REST Catalog Credential Vending for Lakehouse Security

This article details how credential vending enhances lakehouse security by replacing static storage access keys with short-lived, dynamically scoped tokens issued by the Iceberg REST catalog. It describes the flow where engines authenticate, request table metadata, and obtain temporary credentials scoped to specific storage paths. The article compares implementations across Apache Polaris, Snowflake Horizon, Databricks Unity Catalog, AWS Glue, Google Cloud Lakehouse, and Dremio, covering S3, ADLS, and GCS details. It also discusses credential lifetime, rotation, security boundaries, and common mistakes, making it a technical guide for multi-engine lakehouse architectures.