Configure AWS access

Create the cross-account IAM role e6data uses to read your S3 data and Glue catalog, then register its ARN in e6data.

Before you can create a catalog, you grant e6data read-only access to your data by creating a cross-account IAM role in your AWS account and registering its ARN in e6data. This is a required prerequisite for catalog creation.

Step 1 - Create an IAM role for cross-account access

In the AWS Console, go to IAM → Roles and select Create role.
Choose Custom trust policy and enter the policy below. e6data provides the exact account ID and role name to use in place of the placeholders.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<E6DATA_ACCOUNT_ID>:role/<WORKSPACE_ENGINE_ROLE>"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ],
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<EXTERNAL_ID>"
        }
      }
    }
  ]
}

Select Next, name the role (for example, e6data-cross-account-role), and select Create role.

Step 2 - Attach an S3 read-access policy

Open the role and select Add permissions → Create inline policy.
In the JSON editor, enter the following, replacing YOUR-DATA-BUCKET with your bucket name(s):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3ReadAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR-DATA-BUCKET",
        "arn:aws:s3:::YOUR-DATA-BUCKET/*"
      ]
    }
  ]
}

Select Create policy.

Step 3 - Attach a Glue access policy (if using AWS Glue)

If you will connect an AWS Glue catalog, add a second inline policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "GlueCatalogAccess",
      "Effect": "Allow",
      "Action": [
        "glue:GetDatabase",
        "glue:GetPartitions"
        "glue:GetTable",
      ],
      "Resource": [
        "arn:aws:glue:*:*:catalog",
        "arn:aws:glue:*:*:database/*",
        "arn:aws:glue:*:*:table/*"
      ]
    }
  ]
}

Step 4 - Attach KMS Decrypt Policy (only if your S3 buckets are encrypted with KMS)

Click Add permissions → Create inline policy.
Enter, replacing the key ARN with your own KMS key(s) and click Create policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "KMSDecryptAccess",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:DescribeKey",
        "kms:GenerateDataKey"
      ],
      "Resource": [
        "arn:aws:kms:REGION:YOUR-ACCOUNT-ID:key/YOUR-KMS-KEY-ID"
      ]
    }
  ]
}

Step 5 - Retrieve the role ARN

Open the role and copy its Role ARN from the Overview page. You provide this ARN to e6data in the next step.

Alternative - AWS CLI

The same role can be created from the command line:

# Create the IAM role
aws iam create-role \
  --role-name e6data-cross-account-role \
  --assume-role-policy-document file://trust-policy.json

# Attach S3 access policy
aws iam put-role-policy \
  --role-name e6data-cross-account-role \
  --policy-name S3ReadAccess \
  --policy-document file://s3-policy.json

# Attach Glue access policy (if using Glue)
aws iam put-role-policy \
  --role-name e6data-cross-account-role \
  --policy-name GlueCatalogAccess \
  --policy-document file://glue-policy.json

# Get the Role ARN
aws iam get-role --role-name e6data-cross-account-role --query 'Role.Arn' --output text

All of these steps can also be performed with a CloudFormation template. Contact e6data for the template.

Register the role in e6data

With the role created, add it to your workspace:

In the Compute Plane, go to Settings → Storage Credentials.
Select Add Cloud Resource.
Enter the IAM Role ARN from Step 4.
Select Save.

e6data can now use the cross-account role to read your S3 data and Glue catalog.