You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "jlambatl (via GitHub)" <gi...@apache.org> on 2026/05/01 23:12:11 UTC
[I] feat(glue): Support AWS STS AssumeRole for Glue catalog authentication [iceberg-rust]
jlambatl opened a new issue, #2394:
URL: https://github.com/apache/iceberg-rust/issues/2394
### Is your feature request related to a problem or challenge?
Users operating in multi-account AWS environments, or following AWS security best practices, need to access the AWS Glue Data Catalog using temporary IAM credentials obtained via STS AssumeRole rather than long-term static access keys. Currently the Glue catalog only supports static credentials (aws_access_key_id / aws_secret_access_key), named profiles, and the default credential chain — none of which cover the AssumeRole flow directly. This makes it impossible to support common patterns such as cross-account Glue catalog access or workloads where an application assumes a scoped-down IAM role to interact with Glue.
### Describe the solution you'd like
Add three new configuration properties to the Glue catalog, mirroring the naming convention already used by the S3 storage layer.
| Property | Description |
|---------|---------|
| client.assume-role.arn | ARN of the IAM role to assume |
| client.assume-role.external-id | (Optional) External ID for cross-account role assumption |
| client.assume-role.session-name | (Optional) STS session name (default: iceberg-glue-catalog) |
When client.assume-role.arn is set, the catalog should use the existing base credentials (static keys, profile, or default chain) to call AWS STS AssumeRole, then use the resulting temporary credentials for all Glue API calls. These temporary credentials should also be propagated to the S3 FileIO layer so that both metadata reads/writes and Glue API calls operate under the same assumed role.
### Willingness to contribute
None
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] feat(glue): Support AWS STS AssumeRole for Glue catalog authentication [iceberg-rust]
Posted by "jlambatl (via GitHub)" <gi...@apache.org>.
jlambatl commented on issue #2394:
URL: https://github.com/apache/iceberg-rust/issues/2394#issuecomment-6486012684
This issue is still a real problem, the PR is still pending review, I have been making sure it stays updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] feat(glue): Support AWS STS AssumeRole for Glue catalog authentication [iceberg-rust]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #2394:
URL: https://github.com/apache/iceberg-rust/issues/2394#issuecomment-6484239287
This issue has been automatically marked as stale because it has been open for 180 days with no activity. It will be closed in next 14 days if no further activity occurs. To permanently prevent this issue from being considered stale, add the label 'not-stale', but commenting on the issue is preferred when possible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org