Cross-account access to Unity Catalog

​

Step 1: Create policies to access S3 data sources in Account B

1. Sign in to the Account B AWS Console.
2. Search for IAM.
3. In the navigation pane, choose Roles.
4. Click Create role.
5. Under Select type of trusted entity, choose AWS account.
6. Click on Another AWS account to enter the Account ID.
7. Enter the account ID of Account A.
8. Click Next: Permissions.
9. Attach the below policy to the role.
10. Replace the ARN of the S3 bucket/s containing the data.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetObjectVersion"
      ],
      "Resource": [
        "arn:aws:s3:::EXAMPLE-BUCKET/*",
        "arn:aws:s3:::EXAMPLE-BUCKET"
      ],
      "Effect": "Allow"
    }
  ]
}

• Click Next: Add tags.
• Optional: You can add tags to the role. Or leave these fields blank, and click Next: Review.
• Enter a Role name that follows your organization’s naming convention.
• Click Create role.
• Copy the ARN of the newly created role.

​

Step 2: Configure access in Account A

• In Account B, copy the ARN of the role created in Step 1.
• Sign in to the Account A AWS Console.
• Create a policy and choose the JSON view.
• In the STS policy below, replace the ARN with the ARN of the role created in Account B.
• Copy & paste the edited policy into the JSON editor.
• In Account A, attach this policy to: e6data_engine_role (e6data-workspace-<workspace_name>-engine-role)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::ACCOUNT_B_ID:role/ROLENAME"
    }
  ]
}