Manage catalogs in the Google Cloud console

The managed Apache Iceberg REST catalog in BigLake metastore creates interoperability between your query engines by offering a single source of truth for all of your Iceberg data. This document describes Iceberg REST catalog management actions that can be performed in the Google Cloud console.

Before you begin

1. Verify that billing is enabled for your Google Cloud project.

2. Enable the BigLake API.

   Roles required to enable APIs

   To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

   Enable the API

Required roles

To get the permissions that you need to use BigLake metastore in the Google Cloud console, ask your administrator to grant you the following IAM roles on your project:

• BigLake Admin (roles/biglake.admin)
• Storage Admin (roles/storage.admin)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Create a catalog

1. In the Google Cloud console, open the BigLake page.

   Go to BigLake

2. Click Create catalog. The Create catalog page opens.

3. For Select a Cloud Storage bucket, enter the name of the Cloud Storage bucket to use with your catalog. Alternatively, click Browse to choose from a list of existing buckets or to create a new one. You can only have one catalog per Cloud Storage bucket.

4. For Authentication method, select either End-user credentials or Credential vending mode.

5. Click Create.

Note: If you selected credential vending mode as your authentication method, you may need to grant the new catalog's service account the Storage Object User (roles/storage.objectUser) role on your Cloud Storage bucket. Your service account is visible on the Catalog Details page. For information on granting access, see Add a principal to a bucket-level policy.

Enable credential vending

If the authentication method for your catalog is set to end-user credentials, you can switch it to credential vending mode.

1. In the Google Cloud console, open the BigLake page.

   Go to BigLake

2. In the row of the catalog that you're updating, click More catalog actions > Edit authentication.

3. In the authentication dialog, select Credential vending mode.

4. Click Save.

Note: You may need to grant the catalog's service account the Storage Object User (roles/storage.objectUser) role on your Cloud Storage bucket. Your service account is visible on the Catalog Details page. For information on granting access, see Add a principal to a bucket-level policy.

Get catalog details

1. In the Google Cloud console, open the BigLake page.

   Go to BigLake

2. Click the name of any catalog.

3. On the Catalog Details page, explore information about the catalog such as catalog ID, creation timestamp, REST catalog URI, authentication method, and service account.

Delete a catalog

1. In the Google Cloud console, open the BigLake page.

   Go to BigLake

2. In the row of the catalog that you're deleting, click More catalog actions > Delete.

3. In the delete dialog, enter DELETE and click Delete.

View audit logs

1. In the Google Cloud console, open the BigLake page.

   Go to BigLake

2. In the row of the catalog that you're viewing, click More catalog actions > View audit logs.

Pricing

For pricing details, see BigLake pricing.

What's next

• Learn more about the Iceberg REST catalog.