> ## Documentation Index > Fetch the complete documentation index at: https://docs.summation.com/llms.txt > Use this file to discover all available pages before exploring further. # Apache Iceberg > Connect Summation to Apache Iceberg tables in an AWS Glue catalog or an S3 warehouse. The Apache Iceberg connector exposes Iceberg tables as datasets. Pick one of two catalog types in the connection form: * **AWS Glue catalog** — tables are registered in an AWS Glue Data Catalog. Summation browses Glue namespaces and tables, then reads each selected table from its S3 storage through Spice. * **S3 warehouse** — tables live directly under an S3 prefix with no catalog service, laid out as `///metadata/*.metadata.json`. Summation lists the warehouse to find namespaces and tables, and Spice resolves the newest metadata file on every load. Other Iceberg REST catalog providers are not available in the connection form. ## What you'll need * For a Glue catalog: the 12-digit **AWS account ID** that owns the Glue Data Catalog. * For an S3 warehouse: the **warehouse path** (`s3://my-bucket/iceberg-warehouse`, or `s3://my-bucket` when the namespace folders sit at the bucket root), pointing one level above the namespace folders. * The AWS **region** containing the catalog or warehouse and its S3 data. * AWS credentials with read access to the catalog (or warehouse prefix) and the S3 locations backing its Iceberg tables. * An optional session token when using temporary AWS credentials. Use a dedicated read-only IAM principal and scope its S3 permissions to the prefixes containing the tables Summation should read. ## Form fields | Field | Required | Stored as | Notes | | --------------------- | ---------------------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Catalog** | Yes | Config | `AWS Glue catalog` or `S3 warehouse`. Existing connectors remain Glue. | | **AWS Account ID** | Glue only | Config | The 12-digit account ID for the Glue Data Catalog. | | **Warehouse Path** | S3 warehouse only | Config | For example `s3://my-bucket/iceberg-warehouse`, or `s3://my-bucket` when namespaces sit at the bucket root. `s3://` and `s3a://` are both accepted and stored as `s3a://`. | | **AWS Region** | Yes | Config | Region containing the catalog or warehouse, for example `us-west-2`. | | **Access Key ID** | Yes | Secret | AWS access key ID. Both long-lived `AKIA` and temporary `ASIA` keys are supported. | | **Secret Access Key** | Yes | Secret | Secret access key matching the access key ID. | | **Session Token** | Required for temporary credentials | Secret | AWS session token associated with an `ASIA` access key. | ## IAM policy The credentials need permission to browse the catalog and read the S3 objects referenced by the selected Iceberg tables. Replace the account, bucket, and prefix values with your own. An S3 warehouse connector needs only the two S3 statements — drop the Glue statement, and make sure the `s3:prefix` condition covers the warehouse prefix itself, since browsing lists it directly. For a bucket-root warehouse (`s3://my-bucket`), drop the condition entirely or allow the `*` prefix. ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:GetCatalog", "glue:GetDatabases", "glue:GetDatabase", "glue:GetTables", "glue:GetTable" ], "Resource": [ "arn:aws:glue:us-west-2:123456789012:catalog", "arn:aws:glue:us-west-2:123456789012:database/*", "arn:aws:glue:us-west-2:123456789012:table/*/*" ] }, { "Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": "arn:aws:s3:::my-bucket", "Condition": { "StringLike": { "s3:prefix": ["iceberg-warehouse/*"] } } }, { "Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/iceberg-warehouse/*" } ] } ``` See the [Iceberg catalog connector documentation](https://spiceai.org/docs/components/catalogs/iceberg) for the underlying Spice parameters and authentication behavior. ## Adding datasets After saving the connection, browse namespaces and select Iceberg tables. With a Glue catalog, non-Iceberg Glue tables are not shown; with an S3 warehouse, folders without a `metadata/*.metadata.json` file are not shown. Source references use the AWS Glue Iceberg REST catalog form: ```text theme={null} iceberg:https://glue.us-west-2.amazonaws.com/iceberg/v1/catalogs/123456789012/namespaces/analytics/tables/orders ``` or, for an S3 warehouse, the warehouse table path: ```text theme={null} iceberg:s3a://my-bucket/iceberg-warehouse/analytics/orders ``` No metadata file is pinned in the dataset, so tables stay current as the pipeline writing them commits new snapshots. The catalog type, account ID, region, and warehouse path cannot be changed while datasets are linked to the connector, because each dataset's source reference is derived from them. ## Common problems | Error or symptom | Likely cause | | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `AWS Glue authentication failed` | The credentials are invalid, expired, or missing Glue permissions. | | No namespaces appear | The principal lacks `glue:GetDatabases` (or `s3:ListBucket` on the warehouse prefix), or the account ID, region, or warehouse path do not identify the intended catalog. | | A table is missing | The Glue object is not registered as an Iceberg table, the warehouse folder has no `metadata/*.metadata.json` file, or the principal lacks metadata access. | | Dataset deployment fails with S3 access denied | The principal can browse Glue but cannot read the table's metadata or data files in S3. | | Temporary credentials fail validation | Provide the session token issued with the `ASIA` access key. |