Manage Iceberg REST catalog resources

Lakehouse for Apache Iceberg lets you manage the Apache Iceberg REST catalog endpoint within the Lakehouse runtime catalog. You can use the Google Cloud console or the REST API to create, configure, and monitor these catalogs to establish the metadata layer required for query engine connections.

Before you begin

1. Read About the Lakehouse runtime catalog to understand how the Lakehouse runtime catalog works and the limitations for the service.
Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the API

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the API

Required roles

To get the permissions that you need to use the Lakehouse runtime catalog, ask your administrator to grant you the following IAM roles on your project:

• BigLake Admin (roles/biglake.admin)
• Storage Admin (roles/storage.admin)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Management actions

You can perform the following management actions on your Apache Iceberg REST catalog resources using the Google Cloud console or the REST API:

• Create a catalog: Create an Apache Iceberg REST catalog management endpoint pointing to underlying Cloud Storage warehouse locations (CreateIcebergCatalog).
• Update a catalog: Upgrade an existing Cloud Storage bucket catalog (legacy gs:// catalog) to a BigLake catalog (bl:// catalog) (UpdateIcebergCatalog).
• Create a namespace: Create a namespace within an Iceberg REST catalog to group related tables (CreateIcebergNamespace).
• Enable credential vending: Switch an existing catalog's authentication method to credential vending mode to vend short-lived storage tokens directly to query engines (UpdateIcebergCatalog).
• Get catalog details: View properties and metadata for your catalog, including the REST catalog URI required for client connections (GetIcebergCatalog).
• Manage namespace ACLs: View and update IAM policies on your catalog namespaces to control access for specific principals (get-iam-policy, set-iam-policy).
• Delete a catalog: Unregister a catalog metadata management endpoint from the Lakehouse runtime catalog (DeleteIcebergCatalog).
• Delete a namespace: Delete a namespace from your Iceberg REST catalog when it is no longer needed (DeleteIcebergNamespace).
• View audit logs: Inspect Cloud Audit Logs for verifiable records of administrative and data access activities.

Pricing

For pricing details, see Lakehouse for Apache Iceberg pricing.

What's next

• Learn how to manage namespace ACLs.
• Learn more about the Apache Iceberg REST catalog endpoint.