Ataccama ONE Agentic ONE Desktop ONE DQ&C ONE MDM ONE RDM ONE Runtime Server
Downloads

Shared Responsibility Model

Edge instances run inside your own infrastructure: an AWS account or a Kubernetes cluster you operate. This article defines what Ataccama is responsible for and what you, as the customer, own and operate.

The model applies to all deployment options. Self-managed AWS and Kubernetes edge deployments carry additional responsibilities, as described in [Additional responsibilities for self-managed deployments] and Additional responsibilities for Kubernetes edge deployments.

Ataccama staff have no direct access to your edge environment or the resources running inside it at any point.

Ataccama responsibilities

  • Provisioning, maintaining, and operating the applications required for key edge use cases.

  • Maintaining the Ataccama control plane and the cross-account AWS services (SQS queues) used for task dispatch.

  • Publishing new edge releases, including disclosing any breaking changes or required upgrade steps.

  • Providing timely information about new versions, deprecations, and the 90-day support window.

For Ataccama-managed deployments, Ataccama also runs the automation that provisions, upgrades, and configures the edge compute in your account.

Your responsibilities

These responsibilities apply to all deployment options.

  • Selecting the region for the edge instance. On AWS, to guarantee private connectivity for data exchange with the control plane, deploy the edge in the same region as your Ataccama environment; for other regions, contact your Ataccama Customer Success Manager to discuss connectivity options. See Edge Architecture.

  • Preparing the infrastructure the edge runs on:

  • Supplying the required values from infrastructure preparation to Ataccama before the deployment is created.

  • Establishing and maintaining network connectivity between the edge instance and your data sources (such as routing, security group rules, firewall policies).

  • Applying upgrades within 90 days of release where upgrades aren’t applied automatically.

  • Providing the assistance Ataccama Support needs to investigate and resolve issues in the edge compute and connected systems, including log excerpts, edge name, cloud account ID and region, and edge version.

  • Ensuring compliance with your organization’s policies for the resources created in your cloud account or cluster.

You can layer your own security and observability tooling on top of what Ataccama provides, as long as it doesn’t interfere with core functionality.

Additional responsibilities for self-managed deployments on AWS

In self-managed deployments, you also run the deployment and lifecycle operations that Ataccama would otherwise handle.

  • Configuring a Terraform backend according to your organization’s standards before the initial apply.

  • Running the provided Terraform configuration to deploy and configure all edge AWS resources (ECS clusters, Lambda functions, SQS queues, IAM roles, KMS keys, and so on) in your account.

  • Managing IAM permissions for the principal (user or role) used to run Terraform.

  • Securing and retaining the container registry credential Ataccama delivers separately from the Terraform bundle (sent over a separate secure channel such as Bitwarden). Store it in a secrets manager or environment variable, never commit it to source control, and keep it in line with your own secrets policy.

    Terraform does not regenerate this credential; it is an installation input you provide.

  • Downloading new edge deployment packages when a new version is released and applying upgrades in sequence without skipping versions.

  • Notifying Ataccama after destroying an edge instance so the registration can be removed from the control plane.

Additional responsibilities for Kubernetes edge deployments

In Kubernetes edge deployments, you run the deployment and lifecycle operations on a Kubernetes cluster you operate:

  • Operating a cluster that meets the cluster requirements, including etcd encryption, admission control, NetworkPolicy support, and resource quotas.

  • Preparing the Azure resources and the app registration the Kubernetes edge uses, as described in Prepare Azure Resources for Kubernetes Edge.

  • Configuring egress from the cluster to your data sources, your Azure resources, and the Ataccama Edge gateway, as described in Kubernetes Edge Network Access Requirements.

  • Securing the registry credentials, the identity provider client secret, the Azure client secret, and the gateway credentials in Kubernetes Secrets you provision, and rotating them before they expire.

  • Applying chart upgrades within the 90-day support window, one version at a time.

  • Providing resilience for the edge components. The platform service level agreement (SLA) covers Ataccama-managed components only, not the edge running in your cluster.

    To keep the edge available, run multiple replicas of each component, which the chart supports. The edge compute is stateless and can be redeployed from its Helm values at any time. Results and credentials are stored in your own Azure services, so their durability depends on how you configure those services.

Joint responsibilities

Ataccama and your organization work together to keep the environment secure and operational throughout its lifecycle.

  • Ataccama ensures the control plane and deployment artifacts are correct and up to date.

  • You ensure your infrastructure and credentials are correctly configured and that upgrades are applied within the support window.

  • Issues that span both sides (for example, control plane connectivity problems) are investigated collaboratively, with each party providing relevant diagnostics from their environment.

Was this page useful?