Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Connecting to the Data Catalog using AWS Glue Iceberg REST endpoint

AWS Glue's Iceberg REST endpoint supports API operations specified in the Apache Iceberg REST specification. Using an Iceberg REST client, you can connect your application running on an analytics engine to the REST catalog hosted in the Data Catalog.

The endpoint supports both Apache Iceberg table specifications - v1 and v2, defaulting to v2. When using the Iceberg table v1 specification, you must specify v1 in the API call. Using the API operation, you can access Iceberg tables stored in both Amazon S3 object storage and Amazon S3 Table storage.

Endpoint configuration

You can access the AWS Glue Iceberg REST catalog using the service endpoint. Refer to the AWS Glue service endpoints reference guide for the region-specific endpoint. For example, when connecting to AWS Glue in the us-east-1 Region, you need to configure the endpoint URI property as follows:

Endpoint : https://glue.eusc-de-east-1.amazonaws.com/iceberg

Additional configuration properties – When using Iceberg client to connect an analytics engine like Spark to the service endpoint, you are required to specify the following application configuration properties:

catalog_name = "mydatacatalog"
aws_account_id = "123456789012"
aws_region = "us-east-1"
spark = SparkSession.builder \
    ... \
    .config("spark.sql.defaultCatalog", catalog_name) \
    .config(f"spark.sql.catalog.{catalog_name}", "org.apache.iceberg.spark.SparkCatalog") \
    .config(f"spark.sql.catalog.{catalog_name}.type", "rest") \
    .config(f"spark.sql.catalog.{catalog_name}.uri", "https://glue.{aws_region}.amazonaws.com/iceberg") \
    .config(f"spark.sql.catalog.{catalog_name}.warehouse", "{aws_account_id}") \
    .config(f"spark.sql.catalog.{catalog_name}.rest.sigv4-enabled", "true") \
    .config(f"spark.sql.catalog.{catalog_name}.rest.signing-name", "glue") \    
    .config("spark.sql.extensions","org.apache.iceberg.spark.extensions.IcebergSparkSessionExtensions") \
    .getOrCreate()
     

AWS Glue Iceberg endpoint https://glue.eusc-de-east-1.amazonaws.com/iceberg supports supports the following Iceberg REST APIs:

Authentication

The AWS Glue Iceberg REST endpoint supports two authentication methods. Choose the method that matches how your analytics engine or integration connects to the catalog.

Authenticating with OAuth 2.0 bearer tokens

External clients obtain a short-lived OAuth access token from AWS Sign-In and present it to the AWS Glue Iceberg REST endpoint. AWS Glue validates the token and enforces AWS Lake Formation permissions on every request. For the LoadTable operation, the Amazon S3 credentials that AWS Glue vends are bounded by the assumed IAM role and the Lake Formation grants on that role.

This integration uses the OAuth 2.0 Token Exchange Grant (RFC 8693). An integration partner presents an end user's JSON Web Token (JWT) to AWS Sign-In and exchanges it for a short-lived OAuth access token scoped to the AWS Glue service. The partner then presents that token to the AWS Glue Iceberg REST endpoint to read your tables.

For the complete setup and token exchange details, see Configure OAuth access to AWS Glue Iceberg REST Catalog in the AWS Sign-In User Guide.

Prefix and catalog path parameters

Iceberg REST catalog APIs have a free-form prefix in their request URLs. For example, the ListNamespaces API call uses the GET/v1/{prefix}/namespaces URL format. AWS Glue prefix always follows the /catalogs/{catalog} structure to ensure that the REST path aligns the AWS Glue multi-catalog hierarchy. The {catalog} path parameter can be derived based on the following rules:

This catalog ID to prefix mapping is required only when you directly call the REST APIs. When you are working with the AWS Glue Iceberg REST catalog APIs through an engine, you need to specify the AWS Glue catalog ID in the warehouse parameter for your Iceberg REST catalog API setting or in the glue.id parameter for your AWS Glue extensions API setting. For example, see how you can use it with EMR Spark in Use an Iceberg cluster with Spark.

Namespace path parameter

Namespaces in Iceberg REST catalog APIs path can have multiple levels. However, AWS Glue only supports single-level namespaces. To access a namespace in a multi-level catalog hierarchy, you can connect to a multi-level catalog above the namespace to reference the namespace. This allows any query engine that supports the 3-part notation of catalog.namespace.table to access objects in AWS Glue’s multi-level catalog hierarchy without compatibility issues compared to using the multi-level namespace.