AWS and Salesforce Expand Strategic Partnership with Zero Copy Data Integration for Apache Iceberg on Amazon S3
The era of costly and complex data migration is facing a significant shift as Salesforce and Amazon Web Services (AWS) announce the general availability of Zero Copy access to Apache Iceberg tables. This technical integration allows organizations to query and analyze massive datasets stored in Amazon Simple Storage Service (Amazon S3) directly from Salesforce Data 360 without the need for traditional Extract, Transform, Load (ETL) processes. By leveraging the Iceberg REST endpoint from the AWS Glue Data Catalog and managing access through AWS Lake Formation, the collaboration provides a seamless bridge between enterprise data lakes and customer relationship management (CRM) environments. This move marks a pivotal moment in the "Zero Copy" movement, aimed at preserving data governance, ensuring real-time freshness, and maintaining business semantics across disparate cloud platforms.
The Evolution of the Salesforce-AWS Alliance
The latest integration is part of a multi-year strategic expansion between the two technology giants. Historically, companies were forced to choose between maintaining siloed data or investing heavily in data pipelines to move information from AWS-based data lakes into the Salesforce ecosystem for actionable insights. This replication often resulted in "stale" data, where the information used by sales and service teams was hours or even days behind the actual state of the business.
In late 2023 and throughout 2024, Salesforce and AWS signaled a deeper commitment to interoperability. The goal was to treat data residing in Amazon S3 as if it were native to the Salesforce platform. By focusing on Apache Iceberg—a high-performance, open table format—the two companies are embracing industry standards that prevent vendor lock-in while providing the performance levels required for modern AI and analytics applications.
Understanding the Technical Core: Apache Iceberg and Amazon S3
At the heart of this integration is Apache Iceberg, an open-source project managed by the Apache Software Foundation. Originally developed at Netflix to handle petabyte-scale datasets, Iceberg has become the de facto standard for managing large analytic tables. Unlike traditional file formats, Iceberg brings the reliability and simplicity of SQL tables to the big data world. It supports features like ACID (Atomicity, Consistency, Isolation, Durability) transactions, partition evolution, and "time travel," which allows users to query previous versions of a dataset.
Amazon S3 serves as the foundational storage layer for this architecture. Recognized for its 99.999999999% (11 nines) of durability, S3 provides the scalability required for modern data lakes. When combined with Apache Iceberg, S3 becomes a high-performance environment where data engineers can manage records of how datasets change over time. The integration with AWS Glue Data Catalog further enhances this by providing a centralized metadata repository, allowing different engines—such as Amazon Athena, Apache Spark, and now Salesforce Data 360—to interact with the same data consistently.
The Mechanics of Zero Copy File Federation
Zero Copy file federation, often referred to as catalog federation, represents a departure from traditional data sharing. In a standard setup, data must be copied from a source (S3) to a destination (Salesforce). In a Zero Copy architecture, the Salesforce Data 360 engine communicates directly with the AWS Glue Data Catalog to discover the location and schema of the Iceberg tables.
When a query is initiated from Salesforce, the system uses the Iceberg REST endpoint to fetch the latest table metadata. This metadata includes the specific S3 location of the data files, the current schema, and partition information. Salesforce then accesses the data files directly from S3. Crucially, AWS Lake Formation manages this access by providing scoped, temporary credentials. This ensures that Salesforce only sees the specific rows and columns it is authorized to access, maintaining a strict security posture without the overhead of duplicating the security logic in both platforms.
Implementation Roadmap: Setting Up the Integration
For organizations looking to deploy this solution, the process involves a coordinated configuration between the AWS and Salesforce environments.
AWS Environment Configuration
The journey begins within the AWS Management Console. A data lake administrator must first ensure that the target data is stored in an Amazon S3 bucket and formatted as an Apache Iceberg table. This is typically achieved using Amazon Athena, which allows for the creation of Iceberg tables using standard SQL commands.
Once the table is created, the administrator must register the S3 bucket with AWS Lake Formation. This step is critical because it transitions the data from simple file-level permissions to a more granular, table-level access control model. To facilitate the "Zero Copy" aspect, the administrator must enable "third-party engine integration" within Lake Formation settings. This allows external platforms like Salesforce to request data access through the Lake Formation security layer. Finally, an Identity and Access Management (IAM) user or role must be created to provide the necessary handshake between the two clouds.
Salesforce Data 360 Configuration
On the Salesforce side, the integration is managed within the Data 360 interface. Data 360 acts as the real-time data engine for the entire Salesforce platform. To establish the link, a "Data Cloud Connection" is created using the AWS credentials and the Glue Data Catalog ARN (Amazon Resource Name).
After the connection is established, administrators create a "Data Stream." During this phase, Salesforce identifies the available Iceberg tables in the AWS Glue Data Catalog. The system then maps the external Iceberg schema to the Salesforce Data Model. Because this is a Zero Copy federation, the data is not ingested into Salesforce storage; instead, the platform creates a virtual link to the S3 data, ensuring that every time a user or an AI agent accesses a record, they are seeing the most current version available on AWS.
Empowering AI with Agentforce and Real-Time Context
One of the most significant implications of this integration is its impact on artificial intelligence. Salesforce recently introduced Agentforce, a suite of autonomous AI agents designed to handle complex business tasks. For these agents to be effective, they require "trusted context"—a complete and current view of the customer.
In the past, an AI agent might suggest a product to a customer based on data that was 24 hours old, potentially missing a recent return or a support ticket logged in an external system. With Zero Copy federation to Amazon S3, Agentforce can pull real-time telemetry, log data, or historical purchase information directly from the AWS data lake. This ensures that the AI’s logic is grounded in the "ground truth" of the business, leading to more reliable and accurate autonomous actions.
Economic and Operational Advantages
The move toward Zero Copy architecture is driven as much by economics as it is by technology. Moving large volumes of data across cloud environments incurs significant costs, including data egress fees from cloud providers and increased storage costs for the duplicate data. By leaving the data in S3, organizations can significantly reduce their cloud spend.
Operationally, this integration simplifies the data engineering lifecycle. It removes the need for building and maintaining complex ETL pipelines, which are often the most fragile part of a data architecture. When the schema of a table changes in AWS, the Iceberg format handles the evolution, and the Zero Copy federation ensures that Salesforce reflects those changes without manual intervention. This agility allows businesses to respond faster to market changes and internal data requirements.
Security, Governance, and Compliance
In an era of increasing data privacy regulations, such as GDPR and CCPA, the ability to govern data in a single location is invaluable. With Zero Copy federation, the "source of truth" remains within the AWS environment, protected by AWS’s robust security frameworks.
AWS Lake Formation provides centralized control over who can see what data. Administrators can define column-level security and row-level filtering. For example, a salesperson in Salesforce might be granted access to a customer’s purchase history in the S3 data lake, but sensitive information like credit card numbers or internal health markers can be masked or hidden entirely at the Lake Formation level. This centralized governance model reduces the risk of data leaks and ensures that compliance audits are easier to conduct, as there is only one primary repository of sensitive information to monitor.
Strategic Market Impact and Future Outlook
The collaboration between Salesforce and AWS is a clear response to the growing dominance of "data cloud" competitors like Snowflake and Databricks, both of which have been aggressively expanding their own Zero Copy and open-table-format capabilities. By aligning on Apache Iceberg, AWS and Salesforce are signaling their support for an open ecosystem where the customer maintains control over their data.
Market analysts suggest that this integration will be particularly beneficial for industries with massive data footprints, such as manufacturing, healthcare, and telecommunications. In these sectors, the cost of moving data is often prohibitive. By enabling Zero Copy access, Salesforce and AWS are lowering the barrier to entry for advanced analytics and AI-driven customer experiences.
As the partnership evolves, industry experts expect further refinements in performance, particularly for complex join operations between Salesforce native data and federated S3 data. For now, the integration of Apache Iceberg via Zero Copy file federation stands as a robust solution for enterprises looking to unify their data strategy, empower their AI initiatives, and reduce the operational friction of the multi-cloud era.
