts:AssumeRole` and `sts:TagSession`; its permissions grant read-only access to the specific S3 buckets - and, if you use Glue, the Glue catalog - that you choose. You stay in control of this access at all times. Narrow it to specific buckets or prefixes, and revoke it whenever you want by removing the role or editing its trust policy. ## The two planes | Plane | What it does in a Serverless deployment | | - | - | | Control Plane | The shared e6data Console where you manage your organization, workspaces, account, and billing. | | Compute Plane | The per-workspace environment (opened with **Open**) where you manage catalogs and clusters, write queries in the SQL Editor, and view run history. The compute itself is managed by e6data. | ## Request path When you run a query, e6data authenticates the caller, the cluster reads metadata from your catalog and data from your S3 buckets through the cross-account role, executes the query, and returns results. No data is persisted in the e6data account beyond what is needed to serve the query. ## See also * [Configure AWS access](/platform/deploy/aws-serverless/configure-aws-access) - create the cross-account role. * [Deployment models](/platform/deployment-models) - Serverless vs. In Your VPC. * [FAQs](/platform/deploy/aws-serverless/faqs) - what access e6data needs and why. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.