Cross-account access

When your data and metastore live in a different cloud account from the one you're using e6data with, cross-account access lets a single workspace reach across accounts. This keeps you from having to maintain duplicate workspaces.

When you need it

• Your data lake is in a different AWS account than where you've set up e6data
• Your storage account is in a different Azure tenant than where you've granted access

If your metastore and storage are in the same account as your e6data workspace setup, you don't need cross-account configuration.

Cross-account patterns by cloud

The mechanism differs per cloud:

AWS

Cross-account access uses IAM role assumption:

1. The data-owning account creates an IAM role with the appropriate read permissions
2. The role's trust policy permits assumption by e6data's identity
3. You provide the role ARN (and optionally an external ID) in the catalog configuration

See the per-metastore guides:

• AWS Hive Metastore cross-account
• AWS Glue cross-account

Azure

Cross-account access uses a separate Managed Identity in the data-owning tenant:

1. The data-owning tenant creates a User-Assigned Managed Identity
2. The identity is granted Storage Blob Data Reader on the relevant storage account
3. You enable Cross-Account Connection in the catalog form and provide:

   • Tenant ID - the data-owning Azure tenant
   • Client ID - the Managed Identity's Client ID
   • Storage Account Name - the ADLS Gen2 account holding data

This pattern applies across all Azure catalog types (Hive, Unity, Fabric, Polaris, Iceberg REST).

Cross-cloud (e.g., Unity Catalog on Databricks accessed from e6data on AWS)

For Databricks Unity Catalog, the pattern combines a workspace access token with cross-account storage access via Azure Managed Identity or AWS IAM role.

Costs to be aware of

Cross-account access introduces:

• Egress/ingress charges when data crosses an account boundary, especially across regions
• Latency - typically modest within the same region, more noticeable across regions

Best practice: keep e6data, your metastore, and your storage in the same region whenever possible, even if they're in different accounts.

Known limitation

There's a known issue where running a query against a cross-account catalog can prevent subsequent queries against same-account catalogs in the same workspace until the workspace is toggled. Workarounds:

• Disable and re-enable the workspace to clear the state
• Maintain separate workspaces for cross-account catalogs and same-account catalogs

This will be resolved in a future release.

See also

• Catalog overview
• Create a catalog