AWS Glue Data Catalog now supports OAuth for Apache Iceberg REST Catalog APIs

AWS Glue Data Catalog now supports OAuth 2.0 bearer token authentication via AWS Sign-In for Apache Iceberg REST Catalog (IRC) API. The Iceberg REST Catalog spec defines OAuth 2.0 as the standard, natively implemented in engines like Apache Spark, Trino, and Apache Flink. These engines and external partners can now authenticate to the Glue Data Catalog Iceberg endpoint using standard OAuth 2.0 bearer tokens in addition to AWS Signature Version 4 (SigV4). Using OAuth 2.0 token exchange (RFC 8693), OpenID Connect (OIDC) identity tokens can be exchanged for short-lived Glue-scoped bearer tokens to include in IRC requests, following the same standard pattern used across the Iceberg ecosystem. Access is governed by AWS IAM and Lake Formation permissions. Common use cases include third-party analytics and data cloud platforms querying Glue Data Catalog tables through a single, consistent authentication path. This feature is available in all AWS regions where AWS Glue and Lake Formation are offered.

Why it matters

This update is useful for data engineers and data analysts, providing a more secure and standardized way to access Iceberg tables stored in AWS Glue Data Catalog.