Connect to Amazon S3 Tables using an assumed role

How-to guideApplies to: Unified engine deployments

Before you start

Use an existing catalog with at least one readable Iceberg table. The engine and workers must reach the catalog and its table storage. Have the remote identity and permissions ready before creating the Unified registration. Replace the namespace and table with one you know has data. The identity comes from the engine runtime, not your browser or laptop. Grant catalog metadata access and access to the actual table-file prefixes, including any required KMS keys. The source identity needs permission to assume the target role, and that role must trust the source. Copy the table bucket ARN and the REST URI for its region. The signing region must match the ARN. This is an S3 Tables table bucket, not an ordinary S3 bucket.

Values to collect

AWS region, namespace, table, and service-specific catalog identifiers.
Target role ARN and a working source identity.

Run the SQL

Replace every <placeholder> before running. Use unused names for the resources below. Run the statements in order in Workbench.

CREATE CREDENTIAL recipe_s3_tables_assume_role_source USING aws
OPTIONS (
  'authentication' = 'default_chain',
  'region' = '<aws-region>'
);

CREATE CREDENTIAL recipe_s3_tables_assume_role_auth USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'region' = '<aws-region>',
  'source' = 'recipe_s3_tables_assume_role_source',
  'role_arn' = '<role-arn>'
);

CREATE CATALOG recipe_s3_tables_assume_role USING `iceberg-rest`
OPTIONS (
  'uri' = '<catalog-api-uri>',
  'warehouse' = 'arn:aws:s3tables:<aws-region>:<account-id>:bucket/<table-bucket-name>',
  'auth.type' = 'sigv4',
  'rest.signing-name' = 's3tables',
  'rest.signing-region' = '<aws-region>',
  'catalog.type' = 's3-tables',
  'header.x-iceberg-access-delegation' = 'vended-credentials'
)
CREDENTIALS ('auth' = 'recipe_s3_tables_assume_role_auth');

SELECT *
FROM recipe_s3_tables_assume_role.`<namespace>`.`<table>`
LIMIT 5;

Check the result

The SELECT should return up to five rows from the chosen table. Use a nonempty table for this check. This verifies both metadata and table-file access; creating the registration alone does not verify either.

Clean up

This removes only the Unified registrations. It leaves the remote catalog and its tables in place.

DROP CATALOG recipe_s3_tables_assume_role;
DROP CREDENTIAL recipe_s3_tables_assume_role_auth;
DROP CREDENTIAL recipe_s3_tables_assume_role_source;

Transformation Engine

Learn Laminar

Workloads

SQL reference

HTTP API

Recipes

Operations

Connect to Amazon S3 Tables using an assumed role

Before you start

Values to collect

Run the SQL

Check the result

Clean up

​Before you start

​Values to collect

​Run the SQL

​Check the result

​Clean up

Before you start

Values to collect

Run the SQL

Check the result

Clean up