S3 Tables is the AWS-managed variant of the Iceberg sink. Tables live in an S3 Tables table bucket, which AWS maintains for you — automatic compaction and garbage collection, native integration with the AWS console and query engines. It is selected as the S3 Tables catalog in the destination wizard.
Prerequisites
- An existing S3 Tables table bucket, referenced by its ARN:
arn:aws:s3tables:<region>:<account>:bucket/<name>. - The AWS region hosting it. It drives both the service endpoint and request signing.
- Credentials with the S3 Tables IAM namespace (
s3tables:*) — for examples3tables:GetTableBucket,s3tables:ListNamespaces,s3tables:CreateNamespace,s3tables:CreateTable, ands3tables:PutTableData. A role scoped only tos3:*orglue:*will not work. Credentials may also be left blank to use the default AWS chain. - Network egress to
https://s3tables.<region>.amazonaws.com.
Connection fields
| Field | Required | Default | Notes |
|---|---|---|---|
| Name | Yes | — | Destination label. |
| Catalog name | Yes | iceberg | |
| Table bucket ARN | Yes on create | — | The ARN, not a bucket name or path. |
| Region | No | us-east-1 | Drives the endpoint and the signing region. |
| Access key ID | No | — | Blank uses the default AWS credential chain. |
| Secret access key | No | — | Blank uses the default chain; blank on edit keeps the stored secret. |
How it differs
S3 Tables owns its data plane
There is no bucket, endpoint, or object-store credential to configure — the wizard skips the storage step entirely, and those fields are stripped from the saved destination. AWS manages object placement and vends its own scoped credentials.
- Writes go through a SigV4-signed REST catalog addressed by the table bucket ARN.
- Upstream of the catalog, everything is identical to the standard Iceberg sink: snapshot modes, chunking, commit interval, additive schema evolution, and table-creation properties.
- Test connection lists namespaces through the catalog rather than writing a probe object, since S3 Tables only accepts writes as table-scoped commits. A failure is reported against the ARN field.
Gotchas
Watch out
- Pass the ARN, not a bucket name or path — this is the most common mistake, since every other Iceberg catalog takes a name or path.
- The IAM namespace is
s3tables:*. A policy scoped tos3:*returns an opaque access-denied error rather than a helpful one. - Dropping a table requires a purge; Fabric requests it, so a reset cleans up correctly.