Cloud account integration
Icebreaker runs entirely in your AWS account. This page describes what it needs from that account and how it interacts with services you already operate.
What runs where in AWS
Section titled “What runs where in AWS”Your EKS cluster
Section titled “Your EKS cluster”The data plane — Icebreaker Agent, Data Servers, query pods, Resource Manager — runs inside your EKS cluster. You provide the cluster; Icebreaker does not provision it. Requirements:
- A reasonably current EKS version.
- Karpenter installed and able to manage node provisioning.
- A system node pool large enough to run the Icebreaker Agent and Data Server control components.
- Outbound network egress to Icebreaker’s control plane endpoint (no inbound from Icebreaker required).
EC2 capacity
Section titled “EC2 capacity”Query executor pods run on EC2 instances that Karpenter provisions on demand, based on each Capacity Policy’s preferences. You choose:
- Which instance families are eligible.
- Whether to use on-demand, Reserved Instances, Savings Plans, or Spot.
- How much capacity each Capacity Policy is allowed to consume.
Unlike conventional data platforms like Snowflake and Databricks that make a profit largely as compute resellers, Icebreaker runs queries on capacity you have already committed to in your own account — Reserved Instances, Savings Plans, Private Pricing Agreements. Your negotiated cloud spend stays negotiated. Spot Instances are a first-class target for restart-tolerant workloads.
Two roles for S3:
- Source storage. Your Iceberg table data. Icebreaker reads partitions directly from your buckets.
- Results storage. Where query executor pods write Parquet result files. You provide the bucket; Icebreaker writes into it.
Both stay in your account.
IAM model
Section titled “IAM model”Two IAM principals matter:
The Icebreaker Agent’s role
Section titled “The Icebreaker Agent’s role”The Icebreaker Agent needs permission to manage Kubernetes workloads (Deployments, NodePools, namespaces, ConfigMaps) in your cluster. It does not need direct AWS API access in normal operation — Kubernetes drives Karpenter, and Karpenter drives EC2 via its own ServiceAccount.
Query pod execution role
Section titled “Query pod execution role”Query executor pods need permission to:
- Read source data from your S3 source buckets.
- Write Parquet result files to your S3 results bucket.
- Authenticate to your Iceberg catalog (see Catalog integration).
These permissions are granted via a Kubernetes ServiceAccount mapped to an IAM role (IRSA or Pod Identity). You decide what data the pods can see.
Detailed IAM policy templates will appear in Prerequisites.
Network
Section titled “Network”- Outbound from your cluster to Icebreaker: the Icebreaker Agent connects to Icebreaker’s control plane endpoint. One persistent WebSocket connection per agent.
- Inbound to your Data Servers: your SQL clients connect to Data Servers via an Ingress you configure (nginx or AWS ALB). See Networking and ingress.
- No inbound from Icebreaker to your cluster.