Iceberg Is Open. Your Security Model Isn't

An auditor asked who could read the customer table. With three engines on one Iceberg catalog, nobody could answer.

Iceberg’s openness is the point: one table, many engines, no vendor gate. Spark for pipelines, Trino for ad hoc, DuckDB on a laptop.

Each engine, though, enforces access its own way. Grants you set in one don’t exist in another. And under all of it sits object storage: anyone with bucket access can read the data files directly, past every table-level permission you configured.

At audit time this surfaces as one question with no owner: who can read this table? The honest answer is a union across engines plus raw bucket policies, and almost nobody has it written down.

The pattern that holds up: move authorization into the catalog. A REST catalog with credential vending hands out short-lived, scoped storage credentials per request. Engines stop needing standing bucket access. Deny direct reads on the bucket, and the catalog becomes the single enforcement and audit point.

Openness stays. The security model catches up with it.

Could you answer “who can read this table?” across every engine you run today?