AWS Glue Data Catalog now supports catalog-vended credentials with Apache Iceberg REST catalog federation

AWS Glue Data Catalog Enhancements

AWS Glue Data Catalog now supports external catalog's vended credentials in Apache Iceberg REST catalog federation. You can now read external Iceberg tables from Amazon Athena, Amazon EMR, Amazon Redshift, and AWS Glue using coarse-grained table grants in your external Iceberg catalog.

Glue Data Catalog already federates to external Iceberg REST catalogs through an AWS IAM role that you configure with access to your Amazon S3 buckets. This enhancement provides another way to connect to an external Iceberg catalog and read only the tables that the external catalog authorizes. It uses temporary security credentials that are scoped to the Amazon S3 storage prefix and vended by your external Iceberg catalog. AWS Lake Formation manages access control when you query an external table using any AWS analytics engine, allowing you to restrict access further down to specific rows and columns and share external Iceberg tables across AWS accounts.

What to do

• Use the AWS Lake Formation Management Console, AWS CLI, and the AWS Glue and Lake Formation SDKs to manage access control.
• Configure an AWS IAM role with access to your Amazon S3 buckets for external Iceberg REST catalog federation.
• Use temporary security credentials scoped to the Amazon S3 storage prefix for enhanced security.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.