Credential vending overview

Within Google Cloud Lakehouse, you use the Lakehouse runtime catalog to manage metadata for your Lakehouse Iceberg REST catalog tables stored in Cloud Storage.

This document explains how to get and set Identity and Access Management (IAM) policies at the table level to control access to these resources using the gcloud CLI.

How credential vending works

When you use credential vending, the query processing sequence changes slightly to enforce policies before data is read:

  1. Request: A user submits a SQL query to a supported engine (for example, Apache Spark or BigQuery).
  2. Metadata lookup: The engine sends a request to the Lakehouse runtime catalog to resolve the table.
  3. Authentication and policy: The catalog authenticates the user and checks their IAM permissions on the Google Cloud Lakehouse resources.
  4. Response: Because credential vending is enabled, the catalog returns the metadata and a short-lived storage token (downscoped storage credentials) to the engine.
  5. Read: The engine uses this token to read the specific authorized files directly from Cloud Storage.
  6. Compute: The engine processes the data and returns the results.

Supported engines

In order to use credential vending with query engines, your Lakehouse Iceberg REST catalog must be configured to support credential vending.

  • Open source engines: Supported engines like Apache Spark and Trino use short-lived storage tokens vended by the catalog. Your client application must specify support for credential vending in the X-Iceberg-Access-Delegation header.
  • BigQuery: BigQuery uses vended credentials for Cloud Storage access instead of end-user credentials.

What's next