Skip to content

Iceberg: use sts for Iceberg credentials source with Glue + Cloud #1714

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kbatuigas merged 5 commits into from
May 28, 2026
Merged

Iceberg: use sts for Iceberg credentials source with Glue + Cloud #1714

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a70ead6
DOC-2209: Recommend sts for Iceberg AWS Glue on Cloud
kbatuigas May 26, 2026
a168451
Merge branch 'main' into DOC-2209-update-iceberg-aws-glue-cloud-doc-t…
kbatuigas May 26, 2026
39226ff
Apply clarification per SME review
kbatuigas May 28, 2026
03619bb
Fix list item rendering
kbatuigas May 28, 2026
67b4496
Fix object storage property xrefs
kbatuigas May 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions modules/manage/pages/iceberg/iceberg-topics-aws-glue.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ For an example cluster configuration that uses the same IAM credentials for both
* If you want to configure authentication to AWS Glue separately from authentication to S3, there are equivalent credential configuration properties named `iceberg_rest_catalog_aws_*` that override the object storage credentials. These properties only apply to REST catalog authentication, and never to S3 authentication:
+
--
** config_ref:iceberg_rest_catalog_credentials_source,true,properties/cluster-properties[`iceberg_rest_catalog_credentials_source`]. To use the cluster's IAM role, set the property to `aws_instance_metadata`. To use static credentials, set to `config_file`.
** config_ref:iceberg_rest_catalog_credentials_source,true,properties/cluster-properties[`iceberg_rest_catalog_credentials_source`]. To use the cluster's IAM role, set the property to `sts`. To use static credentials, set to `config_file`.

@coderabbitai coderabbitai Bot May 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add an explicit minimum-version caveat for sts guidance.

The new recommendation at Line 138 and example at Line 220 introduce sts, but this page does not state that this behavior requires Redpanda v26.1.9+ (per PR objective/commit context). Without that guardrail, users on earlier versions can follow these steps and hit Glue auth/policy mismatch.

Suggested doc patch 
-** config_ref:iceberg_rest_catalog_credentials_source,true,properties/cluster-properties[`iceberg_rest_catalog_credentials_source`]. To use the cluster's IAM role, set the property to `sts`. To use static credentials, set to `config_file`.
+** config_ref:iceberg_rest_catalog_credentials_source,true,properties/cluster-properties[`iceberg_rest_catalog_credentials_source`]. To use the cluster's IAM role, set the property to `sts` (Redpanda v26.1.9 or later). To use static credentials, set to `config_file`.
 rpk cluster config set \
@@
-  iceberg_rest_catalog_credentials_source=sts \
+  iceberg_rest_catalog_credentials_source=sts \  # Redpanda v26.1.9+

Also applies to: 220-220

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@modules/manage/pages/iceberg/iceberg-topics-aws-glue.adoc` at line 138, The
docs add guidance to set iceberg_rest_catalog_credentials_source to `sts` but
don't state the minimum Redpanda version required; update the
iceberg-topics-aws-glue.adoc text near the
iceberg_rest_catalog_credentials_source description and the example around the
`sts` usage to include an explicit caveat that `sts` requires Redpanda v26.1.9+
(mention the exact version string v26.1.9+), and add a short note preventing
users on earlier versions from following the `sts` flow without upgrading.

** config_ref:iceberg_rest_catalog_aws_access_key,true,properties/cluster-properties[`iceberg_rest_catalog_aws_access_key`] (static credentials only)
** config_ref:iceberg_rest_catalog_aws_secret_key,true,properties/cluster-properties[`iceberg_rest_catalog_aws_secret_key`] (static credentials only), added as a secret value (see the <<update-cluster-configuration,next section>> for details)
** config_ref:iceberg_rest_catalog_aws_region,true,properties/cluster-properties[`iceberg_rest_catalog_aws_region`]
Expand Down Expand Up @@ -217,7 +217,7 @@ rpk cluster config set \
iceberg_catalog_type=rest \
iceberg_rest_catalog_endpoint=https://glue.<glue-region>.amazonaws.com/iceberg \
iceberg_rest_catalog_authentication_mode=aws_sigv4 \
iceberg_rest_catalog_credentials_source=aws_instance_metadata \
iceberg_rest_catalog_credentials_source=sts \
iceberg_rest_catalog_aws_region=<glue-region> \
iceberg_rest_catalog_base_location=s3://<cluster-storage-bucket-name>/<warehouse-path>
----
Expand Down
Loading