apache/iceberg · error · ForbiddenException

Cannot commit %s because Glue cannot access the requested re

Error message

Cannot commit %s because Glue cannot access the requested resources

What it means

ForbiddenException thrown by GlueTableOperations.handleAWSExceptions when the Glue API raises AccessDeniedException during a commit. The AWS credentials in use are not authorized to perform the required Glue operations (GetTable/UpdateTable/CreateTable) on the target database and table. Iceberg maps this to its ForbiddenException so callers can treat it as an authorization problem rather than a transient commit failure.

Source

Thrown at aws/src/main/java/org/apache/iceberg/aws/glue/GlueTableOperations.java:369

  }

  private void handleAWSExceptions(AwsServiceException persistFailure) {
    if (persistFailure instanceof ConcurrentModificationException) {
      throw new CommitFailedException(
          persistFailure, "Cannot commit %s because Glue detected concurrent update", tableName());
    } else if (persistFailure
        instanceof software.amazon.awssdk.services.glue.model.AlreadyExistsException) {
      throw new AlreadyExistsException(
          persistFailure,
          "Cannot commit %s because its Glue table already exists when trying to create one",
          tableName());
    } else if (persistFailure instanceof EntityNotFoundException) {
      throw new NotFoundException(
          persistFailure,
          "Cannot commit %s because Glue cannot find the requested entity",
          tableName());
    } else if (persistFailure instanceof AccessDeniedException) {
      throw new ForbiddenException(
          persistFailure,
          "Cannot commit %s because Glue cannot access the requested resources",
          tableName());
    } else if (persistFailure
        instanceof software.amazon.awssdk.services.glue.model.ValidationException) {
      throw new ValidationException(
          persistFailure,
          "Cannot commit %s because Glue encountered a validation exception "
              + "while accessing requested resources",
          tableName());
    } else {
      int statusCode = persistFailure.statusCode();
      if (statusCode < 500 || statusCode >= 600) {
        throw persistFailure;
      }
    }
  }

View on GitHub (pinned to 86d9c8fc54)

Solutions

1. Grant the executing principal IAM permissions glue:GetTable, glue:UpdateTable, glue:CreateTable on the relevant databases/tables.
2. If Lake Formation is enabled, grant the principal LF permissions (DESCRIBE, INSERT/ALTER as needed) on the table.
3. Verify the configured credentials/role belong to the same account and region as the Glue catalog.
4. Check for SCPs, permission boundaries, or VPC endpoint policies denying glue API calls.

Example fix

// before
// job role policy grants only glue:GetDatabase -> AccessDeniedException on commit
// after
{
  "Effect": "Allow",
  "Action": ["glue:GetTable", "glue:UpdateTable", "glue:CreateTable"],
  "Resource": "arn:aws:glue:*:<account>:table/<db>/*"
}

// dry-run IAM check before running jobs
aws glue get-table --database-name <db> --name <table>
aws sts get-caller-identity  # confirm principal/account

try {
  table.append(df);
} catch (ForbiddenException e) {
  // do not retry; surface IAM/Lake Formation configuration problem
  throw new IllegalStateException("Insufficient Glue permissions, check IAM/LF grants", e);
}

When it happens

Trigger: doCommit → persistGlueTable Glue calls rejected by IAM/lake-formation policy: missing glue:GetTable, glue:UpdateTable, glue:CreateTable permissions, or Lake Formation not granting the principal on the table.

Common situations: EC2 task role or IRSA service account lacking glue:UpdateTable permission; Lake Formation permissions never granted to the job's principal; SCP or resource-based policy restricting the Glue calls; credentials from a different account than the Glue catalog.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Cannot commit %s due to unexpected exception
• Fail to acquire lock %s to commit new metadata at %s
• Cannot commit %s because base metadata location '%s' is not
• Cannot commit %s because Glue detected concurrent update
• Cannot commit %s because Glue cannot find the requested enti

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/09d73ed8a8b51123. Report an issue: GitHub.