Clarify base location requirements

Author: kbatuigas

modules/manage/pages/iceberg/iceberg-topics-aws-glue.adoc

@@ -67,6 +67,12 @@ endif::[]
 
 When `iceberg_delete` or the topic override `redpanda.iceberg.delete` is set to `false`, you can delete the Redpanda topic, and then delete the table in AWS Glue and the Iceberg data and metadata files in the S3 bucket. If you plan to re-create the topic after deleting it, you must delete the table data entirely before re-creating the topic.
 
+ifdef::env-cloud[]
+=== Same AWS account required
+
+For BYOC and BYOVPC deployments, the AWS Glue Data Catalog must be in the same AWS account as the cluster. Cross-account Glue access has not been tested or certified. If you need to use a Glue catalog in a different AWS account, contact https://support.redpanda.com[Redpanda support^].
+endif::[]
+
 == Authorize access to AWS Glue
 
 ifdef::env-cloud[]
@@ -172,8 +178,12 @@ iceberg_rest_catalog_base_location: s3://<bucket-name>/<warehouse-path>
 Use your own values for the following placeholders:
 +
 --
-- `<glue-region>`: The AWS region where your Data Catalog is located. The region in the AWS Glue endpoint must match the region specified in either your config_ref:cloud_storage_region,true,properties/cluster-properties[`cloud_storage_region`] or config_ref:iceberg_rest_catalog_aws_region,true,properties/cluster-properties[`iceberg_rest_catalog_aws_region`] property.
-- `<bucket-name>` and `<warehouse-path>`: AWS Glue requires you to specify the base location where Redpanda stores Iceberg data and metadata files. You must use an S3 URI; for example, `s3://<bucket-name>/iceberg`. As a security best practice, Redpanda Data recommends specifying a subfolder (using prefixes) rather than the root of the bucket.
+* `<glue-region>`: The AWS region where your Data Catalog is located. The region in the AWS Glue endpoint must match the region specified in either your config_ref:cloud_storage_region,true,properties/cluster-properties[`cloud_storage_region`] or config_ref:iceberg_rest_catalog_aws_region,true,properties/cluster-properties[`iceberg_rest_catalog_aws_region`] property.
+* `<bucket-name>` and `<warehouse-path>`: AWS Glue requires you to specify the base location where Redpanda stores Iceberg data and metadata files. You must use an S3 URI; for example, `s3://<bucket-name>/iceberg`. This must be the same bucket used for Tiered Storage (your `cloud_storage_bucket`). You cannot specify a different bucket for Iceberg data.
++
+`<warehouse-path>` is a name you choose (such as `iceberg`) as the logical name for the warehouse represented by all Redpanda Iceberg topic data in the cluster.
++
+As a security best practice, do not use the bucket root for the base location. Always specify a subfolder to avoid interfering with Tiered Storage data.
 --
 endif::[]
 ifdef::env-cloud[]
@@ -200,7 +210,7 @@ rpk cluster config set \
   iceberg_rest_catalog_authentication_mode=aws_sigv4 \
   iceberg_rest_catalog_credentials_source=aws_instance_metadata \
   iceberg_rest_catalog_aws_region=<glue-region> \
-  iceberg_rest_catalog_base_location=s3://<bucket-name>/<warehouse-path>
+  iceberg_rest_catalog_base_location=s3://<cluster-storage-bucket-name>/<warehouse-path>
 ----
 --
 
@@ -221,20 +231,24 @@ rpk cluster config set \
   iceberg_rest_catalog_aws_region=<glue-region> \
   iceberg_rest_catalog_aws_access_key=<glue-access-key> \
   iceberg_rest_catalog_aws_secret_key='${secrets.<glue-secret-key-name>}' \
-  iceberg_rest_catalog_base_location=s3://<bucket-name>/<warehouse-path>
+  iceberg_rest_catalog_base_location=s3://<cluster-storage-bucket-name>/<warehouse-path>
 ----
 --
 ======
 +
 Use your own values for the following placeholders:
 +
 --
-- `<glue-region>`: The AWS region where your Data Catalog is located. The region in the AWS Glue endpoint must match the region specified in your config_ref:iceberg_rest_catalog_aws_region,true,properties/cluster-properties[`iceberg_rest_catalog_aws_region`] property.
-- `<bucket-name>` and `<warehouse-path>`: AWS Glue requires you to specify the base location where Redpanda stores Iceberg data and metadata files. You must use an S3 URI; for example, `s3://<bucket-name>/iceberg`. For BYOC clusters, the bucket name is `redpanda-cloud-storage-<cluster-id>`. For BYOVPC clusters, use the name of the bucket you created as a customer-managed resource.
+* `<glue-region>`: The AWS region where your Data Catalog is located. The region in the AWS Glue endpoint must match the region specified in your config_ref:iceberg_rest_catalog_aws_region,true,properties/cluster-properties[`iceberg_rest_catalog_aws_region`] property.
+* `<cluster-storage-bucket-name>` and `<warehouse-path>`: AWS Glue requires you to specify the base location where Redpanda stores Iceberg data and metadata files. You must use an S3 URI; for example, `s3://<cluster-storage-bucket-name>/iceberg`.
+** Bucket name: For BYOC clusters, the bucket name is `redpanda-cloud-storage-<cluster-id>`. For BYOVPC clusters, use the name of the bucket you created as a customer-managed resource. 
++
+This must be the same bucket used for Tiered Storage. You cannot specify a different bucket for Iceberg data.
+** Warehouse: This is a name you choose as the logical name (such as `iceberg`) for the warehouse represented by all Redpanda Iceberg topic data in the cluster.
 +
-As a security best practice, Redpanda Data recommends specifying a subfolder (using prefixes) rather than the root of the bucket.
-- `<glue-access-key>` (static credentials only): The AWS access key ID for your Glue service account.
-- `<glue-secret-key-name>` (static credentials only): The name of the secret that stores the AWS secret access key for your Glue service account. To reference a secret in a cluster property, for example `iceberg_rest_catalog_aws_secret_key`, you must first xref:manage:iceberg/use-iceberg-catalogs.adoc#store-a-secret-for-rest-catalog-authentication[store the secret value].
+As a security best practice, do not use the bucket root for the base location. Always specify a subfolder to avoid interfering with Tiered Storage data.
+* `<glue-access-key>` (static credentials only): The AWS access key ID for your Glue service account.
+* `<glue-secret-key-name>` (static credentials only): The name of the secret that stores the AWS secret access key for your Glue service account. To reference a secret in a cluster property, for example `iceberg_rest_catalog_aws_secret_key`, you must first xref:manage:iceberg/use-iceberg-catalogs.adoc#store-a-secret-for-rest-catalog-authentication[store the secret value].
 --
 endif::[]
 +