> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/deployment/aws-serverless/architecture.md).

# Architecture

How a Serverless e6data deployment on AWS works - managed compute in e6data's account, your data read in place via a cross-account IAM role.

In a **Serverless** deployment, e6data runs and manages the compute for you. You grant e6data scoped, read-only access to your data; everything else - provisioning clusters, scaling, upgrades - is handled by the platform.

![AWS Serverless deployment architecture](https://256648299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fz2BYVXehgdnk8dbeZoW5%2Fuploads%2Fgit-blob-8d8d1c999cb5ce615b6b6c5626f49a2efe922ab8%2FAWS%20Serverless%20PLT-V2.png?alt=media)

## Where your data lives

Your data stays in **your AWS account**. e6data does not copy or move it. When a query runs, the engine reads directly from your S3 buckets and resolves table metadata from your catalog (for example, AWS Glue). e6data holds **read-only** access and cannot create, update, or delete your objects.

## Cross-account access

e6data's compute runs in e6data's AWS account. To read your data, it assumes a **cross-account IAM role** that you create in your own account. The role's trust policy names the e6data principal and is limited to `sts:AssumeRole` and `sts:TagSession`; its permissions grant read-only access to the specific S3 buckets - and, if you use Glue, the Glue catalog - that you choose.

You stay in control of this access at all times. Narrow it to specific buckets or prefixes, and revoke it whenever you want by removing the role or editing its trust policy.

## The two planes

| Plane         | What it does in a Serverless deployment                                                                                                                                                      |
| ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Control Plane | The shared e6data Console where you manage your organization, workspaces, account, and billing.                                                                                              |
| Compute Plane | The per-workspace environment (opened with **Open**) where you manage catalogs and clusters, write queries in the SQL Editor, and view run history. The compute itself is managed by e6data. |

## Request path

When you run a query, e6data authenticates the caller, the cluster reads metadata from your catalog and data from your S3 buckets through the cross-account role, executes the query, and returns results. No data is persisted in the e6data account beyond what is needed to serve the query.

## See also

* [Configure AWS access](/query-engine/guides/deployment/aws-serverless/configure-aws-access.md) - create the cross-account role.
* [Deployment models](/query-engine/get-started/deployment-models.md) - Serverless vs. In Your VPC.
* [FAQs](/query-engine/guides/deployment/aws-serverless/faqs.md) - what access e6data needs and why.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/deployment/aws-serverless/architecture.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.