Sharing another lakeFS tip: You can use lakeFS to read and write versioned data, without the data itself ever going through a lakeFS server! How is that magic possible? lakefs unicorn The answer is pre-signed URLs! These are short-lived, pre-authenticated URLs, supported on all object stores. When performing a GetObject from lakeFS, it will actually return a redirect to a pre-signed URL of the remote file - this way your client directly talks to the object store. is even theoretically possible to define an IAM policy such that requests to those URLs are only allowed from certain VPCs - so in essence, letting lakeFS manage data that it cannot even access at all 🤯