> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cross-account access to a Hive Metastore (AWS)

> Connect an e6data workspace to a Hive Metastore and S3 data in a different AWS account.

To connect your e6data Workspace to a Hive Metastore and S3 data source in a different cloud account, please follow the steps below:

<Info>
  This guide assumes:

  * the e6data Workspace (clusters/compute) is installed in a cloud account named **Account A.**
  * the Hive Metastore & S3 data stores are located in a different cloud account named **Account B.**
  * Both **Account A** & **Account B** are in the same AWS region.
</Info>

### Step 1: Create policies to access Hive & S3 data sources in **Account B**

1. Sign in to the **Account B** AWS Console.
2. Search for **IAM.**
3. In the navigation pane, choose **Roles**.
4. Click **Create role**.
5. Under **Select type of trusted entity**, choose **AWS account**.
6. Click on **Another AWS account** to enter the **Account ID**.
7. Enter the account ID of **Account A**.
8. Click **Next: Permissions**.
9. Attach the below policy to the role.
10. Replace the ARN of the S3 bucket/s containing the data.

**S3 & Hive Policy**

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetObjectVersion"
      ],
      "Resource": [
        "arn:aws:s3:::EXAMPLE-BUCKET/*",
        "arn:aws:s3:::EXAMPLE-BUCKET"
      ],
      "Effect": "Allow"
    }
  ]
}
```

* Click **Next: Add tags**.

* Optional: You can add tags to the role. Or leave these fields blank, and click **Next: Review**.

* Enter a **Role name** that follows your organization's naming convention.

* Click **Create role**.

* Copy the ARN of the newly created role.

### Step 2: Configure access in **Account A**

* In **Account B**, copy the ARN of the role created in Step 1.
* Sign in to the **Account A** AWS Console.
* Create a policy and choose the **JSON** view.
* In the STS policy below, replace the ARN with the ARN of the role created in **Account B**.
* Copy & paste the edited policy into the JSON editor.
* In **Account A**, attach this policy to:

  e6data\_engine\_role (e6data-workspace-\<workspace\_name>-engine-role)

**STS Policy**

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::ACCOUNT_B_ID:role/ROLENAME"
    }
  ]
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.