Repository navigation
Allow to assume role when connecting to AWS catalogs (glue/dynamodb) #2747
Description
Feature Request / Improvement
At this moment, role-arn parameters (either with client or s3 prefix) can be used to assume role before accessing S3 objects. I propose that this functionality is extended to catalog clients for AWS iceberg catalogs (glue/dynamodb). This will improve users experience, since other client-prefixed parameters are usually shared between s3 and glue/dynamodb.
Activity
fix(ingest/iceberg): inject S3 credentials alongside Glue during cros…
github-actions commentedon May 16, 2026
This issue has been automatically marked as stale because it has been open for 180 days with no activity. It will be closed in next 14 days if no further activity occurs. To permanently prevent this issue from being considered stale, add the label 'not-stale', but commenting on the issue is preferred when possible.
LDVSOFT commentedon May 18, 2026
plz
not-stalelemon0333 commentedon Aug 24, 2026
I'd like to pick this up if no one is already on it.
Proposed approach — extend the existing assume-role mechanism (currently honored only by the S3 FileIO via
client.role-arn/client.role-session-name, seepyiceberg/io/pyarrow.py) to the boto3 sessions built byGlueCatalogandDynamoDbCatalog:boto3.Sessionconstruction path (pyiceberg/catalog/glue.py,pyiceberg/catalog/dynamodb.py), when a role ARN is configured, perform an STSAssumeRolefrom the base session and use the returned temporary credentials for the Glue/DynamoDB client.client.*properties: a service-prefixed override (glue.role-arn/dynamodb.role-arn,glue.role-session-name/dynamodb.role-session-name) falling back to the unifiedclient.role-arn/client.role-session-name. This mirrors howglue.region→client.regionetc. already work.moto(mock STS + Glue + DynamoDB) asserting the client is built from the assumed-role credentials.Since the thread doesn't have a maintainer response yet, could a maintainer confirm this direction — and in particular whether you'd like the service-prefixed properties (
glue.role-arn/dynamodb.role-arn) in addition to the unifiedclient.role-arn, or the unified ones only? Happy to adjust the naming to match your conventions.