> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/deployment/aws-serverless/configure-aws-access.md).

# Configure AWS access

Create the cross-account IAM role e6data uses to read your S3 data and Glue catalog, then register its ARN in e6data.

Before you can create a catalog, you grant e6data read-only access to your data by creating a **cross-account IAM role** in your AWS account and registering its ARN in e6data. This is a required prerequisite for catalog creation.

## Step 1 - Create an IAM role for cross-account access

1. In the **AWS Console**, go to **IAM → Roles** and select **Create role**.
2. Choose **Custom trust policy** and enter the policy below. e6data provides the exact account ID and role name to use in place of the placeholders.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<E6DATA_ACCOUNT_ID>:role/<WORKSPACE_ENGINE_ROLE>"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ],
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<EXTERNAL_ID>"
        }
      }
    }
  ]
}
```

3. Select **Next**, name the role (for example, `e6data-cross-account-role`), and select **Create role**.

## Step 2 - Attach an S3 read-access policy

1. Open the role and select **Add permissions → Create inline policy**.
2. In the JSON editor, enter the following, replacing `YOUR-DATA-BUCKET` with your bucket name(s):

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3ReadAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR-DATA-BUCKET",
        "arn:aws:s3:::YOUR-DATA-BUCKET/*"
      ]
    }
  ]
}
```

3. Select **Create policy**.

## Step 3 - Attach a Glue access policy (if using AWS Glue)

If you will connect an AWS Glue catalog, add a second inline policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "GlueCatalogAccess",
      "Effect": "Allow",
      "Action": [
        "glue:GetDatabase",
        "glue:GetPartitions"
        "glue:GetTable",
      ],
      "Resource": [
        "arn:aws:glue:*:*:catalog",
        "arn:aws:glue:*:*:database/*",
        "arn:aws:glue:*:*:table/*"
      ]
    }
  ]
}
```

## Step 4 - Attach KMS Decrypt Policy (only if your S3 buckets are encrypted with KMS)

1. Click Add permissions → Create inline policy.
2. Enter, replacing the key ARN with your own KMS key(s) and click Create policy.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "KMSDecryptAccess",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:DescribeKey",
        "kms:GenerateDataKey"
      ],
      "Resource": [
        "arn:aws:kms:REGION:YOUR-ACCOUNT-ID:key/YOUR-KMS-KEY-ID"
      ]
    }
  ]
}
```

## Step 5 - Retrieve the role ARN

Open the role and copy its **Role ARN** from the **Overview** page. You provide this ARN to e6data in the next step.

## Alternative - AWS CLI

The same role can be created from the command line:

```bash
# Create the IAM role
aws iam create-role \
  --role-name e6data-cross-account-role \
  --assume-role-policy-document file://trust-policy.json

# Attach S3 access policy
aws iam put-role-policy \
  --role-name e6data-cross-account-role \
  --policy-name S3ReadAccess \
  --policy-document file://s3-policy.json

# Attach Glue access policy (if using Glue)
aws iam put-role-policy \
  --role-name e6data-cross-account-role \
  --policy-name GlueCatalogAccess \
  --policy-document file://glue-policy.json

# Get the Role ARN
aws iam get-role --role-name e6data-cross-account-role --query 'Role.Arn' --output text
```

{% hint style="info" %}
All of these steps can also be performed with a CloudFormation template. Contact e6data for the template.
{% endhint %}

## Register the role in e6data

With the role created, add it to your workspace:

1. In the Compute Plane, go to **Settings → Storage Credentials**.
2. Select **Add Cloud Resource**.
3. Enter the **IAM Role ARN** from Step 4.
4. Select **Save**.

e6data can now use the cross-account role to read your S3 data and Glue catalog.

## See also

* [Connect S3 and Glue](/query-engine/guides/deployment/aws-serverless/connect-s3-and-glue.md) - create a catalog that uses this role.
* [Troubleshooting](/query-engine/guides/deployment/aws-serverless/troubleshooting.md) - cross-account access errors.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/deployment/aws-serverless/configure-aws-access.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.