> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon S3 Tables

> Connect Amazon S3 Tables buckets to your e6data workspace and query their Iceberg tables.

**AWS S3 Tables** is Amazon's managed Iceberg table service in S3. e6data can connect to S3 Tables buckets and query tables through the S3 Tables catalog APIs.

<Info>
  S3 Tables is an AWS-specific offering, available on workspaces deployed in AWS regions. If your workspace is on Azure, use [Iceberg REST Catalog](/query/catalogs/iceberg-rest-catalog) instead with your own catalog server.
</Info>

## Before you start

* Have your S3 Tables bucket ARN ready (format: `arn:aws:s3tables:<region>:<account>:bucket/<bucket-name>`).
* Have an IAM role (cross-account or same-account) with read permissions on the bucket - see [IAM permissions](#iam-permissions) below.
* For Serverless, complete the [AWS Serverless setup](/platform/deploy/aws-serverless) so e6data has a path to assume your role.

## Connect to S3 Tables

1. Navigate to the **Catalogs** section from the sidebar and click **Create Catalog**.
2. Enter a **Catalog Name**. Lowercase letters, numbers, and hyphens are recommended (for example, `prod-s3-tables`).
3. Select **Catalog Type** as **AWS S3 Tables**.
4. (Optional) Enable **Governance**. Apply fine-grained access control via Ranger, OPA, or Lake Formation.
5. Provide the S3 Tables connection details:

   | Field | Description |
   | - | - |
   | **Region** | AWS region where the S3 Tables bucket lives (for example, `us-east-1`) |
   | **Bucket ARN** | Full ARN of the S3 Tables bucket |
   | **IAM Role ARN** | Role e6data assumes to access the bucket |
   | **External ID** | (Optional) External ID for cross-account assumption |
6. (Optional) Enable **Cross-Account Access** if the bucket is in a different AWS account from where e6data is set up. The Role ARN should target the role in the data-owning account; e6data's identity must be allowed to assume it.
7. Click **Test Connection** to verify connectivity. The test confirms the role can be assumed, the bucket is reachable, and e6data can list namespaces.
8. After a successful test, **select namespaces** to expose. Each namespace contains tables that become queryable.
9. Click **Create Catalog**.

## IAM permissions

The IAM role e6data assumes needs these S3 Tables and S3 permissions:

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3tables:GetTableBucket",
        "s3tables:ListNamespaces",
        "s3tables:GetNamespace",
        "s3tables:ListTables",
        "s3tables:GetTable",
        "s3tables:GetTableMetadataLocation",
        "s3tables:GetTableData"
      ],
      "Resource": [
        "arn:aws:s3tables:<region>:<account>:bucket/<bucket-name>",
        "arn:aws:s3tables:<region>:<account>:bucket/<bucket-name>/*"
      ]
    }
  ]
}
```

For cross-account access, the trust policy on the role must allow e6data's identity to assume it. See [Cross-account access](/query/catalogs/cross-account) for the AWS pattern.

## Edit an S3 Tables catalog

Edit to update which namespaces it exposes, rotate the IAM role, or change governance settings.

1. Open the **Catalogs** page in the Compute Plane.
2. Find the S3 Tables catalog, click the row actions (⋮), and click **Edit**.
3. Update what you need - selected namespaces, **IAM Role ARN**, **External ID**, or **Governance settings**.
4. Click **Test Connection** if you changed the role or external ID.
5. Click **Update Catalog**.

A re-test is required when you change the Bucket ARN, Region, IAM Role ARN, External ID, or Cross-Account Access toggle. Namespace-selection changes don't. Namespace changes apply on the next query; IAM role changes take effect within seconds (queries in flight may briefly fail and need a retry).

## Delete an S3 Tables catalog

1. Open the **Catalogs** page, find the catalog, click the row actions (⋮), and click **Delete**. Confirm.

Deletion removes the catalog from this workspace; attached clusters lose access. The underlying S3 Tables bucket, tables, and data are **not** modified - e6data is read-only.

## See also

* [Catalogs overview](/query/catalogs/register-and-manage-catalogs)
* [Cross-account access](/query/catalogs/cross-account)
* [Iceberg REST Catalog](/query/catalogs/iceberg-rest-catalog) - for non-S3-Tables Iceberg catalogs


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.