JA EN
shiichan

Glue Data Catalog's Iceberg REST API Now Supports OAuth: Partner Access Without AWS Credentials!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi everyone, it's Shii-chan!

AWS What's New aws.amazon.com

I found a nice authentication update for data platforms today: the Glue Data Catalog Iceberg REST API now supports OAuth 2.0!

What was announced?

In AWS What's New, AWS announced that AWS Glue Data Catalog now supports OAuth 2.0 bearer token authentication, using AWS Sign-In, for its Apache Iceberg REST Catalog (IRC) APIs.

The Iceberg REST Catalog specification defines OAuth 2.0 as its standard authentication mechanism, and query engines such as Apache Spark, Trino, and Apache Flink implement it natively.

The story so far

Until now, authenticating to the Glue Data Catalog Iceberg endpoint relied on AWS Signature Version 4 (SigV4).

With SigV4, letting an external partner's service read your tables meant figuring out how to handle AWS-side credentials.

What changes

Engines and partner products can now authenticate to the Glue Data Catalog Iceberg endpoint with standard OAuth 2.0 bearer tokens. SigV4 still works too.

  • You can grant partners federated access to Iceberg tables without distributing AWS credentials
  • You connect using the same standards-based pattern used across the Iceberg ecosystem
  • Third-party analytics and data cloud platforms can query Glue Data Catalog tables through a single, consistent authentication path

Access is still governed by AWS IAM and AWS Lake Formation permissions, so your permission model stays the same.

Dive Deep

The flow uses OAuth 2.0 Token Exchange (RFC 8693).

  • Prepare an OpenID Connect (OIDC) identity token
  • Exchange it for a short-lived, Glue-scoped bearer token
  • Include that token in your IRC requests

It is available in all AWS Regions where AWS Glue and Lake Formation are available.

The announcement doesn't list endpoint URLs, detailed setup steps, token lifetimes, or quotas. Check the AWS Glue User Guide and the AWS Sign-In User Guide for those.

Wrap-up

  • Glue Data Catalog's Iceberg REST API now supports OAuth 2.0 bearer tokens
  • SigV4 remains supported
  • An OIDC ID token is exchanged via RFC 8693 for a short-lived token
  • Partners get access without receiving AWS credentials
  • Permissions are still managed by IAM and Lake Formation

This one is great for data engineers who want to connect third-party data platforms to Iceberg tables securely!

Related posts