Skip to content

SYSTEM Cited by 1 source

Eclipse Dataspace Components (EDC)

Definition

Eclipse Dataspace Components (EDC) is an open-source connector framework under the Eclipse Foundation (technology.edc) for implementing data-space architectures per the International Data Space Association (IDSA) standards. EDC enables trusted, sovereign data sharing between organizations through contract negotiation, policy enforcement, and secure data transfer protocols.

Architecture

EDC connectors are split into two primary planes:

  • Control Plane — handles contract negotiation, policy management, asset catalog, and the Dataspace Protocol (DSP) API. Relational state (Aurora on AWS), credential management (Secrets Manager), and OAuth 2.0 token vending (Cognito) are control-plane dependencies.
  • Data Plane — executes actual data transfers between participants. Connects to backend storage systems (S3 on AWS) and may require OAuth 2.0 client credentials for backend connectivity.

Both planes ship as containers, stored in a container registry (Amazon ECR), and deployed on a serverless container orchestration substrate (ECS + Fargate on AWS).

Production Deployment on AWS (2026-07-17)

The canonical AWS production architecture treats each connector instance as an isolated architecture cell — all resources (compute, database, secrets, storage, networking) for one connector are self-contained. Enterprises deploy separate cells per use case for failure isolation and data governance.

Key substrate components per cell: - Compute: Amazon ECS + AWS Fargate (serverless, no infrastructure management) - State: Amazon Aurora (relational control-plane data) - Secrets: AWS Secrets Manager - Identity: Amazon Cognito (OAuth 2.0 client credentials) - Storage: Amazon S3 (inbound/outbound data assets) - Networking: Amazon API Gateway + Network Load Balancer via VPC links (private connectivity in isolated VPC) - IaC: AWS CDK (single command deploys full cell)

Security: defense-in-depth via VPC isolation + security group segmentation + IAM least-privilege + encryption everywhere (at rest, in transit, in processing). API protection via SigV4.

Reliability: multi-AZ by default (cross-zone LB, Aurora multi-AZ replication, Fargate cross-AZ scheduling), ECS circuit breakers for deployment rollback, automated health checks, Aurora point-in-time recovery.

Reference implementation: Dataspace Connector on AWS.

Seen in

Last updated · 585 distilled / 1,765 read