Dear Starburst Galaxy/Trino Community:
I created an iceberg table from an external engine. This iceberg table is stored in a azure account (adls). I’ve set up the azure catalog, the cluster, and am now using the schema discovery feature to register my iceberg table. However, the iceberg registration always fails with permission issues.
There are two sql commands being called once you identify the tables in your azure path:
Query 1)
CREATE SCHEMA IF NOT EXISTS "<catalog-name>"."<schema-discovery-name>" WITH (location = abfs://<contianer>@<account>.dfs.core.windows.net/')
Error Message for 1)
Failed to create directory: abfs://<container>@<account>.dfs.core.windows.net/
- This is the correct container path to my tables i wish to register
Query 2)
CALL <catalog-name>.system.register_table(schema_name => <schema-discovery-name>, table_name => '<my-iceberg-table-name', table_location => abfss://<container>@<account>.dfs.core.windows.net/<my-iceberg-table-name>)
Error Message for 2)
Access Denied: Role accountadmin is not allowed to use location: 'abfss://<container>@<account>.dfs.core.windows.net/<my-iceberg-table-name>)
I’m most interested in learning about error message 2. I can move past error message 1
I have followed numerous steps provided by starburst galaxy. Including:
- Trying the ‘access key’ and the ‘application principal’ method for my catalog config (reference here: Starburst | External security in Azure).
- Changing the azure permissions on the container + table(s)
- I can create NEW iceberg tables from scratch, but ive yet to successfully READ an existing table stored in azure.
Please help! Thanks