Skip to main content

​
When you need it

  • Your data lake is in a different AWS account than where you’ve set up e6data
  • Your storage account is in a different Azure tenant than where you’ve granted access
If your metastore and storage are in the same account as your e6data workspace setup, you don’t need cross-account configuration.

​
Cross-account patterns by cloud

The mechanism differs per cloud:

​
AWS

Cross-account access uses IAM role assumption:
  1. The data-owning account creates an IAM role with the appropriate read permissions
  2. The role’s trust policy permits assumption by e6data’s identity
  3. You provide the role ARN (and optionally an external ID) in the catalog configuration
See the per-metastore guides:

​
Azure

Cross-account access uses a separate Managed Identity in the data-owning tenant:
  1. The data-owning tenant creates a User-Assigned Managed Identity
  2. The identity is granted Storage Blob Data Reader on the relevant storage account
  3. You enable Cross-Account Connection in the catalog form and provide:
    • Tenant ID - the data-owning Azure tenant
    • Client ID - the Managed Identity’s Client ID
    • Storage Account Name - the ADLS Gen2 account holding data
This pattern applies across all Azure catalog types (Hive, Unity, Fabric, Polaris, Iceberg REST).

​
Cross-cloud (e.g., Unity Catalog on Databricks accessed from e6data on AWS)

For Databricks Unity Catalog, the pattern combines a workspace access token with cross-account storage access via Azure Managed Identity or AWS IAM role.

​
Costs to be aware of

Cross-account access introduces:
  • Egress/ingress charges when data crosses an account boundary, especially across regions
  • Latency - typically modest within the same region, more noticeable across regions
Best practice: keep e6data, your metastore, and your storage in the same region whenever possible, even if they’re in different accounts.

​
Known limitation

There’s a known issue where running a query against a cross-account catalog can prevent subsequent queries against same-account catalogs in the same workspace until the workspace is toggled. Workarounds:
  • Disable and re-enable the workspace to clear the state
  • Maintain separate workspaces for cross-account catalogs and same-account catalogs
This will be resolved in a future release.

​
See also

Last modified on October 1, 2026