This topic describes how to access OSS Tables from Flink by using Iceberg REST Catalog, which is compatible with the standard Iceberg REST protocol and requires no additional deployment. You can use Flink SQL to create tables, write data, and run queries for streaming or batch data lake ingestion.
Step 1: Prepare the environment
Download dependency JARs
Place the following dependency JARs in the $FLINK_HOME/lib directory of your Flink installation, or specify them with the -C parameter when submitting a job.
|
JAR |
Version |
Description |
|
Must match the Iceberg version. |
The Flink runtime integration package for Iceberg. Select the package that matches your Flink version. For example, use |
|
|
Must match the Iceberg version. |
Provides the S3FileIO implementation and the AWS SDK required for SigV4 signature authentication for the REST catalog. The version must match the runtime package. |
|
|
3.3.6 |
Hadoop API dependency (required for internal Iceberg loading). You can adjust the version as needed. |
|
|
3.3.6 |
Hadoop runtime dependency (required for internal Iceberg loading). You can adjust the version as needed. |
Configure access credentials
Configure environment variables
The Iceberg REST catalog uses SigV4 signature authentication, and S3FileIO also requires credentials to access the data plane. Before starting Flink, provide these credentials by setting the following environment variables:
The environment variable names use the AWS_ prefix because Iceberg's SigV4 signature module and S3FileIO reuse the AWS SDK's standard credential providers. You must provide the AccessKey ID and AccessKey Secret of your Alibaba Cloud account.
export AWS_ACCESS_KEY_ID=<your_alibaba_cloud_accesskey_id>
export AWS_SECRET_ACCESS_KEY=<your_alibaba_cloud_accesskey_secret>
export AWS_REGION=<region, for example, cn-hangzhou>
export AWS_DEFAULT_REGION=<region, for example, cn-hangzhou>
# Optional. Set this variable when using STS temporary credentials.
export AWS_SESSION_TOKEN=<your_alibaba_cloud_sts_token>
# Disable STREAMING-UNSIGNED-PAYLOAD-TRAILER chunked upload encoding, which is not supported by OSS.
export AWS_REQUEST_CHECKSUM_CALCULATION=WHEN_REQUIRED
If you use AWS SDK 2.20 or later, you might encounter a signature error when writing data: aws-chunked encoding is not supported with the specified x-amz-content-sha256 value. To resolve this, add the following JVM parameters to the Flink configuration file conf/config.yaml:
env.java.opts.all: "-Daws.requestChecksumCalculation=when_required -Daws.responseChecksumValidation=when_required"
Pass credentials in catalog properties
In addition to using environment variables, you can explicitly pass credentials in catalog properties. This method is suitable for multi-catalog scenarios or environments in which you cannot inject the same environment variables into all Flink processes. Add the following properties to the WITH clause of the catalog creation statement in Step 3:
-- Credentials for REST Catalog SigV4 signing
'rest.access-key-id' = '<your_alibaba_cloud_accesskey_id>',
'rest.secret-access-key' = '<your_alibaba_cloud_accesskey_secret>',
-- Optional. Set this property when using STS temporary credentials.
'rest.session-token' = '<your_alibaba_cloud_sts_token>',
-- Credentials for the S3FileIO data plane
's3.access-key-id' = '<your_alibaba_cloud_accesskey_id>',
's3.secret-access-key' = '<your_alibaba_cloud_accesskey_secret>',
'client.region' = '<region, for example, cn-hangzhou>',
-- Optional. Set this property when using STS temporary credentials.
's3.session-token' = '<your_alibaba_cloud_sts_token>'
These properties pass only credentials. If you do not set the AWS_REQUEST_CHECKSUM_CALCULATION environment variable, add the JVM parameters described earlier to conf/config.yaml by using env.java.opts.all to disable chunked upload encoding.
Step 2: Create a table bucket
Before writing data, you must create a table bucket and a namespace. You can use ossutil or the AWS CLI.
Method 1: Use ossutil
1. Install or upgrade ossutil
Install ossutil version 2.3.0 or later. If you have an older version installed, run the following command to upgrade it:
ossutil update -f
2. Configure credentials
Run the ossutil config command and, when prompted, enter your AccessKey ID, AccessKey Secret, and region.
3. Create a table bucket
ossutil tables-api create-table-bucket --name {table_bucket_name} --endpoint http://{endpoint} --region {region}
After the command succeeds, the command output contains the table bucket ARN. Record this value for later use.
4. Create a namespace
ossutil tables-api create-namespace --table-bucket-arn {table_bucket_arn} --namespace {namespace_name} --endpoint http://{endpoint}
namespace and table names cannot contain hyphens (-). Use underscores (_) instead, because these names are used as identifiers in SQL statements.
5. Create a table
You can create an Iceberg table in either of the following ways:
-
Use another compute engine, such as Spark, to create the table.
-
Use ossutil to create the table. First, save the table schema to a JSON file, and then call
create-table.The following example shows a schema file named
schema.jsonthat defines three fields:{ "iceberg": { "schema": { "fields": [ {"name": "event_id", "type": "string", "required": true}, {"name": "event_time", "type": "string"}, {"name": "event_type", "type": "string"} ] } } }Create a table based on the schema file:
ossutil tables-api create-table --table-bucket-arn {bucket_arn} --namespace {namespace_name} --name {table_name} --format ICEBERG --metadata file://{file_path} --endpoint http://{endpoint}
Method 2: Use the AWS CLI
OSS Tables is compatible with the S3 Tables API, so you can also use the AWS CLI to manage a table bucket.
1. Install the AWS CLI
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
2. Configure credentials
Run the aws configure command and enter your AccessKey ID, AccessKey Secret, and region as prompted.
3. Create a table bucket
aws s3tables --endpoint http://{endpoint} create-table-bucket --region {region} --name {table_bucket_name}
After the command succeeds, the output contains the table bucket ARN.
4. Create a namespace
aws s3tables --endpoint http://{endpoint} create-namespace --table-bucket-arn {table_bucket_arn} --namespace {namespace_name}
5. Create a table
-
Create the table with another compute engine, such as Spark.
-
To create the table with the AWS CLI, first save the full input parameters to a JSON file named
create-table.json, and then callcreate-table.{ "tableBucketARN": "{bucket_arn}", "namespace": "{namespace_name}", "name": "{table_name}", "format": "ICEBERG", "metadata": { "iceberg": { "schema": { "fields": [ {"name": "event_id", "type": "string","required": true}, {"name": "event_time", "type": "string"}, {"name": "event_type", "type": "string"} ] } } } }aws s3tables --endpoint http://{endpoint} create-table --cli-input-json file://{file_path}
6. Manage background maintenance jobs
OSS Tables supports automatic background maintenance for Iceberg tables, such as file cleanup and file compaction. You can use the AWS CLI to query and configure these maintenance jobs.
Query the status of a table maintenance job:
aws s3tables get-table-maintenance-job-status \
--table-bucket-arn="{bucket_arn}" \
--namespace="{namespace_name}" \
--name="{table_name}"
Configure a bucket-level maintenance policy (file cleanup):
aws s3tables put-table-bucket-maintenance-configuration \
--table-bucket-arn {table_arn} \
--type icebergUnreferencedFileRemoval \
--value '{"status":"enabled","settings":{"icebergUnreferencedFileRemoval":{"unreferencedDays":4,"nonCurrentDays":10}}}'
Configure a table-level maintenance policy (file compaction):
aws s3tables put-table-maintenance-configuration \
--table-bucket-arn {bucket_arn} \
--type icebergCompaction \
--namespace {namespace_name} \
--name {table_name} \
--value='{"status":"enabled","settings":{"icebergCompaction":{"targetFileSizeMB":256}}}'
Step 3: Configure Flink
Configure Flink process parameters
The following settings in flink-conf.yaml are optional and explicitly specify the region and credential provider for S3FileIO. You can omit them if you configured the environment variables in Step 1, including AWS_REGION.
|
Parameter |
Required |
Description |
|
|
No |
The region used by S3FileIO. Example: |
|
|
No |
The credential provider. Set this to |
|
|
No |
The region used by the Hadoop S3A file system. Example: |
Use Iceberg REST Catalog
OSS Tables provides an Iceberg REST catalog endpoint. Flink connects to this endpoint using the RESTCatalog implementation in the Iceberg Connector. The endpoint formats are as follows:
-
Internal network:
https://{region}-internal.oss-tables.aliyuncs.com/iceberg -
Public network:
https://{region}.oss-tables.aliyuncs.com/iceberg
OSS Tables provides an S3FileIO endpoint for accessing the OSS data plane. Flink uses this endpoint to access table data. The endpoint formats are as follows:
-
Internal network:
https://oss-{region}-internal.aliyuncs.com -
Public network:
https://oss-{region}.aliyuncs.com
Create a catalog
Run the following statement in Flink SQL to create a catalog:
CREATE CATALOG mycatalog WITH (
'type' = 'iceberg',
'catalog-impl' = 'org.apache.iceberg.rest.RESTCatalog',
'io-impl' = 'org.apache.iceberg.aws.s3.S3FileIO',
'uri' = 'https://{region}-internal.oss-tables.aliyuncs.com/iceberg',
'warehouse' = '<table_bucket_arn>',
'rest.sigv4-enabled' = 'true',
'rest.signing-name' = 'osstables',
'rest.signing-region' = '<region>',
's3.endpoint' = 'https://oss-{region}-internal.aliyuncs.com',
's3.path-style-access' = 'false'
);
Configuration parameters
|
Parameter |
Required |
Description |
|
|
Yes |
Set this to |
|
|
Yes |
Set this to |
|
|
Yes |
Set this to |
|
|
Yes |
The REST catalog endpoint URL. Format:
|
|
|
Yes |
The table bucket ARN. Format: |
|
|
Yes |
Set this to |
|
|
Yes |
Set this to |
|
|
Yes |
The SigV4 signing region. Example: |
|
|
Yes |
The OSS data plane endpoint. Format:
|
|
|
No |
Specifies whether to use path-style access. The default value is |
Create a table
CREATE TABLE IF NOT EXISTS mycatalog.<namespace>.<table_name> (
event_id STRING,
event_time STRING,
event_type STRING
) WITH (
'format-version' = '2',
'write.format.default' = 'parquet',
'write.target-file-size-bytes' = '33554432', -- 32 MB (not 128 MB)
'write.parquet.row-group-size-bytes' = '8388608' -- 8 MB
);
We recommend setting write.target-file-size-bytes to 32 MB (33554432). This helps prevent large files from slowing down maintenance jobs.
Step 4: Write and query data
After you create the table, run the following statements in the Flink SQL Client in sequence. Successful table creation verifies the metadata path. Successful insertion and query results verify the data path. Use table.dml-sync to wait for the insert job to finish before running the query. This is useful for non-interactive validation that uses an SQL file.
Insert test data
SET 'table.dml-sync' = 'true';
SET 'sql-client.execution.result-mode' = 'TABLEAU';
INSERT INTO mycatalog.<namespace>.<table_name> VALUES
('evt-001', '2026-07-28 10:00:00', 'click'),
('evt-002', '2026-07-28 10:01:00', 'view');
Query and verify the results
-- Switch to batch execution mode. In streaming mode, ORDER BY on a non-time attribute returns an error.
SET 'execution.runtime-mode' = 'batch';
SELECT event_id, event_time, event_type
FROM mycatalog.<namespace>.<table_name>
ORDER BY event_id;
The query result must contain the evt-001 and evt-002 records. If table creation succeeds but insertion or querying fails, first check the S3FileIO endpoint, credentials, and data-plane permissions.
Permissions
When accessing OSS Tables with a RAM user or STS temporary credentials, ensure the identity has the required permissions.
Resource definitions
-
table bucket ARN:
acs:osstables:<region>:<alibaba_cloud_account_id>:bucket/<table_bucket_name> -
table ARN:
acs:osstables:<region>:<alibaba_cloud_account_id>:bucket/<table_bucket_name>/table/<table_id>
Action definitions
The following table lists the actions supported by OSS Tables and indicates whether cross-account access is supported for each action.
|
Category |
Action |
Cross-account access |
|
Table bucket level |
|
Not allowed |
|
|
Allowed |
|
|
|
Not allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Not allowed |
|
|
|
Not allowed |
|
|
|
Not allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Not allowed |
|
|
|
Not allowed |
|
|
|
Not allowed |
|
|
Table level |
|
Allowed |
|
|
Allowed |
|
|
|
Not allowed |
|
|
|
Not allowed |
|
|
|
Not allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Allowed |
|
|
|
Not allowed |
|
|
|
Not allowed |
|
|
|
Allowed |
Iceberg REST operation and permission mapping
The following table maps Iceberg REST Catalog operations to the required OSS actions.
|
Iceberg REST operation |
Required OSS action |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|