Apache Iceberg

The Apache Iceberg connector exposes Iceberg tables as datasets. Pick one of two catalog types in the connection form:

AWS Glue catalog — tables are registered in an AWS Glue Data Catalog. Summation browses Glue namespaces and tables, then reads each selected table from its S3 storage through Spice.
S3 warehouse — tables live directly under an S3 prefix with no catalog service, laid out as <warehouse>/<namespace>/<table>/metadata/*.metadata.json. Summation lists the warehouse to find namespaces and tables, and Spice resolves the newest metadata file on every load.

Other Iceberg REST catalog providers are not available in the connection form.

What you’ll need

For a Glue catalog: the 12-digit AWS account ID that owns the Glue Data Catalog.
For an S3 warehouse: the warehouse path (s3://my-bucket/iceberg-warehouse, or s3://my-bucket when the namespace folders sit at the bucket root), pointing one level above the namespace folders.
The AWS region containing the catalog or warehouse and its S3 data.
AWS credentials with read access to the catalog (or warehouse prefix) and the S3 locations backing its Iceberg tables.
An optional session token when using temporary AWS credentials.

Use a dedicated read-only IAM principal and scope its S3 permissions to the prefixes containing the tables Summation should read.

Form fields

Field	Required	Stored as	Notes
Catalog	Yes	Config	`AWS Glue catalog` or `S3 warehouse`. Existing connectors remain Glue.
AWS Account ID	Glue only	Config	The 12-digit account ID for the Glue Data Catalog.
Warehouse Path	S3 warehouse only	Config	For example `s3://my-bucket/iceberg-warehouse`, or `s3://my-bucket` when namespaces sit at the bucket root. `s3://` and `s3a://` are both accepted and stored as `s3a://`.
AWS Region	Yes	Config	Region containing the catalog or warehouse, for example `us-west-2`.
Access Key ID	Yes	Secret	AWS access key ID. Both long-lived `AKIA` and temporary `ASIA` keys are supported.
Secret Access Key	Yes	Secret	Secret access key matching the access key ID.
Session Token	Required for temporary credentials	Secret	AWS session token associated with an `ASIA` access key.

IAM policy

The credentials need permission to browse the catalog and read the S3 objects referenced by the selected Iceberg tables. Replace the account, bucket, and prefix values with your own. An S3 warehouse connector needs only the two S3 statements — drop the Glue statement, and make sure the s3:prefix condition covers the warehouse prefix itself, since browsing lists it directly. For a bucket-root warehouse (s3://my-bucket), drop the condition entirely or allow the * prefix.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "glue:GetCatalog",
        "glue:GetDatabases",
        "glue:GetDatabase",
        "glue:GetTables",
        "glue:GetTable"
      ],
      "Resource": [
        "arn:aws:glue:us-west-2:123456789012:catalog",
        "arn:aws:glue:us-west-2:123456789012:database/*",
        "arn:aws:glue:us-west-2:123456789012:table/*/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::my-bucket",
      "Condition": {
        "StringLike": { "s3:prefix": ["iceberg-warehouse/*"] }
      }
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::my-bucket/iceberg-warehouse/*"
    }
  ]
}

See the Iceberg catalog connector documentation for the underlying Spice parameters and authentication behavior.

Adding datasets

After saving the connection, browse namespaces and select Iceberg tables. With a Glue catalog, non-Iceberg Glue tables are not shown; with an S3 warehouse, folders without a metadata/*.metadata.json file are not shown. Source references use the AWS Glue Iceberg REST catalog form:

iceberg:https://glue.us-west-2.amazonaws.com/iceberg/v1/catalogs/123456789012/namespaces/analytics/tables/orders

or, for an S3 warehouse, the warehouse table path:

iceberg:s3a://my-bucket/iceberg-warehouse/analytics/orders

No metadata file is pinned in the dataset, so tables stay current as the pipeline writing them commits new snapshots. The catalog type, account ID, region, and warehouse path cannot be changed while datasets are linked to the connector, because each dataset’s source reference is derived from them.

Common problems

Error or symptom	Likely cause
`AWS Glue authentication failed`	The credentials are invalid, expired, or missing Glue permissions.
No namespaces appear	The principal lacks `glue:GetDatabases` (or `s3:ListBucket` on the warehouse prefix), or the account ID, region, or warehouse path do not identify the intended catalog.
A table is missing	The Glue object is not registered as an Iceberg table, the warehouse folder has no `metadata/*.metadata.json` file, or the principal lacks metadata access.
Dataset deployment fails with S3 access denied	The principal can browse Glue but cannot read the table’s metadata or data files in S3.
Temporary credentials fail validation	Provide the session token issued with the `ASIA` access key.

Get started

Features

API & Integrations

API Reference

What you’ll need

Form fields

IAM policy

Adding datasets

Common problems

​What you’ll need

​Form fields

​IAM policy

​Adding datasets

​Common problems

What you’ll need

Form fields

IAM policy

Adding datasets

Common problems