> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure AWS access

> Create the cross-account IAM role e6data uses to read your S3 data and Glue catalog, then register its ARN in e6data.

Before you can create a catalog, you grant e6data read-only access to your data by creating a **cross-account IAM role** in your AWS account and registering its ARN in e6data. This is a required prerequisite for catalog creation.

## Step 1 - Create an IAM role for cross-account access

1. In the **AWS Console**, go to **IAM → Roles** and select **Create role**.
2. Choose **Custom trust policy** and enter the policy below. e6data provides the exact account ID and role name to use in place of the placeholders.

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<E6DATA_ACCOUNT_ID>:role/<WORKSPACE_ENGINE_ROLE>"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ],
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<EXTERNAL_ID>"
        }
      }
    }
  ]
}
```

3. Select **Next**, name the role (for example, `e6data-cross-account-role`), and select **Create role**.

## Step 2 - Attach an S3 read-access policy

1. Open the role and select **Add permissions → Create inline policy**.
2. In the JSON editor, enter the following, replacing `YOUR-DATA-BUCKET` with your bucket name(s):

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3ReadAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR-DATA-BUCKET",
        "arn:aws:s3:::YOUR-DATA-BUCKET/*"
      ]
    }
  ]
}
```

3. Select **Create policy**.

## Step 3 - Attach a Glue access policy (if using AWS Glue)

If you will connect an AWS Glue catalog, add a second inline policy:

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "GlueCatalogAccess",
      "Effect": "Allow",
      "Action": [
        "glue:GetDatabase",
        "glue:GetPartitions",
        "glue:GetTable"
      ],
      "Resource": [
        "arn:aws:glue:*:*:catalog",
        "arn:aws:glue:*:*:database/*",
        "arn:aws:glue:*:*:table/*"
      ]
    }
  ]
}
```

## Step 4 - Attach KMS Decrypt Policy (only if your S3 buckets are encrypted with KMS)

1. Click Add permissions → Create inline policy.
2. Enter, replacing the key ARN with your own KMS key(s) and click Create policy.

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "KMSDecryptAccess",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:DescribeKey",
        "kms:GenerateDataKey"
      ],
      "Resource": [
        "arn:aws:kms:REGION:YOUR-ACCOUNT-ID:key/YOUR-KMS-KEY-ID"
      ]
    }
  ]
}
```

## Step 5 - Retrieve the role ARN

Open the role and copy its **Role ARN** from the **Overview** page. You register this ARN in e6data in [Register the role in e6data](#register-the-role-in-e6data) below.

## Alternative - AWS CLI

The same role can be created from the command line:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
# Create the IAM role
aws iam create-role \
  --role-name e6data-cross-account-role \
  --assume-role-policy-document file://trust-policy.json

# Attach S3 access policy
aws iam put-role-policy \
  --role-name e6data-cross-account-role \
  --policy-name S3ReadAccess \
  --policy-document file://s3-policy.json

# Attach Glue access policy (if using Glue)
aws iam put-role-policy \
  --role-name e6data-cross-account-role \
  --policy-name GlueCatalogAccess \
  --policy-document file://glue-policy.json

# Get the Role ARN
aws iam get-role --role-name e6data-cross-account-role --query 'Role.Arn' --output text
```

<Info>
  All of these steps can also be performed with a CloudFormation template. Contact e6data for the template.
</Info>

## Register the role in e6data

With the role created, add it to your workspace:

1. In the Compute Plane, go to **Settings → Storage Credentials**.
2. Select **Add Cloud Resource**.
3. Enter the **IAM Role ARN** from Step 5.
4. Select **Save**.

e6data can now use the cross-account role to read your S3 data and Glue catalog.

## See also

* [Connect S3 and Glue](/platform/deploy/aws-serverless/connect-s3-and-glue) - create a catalog that uses this role.
* [Troubleshooting](/platform/deploy/aws-serverless/troubleshooting) - cross-account access errors.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.