apache / apache/iceberg-rust

feat(glue): Support AWS STS AssumeRole for Glue catalog authentication

Open
#2,394 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
1.4k
Forks
567
Avg merge
2d 2h
Merged PRs (30d)
93

Description

### Is your feature request related to a problem or challenge?

Users operating in multi-account AWS environments, or following AWS security best practices, need to access the AWS Glue Data Catalog using temporary IAM credentials obtained via STS AssumeRole rather than long-term static access keys. Currently the Glue catalog only supports static credentials (aws_access_key_id / aws_secret_access_key), named profiles, and the default credential chain — none of which cover the AssumeRole flow directly. This makes it impossible to support common patterns such as cross-account Glue catalog access or workloads where an application assumes a scoped-down IAM role to interact with Glue.

### Describe the solution you'd like

Add three new configuration properties to the Glue catalog, mirroring the naming convention already used by the S3 storage layer.

| Property | Description |
|---------|---------|
| client.assume-role.arn | ARN of the IAM role to assume |
| client.assume-role.external-id | (Optional) External ID for cross-account role assumption |
| client.assume-role.session-name | (Optional) STS session name (default: iceberg-glue-catalog) |

When client.assume-role.arn is set, the catalog should use the existing base credentials (static keys, profile, or default chain) to call AWS STS AssumeRole, then use the resulting temporary credentials for all Glue API calls. These temporary credentials should also be propagated to the S3 FileIO layer so that both metadata reads/writes and Glue API calls operate under the same assumed role.

### Willingness to contribute

None

Contributor guide

Open the contributing guide

Research direction

Start with the Glue catalog configuration and the S3 storage layer's existing credential handling, then trace how base credentials reach Glue API calls and the S3 FileIO layer. Implement the three AssumeRole properties and verify that temporary credentials are used consistently for both catalog and metadata operations, including optional external ID and session name behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, rust
Domain
backend, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.