Set Up an AWS Glue Data Catalog File Federation Connection

Create an AWS Glue Data Catalog connection to pull data into Data 360.

User Permissions Needed
To create an AWS Glue Data Catalog connection:	System Admin profile or Data 360 Architect permission set

Requirements:

Firewall: If your Glue Data Catalog-managed Iceberg data lakehouse is behind a firewall, add these Data 360 IP Addresses to your allowlist before creating a connection. If the network firewall that protects the Glue Data Catalog and the underlying S3 bucket are different, make sure to update both network firewalls. Also, make sure both the Glue Data Catalog and the S3 bucket are publicly accessible.

Data 360 doesn’t support connecting over AWS PrivateLink to either the Glue Data Catalog or the storage bucket,

Note

Set Up the Connector

In Data Cloud, click Setup, and select Data Cloud Setup.
Under External Integrations, select Other Connectors.
Click New.
On the Source tab, select AWS Glue Data Catalog and click Next.
Enter a name for the connection.

In the Authentication Details section, enter the AWS Access Key ID and AWS Secret Access Key for the Identity and Access Management (IAM) user. Make sure that the IAM user has a policy that grants the user read-only access to Glue Data Catalog. Use AWS Lake Formation to configure storage credential vending. This approach is for Glue Data Catalog to vend temporary credentials at run time so that Data 360 can access the underlying storage bucket.

1{
2"Version": "2012-10-17",
3 "Statement": [
4{
5    "Effect": "Allow",
6    "Action": [
7        "lakeformation:GetDataAccess"
8    ],
9    "Resource": "*"
10},
11{
12    "Action": [
13        "glue:ListSchemas",
14        "glue:GetTables",
15        "glue:GetTableVersions",
16        "glue:GetTableVersion",
17        "glue:GetTable",
18        "glue:GetSchema",
19        "glue:GetDatabases",
20        "glue:GetDatabase"
21    ],
22    "Effect": "Allow",
23    "Resource": [
24        "arn:aws:glue:us-west-2:240852588578:userDefinedFunction/*/*",
25        "arn:aws:glue:us-west-2:240852588578:tableVersion/*/*/*",
26        "arn:aws:glue:{REGION}:{ACCOUNT_ID}:table/*/*",
27        "arn:aws:glue:{REGION}:{ACCOUNT_ID}:schema/*",
28        "arn:aws:glue:{REGION}:{ACCOUNT_ID}:registry/*",
29        "arn:aws:glue:{REGION}:{ACCOUNT_ID}:database/*",
30        "arn:aws:glue:{REGION}:{ACCOUNT_ID}:connection/*",
31        "arn:aws:glue:{REGION}:{ACCOUNT_ID}:catalog"
32    ],
33
34
35    "Sid": "AWSGlueDataCatalogWithS3ReadOnlyAccess"
36    }
37]
38
39}

If you don’t configure storage credential vending, make sure that the policy also explicitly covers the S3 bucket. Add this IAM policy, and remove the component of the previously mentioned policy that is specific to Lake Formation.

1```
2{
3"Version": "2012-10-17",
4"Statement": [
5    {
6    "Sid": "ListBucketForIceberg",
7    "Effect": "Allow",
8    "Action": [
9        "s3:ListBucket",
10        "s3:GetBucketLocation"
11    ],
12    "Resource": [
13        "arn:aws:s3:::{bucket}"
14    ],
15    "Condition": {
16        "StringLike": {
17        "s3:prefix": [
18            "{s3_prefix_1}/*",
19            "{s3_prefix_2}/*"
20        ]
21        }
22    }
23    },
24    {
25    "Sid": "ReadIcebergFiles",
26    "Effect": "Allow",
27    "Action": [
28        "s3:GetObject",
29        "s3:GetObjectVersion"
30    ],
31    "Resource": [
32        "arn:aws:s3:::{bucket}/{object_prefix_1}/*",
33        "arn:aws:s3:::{bucket}/{object_prefix_2}/*"
34    ]
35    },
36    {
37    "Sid": "KMSAccessForIceberg",
38    "Effect": "Allow",
39    "Action": [
40        "kms:DescribeKey",
41"kms:Decrypt"
42],
43"Resource": "{kms_key_arn}"
44}
45]
46}
47```

For catalog URL, enter the URL of the Glue Data Catalog. See Connecting to the Data Catalog by using AWS Glue Iceberg REST endpoint.
For Catalog ID, enter the 12-digit AWS account ID linked to the Glue Data Catalog.
For Signing Region, enter the host AWS region that Glue Data Catalog.
For Signing Service, enter glue. Data 360 requires the Signing Service, in addition to the AWS Access Key ID, Secret Access Key, and Signing Region, to sign requests to the Glue Data Catalog by using AWS Signature Version 4.

Storage Considerations

Cross-Region S3 Storage Bucket: If your Data 360 org isn’t in the same region as your S3 storage bucket and your catalog doesn’t support storage credential vending, make sure that the server hosting the REST catalog has the client.region property in the LoadTableResult object. See Iceberg OpenAPI.
S3 Storage Bucket Name: If you use AWS S3, make sure that the S3 bucket’s name doesn’t contain a period. You can access such buckets via path-style addressing, which AWS has marked for deprecation. Data 360 supports only those buckets that are accessed via virtual host-style addressing with SSL.

Other Considerations

Row-Level Updates: Querying Iceberg tables that are configured to use Iceberg V2 MoR Position Equality Deletes or Iceberg V3 Deletion Vectors isn’t supported. To express a merge-on-read table as a copy-on-write table, see Submitting Spark Jobs for MoR to CoW Conversion.
Views: Querying Iceberg views isn’t supported.
Namespaces: Only single-level (catalog -> database -> table) and two-level (catalog -> database -> schema -> table) namespaces are supported.
Temporal Data Types: The time and timestamp_ntz data types aren’t supported.
Change Data: Certain features in Data Cloud require the ability to detect when a data lake object changes (example, data actions). For Data Cloud to construct a change data feed, that is, a log of incremental changes to an external data lake object, it needs a primary key. For such features, use Iceberg’s identifier-field-ids construct to define which columns comprise a table’s primary key and make sure that your query engines (writers) respect your configuration.

Next Step

Create an AWS Glue Data Catalog Data Stream