Create a catalog

Creating a catalog endpoint (such as an Apache Iceberg REST catalog endpoint or Apache Hive catalog endpoint) establishes a management endpoint within the Lakehouse runtime catalog.

This endpoint points to an underlying Cloud Storage bucket, providing a metadata layer that lets query engines and open-source workloads interact directly with your tables.

When creating your catalog endpoint for Lakehouse for Apache Iceberg, you can choose between end-user credentials or credential vending mode for storage access delegation.

Before you begin

1. Read About the Lakehouse runtime catalog to understand how the Lakehouse runtime catalog works and the limitations for the service.
Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake API.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the API

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake API.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the API

Required roles

To get the permissions that you need to create a catalog and register tables, ask your administrator to grant you the following IAM roles:

• Create a catalog:
  • BigLake Admin (roles/biglake.admin) on your project
  • Storage Admin (roles/storage.admin) on your project
• Create (register) tables: BigLake Admin (roles/biglake.admin) on your project. Registering tables in a multiple-bucket catalog requires the specific table registration permission (biglake.tables.register), which is included in the BigLake Admin role.
• Use the auto-provisioned catalog service account in credential vending mode: Storage Object User (roles/storage.objectUser) on the target Cloud Storage buckets. After creating the catalog, explicitly grant the Storage Object User role (roles/storage.objectUser) on your storage buckets to the auto-provisioned service account.

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Create a catalog

Create a catalog.

Create a catalog

Follow these steps to create a catalog based on your preferred credential mode and bucket type. For more information about the different catalog types, see About the Apache Iceberg REST catalog endpoint.