Access control restricts data and operations to authorized users, roles, or services. In an Iceberg lakehouse, effective governance depends on coordination among storage, catalogs, and query engines rather than a single permission layer. section 5.1.2 section 7.6
Apply permissions across complementary layers:
- Storage restricts reads and writes through bucket, prefix, filesystem, or host-level permissions, while encryption and access logging protect and audit the underlying data. section 5.1.2
- Catalogs centralize identities, namespaces, tables, and operations; they can integrate with IAM, LDAP, OAuth, SAML, or SSO and apply RBAC or ABAC. section 7.2.2 section 7.2.3
- Query engines typically enforce row-level and column-level policies at query time, so catalog policy definitions require compatible engine enforcement. section 4.3.3 section 8.4.1
- Credential vending limits clients to short-lived, scoped storage credentials for an authorized query or job, reducing exposure to long-lived access keys. section 7.2.2 section 7.6
Restricting shared analytics data
A healthcare analytics firm can combine granular storage policies, encryption, identity-provider integration, and retained audit trails for patient records. In a multibrand media organization, a federation layer can apply brand-specific policies while shared Iceberg tables and BI tools remain available. section 5.5.2 section 9.5.4
Figure 7.6 Catalogs can have different levels of access control, allowing you to control who has access to which namespaces or tables.
Use the access-control diagram to compare permissions applied to namespaces and tables within a catalog. section 7.2.2
