> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/catalogs/cross-account.md).

# Cross-account access

When your data and metastore live in a different cloud account from the one you're using e6data with, **cross-account access** lets a single workspace reach across accounts. This keeps you from having to maintain duplicate workspaces.

## When you need it

* Your data lake is in a different AWS account than where you've set up e6data
* Your storage account is in a different Azure tenant than where you've granted access

If your metastore and storage are in the same account as your e6data workspace setup, you don't need cross-account configuration.

## Cross-account patterns by cloud

The mechanism differs per cloud:

### AWS

Cross-account access uses **IAM role assumption**:

1. The data-owning account creates an IAM role with the appropriate read permissions
2. The role's trust policy permits assumption by e6data's identity
3. You provide the role ARN (and optionally an external ID) in the catalog configuration

See the per-metastore guides:

* [AWS Hive Metastore cross-account](/query-engine/guides/catalogs/cross-account/aws-hive-metastore.md)
* [AWS Glue cross-account](/query-engine/guides/catalogs/cross-account/aws-glue.md)

### Azure

Cross-account access uses a **separate Managed Identity** in the data-owning tenant:

1. The data-owning tenant creates a User-Assigned Managed Identity
2. The identity is granted `Storage Blob Data Reader` on the relevant storage account
3. You enable **Cross-Account Connection** in the catalog form and provide:
   * **Tenant ID** - the data-owning Azure tenant
   * **Client ID** - the Managed Identity's Client ID
   * **Storage Account Name** - the ADLS Gen2 account holding data

This pattern applies across all Azure catalog types (Hive, Unity, Fabric, Polaris, Iceberg REST).

### Cross-cloud (e.g., Unity Catalog on Databricks accessed from e6data on AWS)

For [Databricks Unity Catalog](/query-engine/guides/catalogs/cross-account/unity-catalog.md), the pattern combines a workspace access token with cross-account storage access via Azure Managed Identity or AWS IAM role.

## Costs to be aware of

Cross-account access introduces:

* **Egress/ingress charges** when data crosses an account boundary, especially across regions
* **Latency** - typically modest within the same region, more noticeable across regions

Best practice: keep e6data, your metastore, and your storage in the same region whenever possible, even if they're in different accounts.

## Known limitation

There's a known issue where running a query against a cross-account catalog can prevent subsequent queries against same-account catalogs in the same workspace until the workspace is toggled. Workarounds:

* Disable and re-enable the workspace to clear the state
* Maintain separate workspaces for cross-account catalogs and same-account catalogs

This will be resolved in a future release.

## See also

* [Catalog overview](/query-engine/guides/catalogs.md)
* [Create a catalog](/query-engine/guides/catalogs/register-and-manage-catalogs.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/catalogs/cross-account.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.