OSS Tables is compatible with the Apache Iceberg REST Catalog protocol. You can use the Iceberg Sink Connector for Kafka Connect to write Kafka messages to tables in OSS Tables in real time, enabling stream data ingestion.
Step 1: Prepare the environment
Download dependency JAR packages
Place the following JAR packages in the Kafka Connect plug-in directory, which is the path specified by plugin.path.
JAR package | Version requirement | Description |
Matches the Apache Iceberg version | Provides the S3FileIO implementation and the AWS SDK required for REST Catalog SigV4 signing authentication. | |
Matches the Apache Iceberg version | Provides the SigV4 signing and S3FileIO implementation. The version must be consistent with the | |
Matches the Apache Iceberg version | Supports writing data in the Parquet file format. | |
3.3.6 | A Hadoop runtime dependency required for internal loading by Apache Iceberg. You can adjust the version as needed. | |
3.3.6 | A Hadoop API dependency required for internal loading by Apache Iceberg. You can adjust the version as needed. | |
3.3.2 | This dependency is required by the Apache Iceberg SnapshotProducer at runtime. If this package is missing, a |
Step 2: Create a Table Bucket
Before you can write data, create a Table Bucket and a namespace. You can use ossutil or the AWS Command Line Interface (CLI) to create them.
Method 1: Use ossutil
1. Install or update ossutil
Install ossutil version 2.3.0 or later. If you have already installed ossutil, run the following command to update it to the latest version:
ossutil update -f2. Configure credentials
Run the ossutil config command and enter the AccessKey ID, AccessKey Secret, and region as prompted.
3. Create a Table Bucket
ossutil tables-api create-table-bucket --name {table_bucket_name} --endpoint http://{endpoint} --region {region}After the command runs successfully, the output includes the Table Bucket ARN. Record this value.
4. Create a namespace
ossutil tables-api create-namespace --table-bucket-arn {table_bucket_arn} --namespace {namespace_name} --endpoint http://{endpoint}Use underscores (_) instead of hyphens (-) in namespace and table names because the names are used as SQL identifiers.
5. Create a table
You can create an Apache Iceberg table by using one of the following methods:
Create the table by using another compute engine, such as Spark.
Create the table by using ossutil. First, save the table schema to a JSON file, and then call
create-table.In the following example, the schema file
schema.jsondefines 3 fields:{ "iceberg": { "schema": { "fields": [ {"name": "event_id", "type": "string", "required": true}, {"name": "event_time", "type": "string"}, {"name": "event_type", "type": "string"} ] } } }Create a table based on the schema file:
ossutil tables-api create-table --table-bucket-arn {table_bucket_arn} --namespace {namespace_name} --name {table_name} --format ICEBERG --metadata file://schema.json --endpoint http://{endpoint}
Method 2: Use the AWS CLI
OSS Tables is compatible with the S3 Tables API. You can also use the AWS CLI to manage a Table Bucket.
1. Install the AWS CLI
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install2. Configure credentials
Run the aws configure command and enter the AccessKey ID, AccessKey Secret, and region as prompted.
3. Create a Table Bucket
aws s3tables --endpoint http://{endpoint} create-table-bucket --region {region} --name {table_bucket_name}After the command runs successfully, the output includes the Table Bucket ARN.
4. Create a namespace
aws s3tables --endpoint http://{endpoint} create-namespace --table-bucket-arn {table_bucket_arn} --namespace {namespace_name}5. Create a table
Create the table by using another compute engine, such as Spark.
To create the table by using the AWS CLI, first save the input parameters to a JSON file, such as
create-table.json, and then callcreate-table.{ "tableBucketARN": "{table_bucket_arn}", "namespace": "{namespace_name}", "name": "{table_name}", "format": "ICEBERG", "metadata": { "iceberg": { "schema": { "fields": [ {"name": "event_id", "type": "string", "required": true}, {"name": "event_time", "type": "string"}, {"name": "event_type", "type": "string"} ] } } } }aws s3tables --endpoint http://{endpoint} create-table --cli-input-json file://{file_path}
6. Manage background maintenance jobs
OSS Tables supports automatic background maintenance for Apache Iceberg tables, such as file cleanup and small file compaction. You can use the AWS CLI to query and configure these maintenance jobs.
Query the status of a table maintenance job:
aws s3tables get-table-maintenance-job-status \
--table-bucket-arn="{table_bucket_arn}" \
--namespace="{namespace_name}" \
--name="{table_name}" Configure a bucket-level maintenance policy (file cleanup):
aws s3tables put-table-bucket-maintenance-configuration \
--table-bucket-arn {table_bucket_arn} \
--type icebergUnreferencedFileRemoval \
--value '{"status":"enabled","settings":{"icebergUnreferencedFileRemoval":{"unreferencedDays":4,"nonCurrentDays":10}}}' Configure a table-level maintenance policy (small file compaction):
aws s3tables put-table-maintenance-configuration \
--table-bucket-arn {table_bucket_arn} \
--type icebergCompaction \
--namespace {namespace_name} \
--name {table_name} \
--value='{"status":"enabled","settings":{"icebergCompaction":{"targetFileSizeMB":256}}}'Step 3: Configure Kafka Connect
OSS Tables provides an Apache Iceberg REST Catalog endpoint. Kafka Connect uses the Iceberg Sink Connector to connect to this endpoint and write data. The endpoints are:
Internal network:
https://{region}-internal.oss-tables.aliyuncs.com/icebergPublic network:
https://{region}.oss-tables.aliyuncs.com/iceberg
OSS Tables provides an S3FileIO access endpoint for the OSS data plane, which the Iceberg Sink Connector uses to access table data. The endpoints are:
Internal network:
https://oss-{region}-internal.aliyuncs.comPublic network:
https://oss-{region}.aliyuncs.com
Connector configuration
When you create an Iceberg Sink Connector, specify the connector class as org.apache.iceberg.connect.IcebergSinkConnector and configure the following properties:
# --- Iceberg Catalog (REST) ---
iceberg.catalog.type: rest
iceberg.catalog.uri: https://{region}-internal.oss-tables.aliyuncs.com/iceberg
iceberg.catalog.rest.sigv4-enabled: true
iceberg.catalog.rest.signing-region: {region}
iceberg.catalog.warehouse: {table_bucket_arn}
iceberg.catalog.rest.signing-name: osstables
iceberg.catalog.rest.access-key-id: {access_key_id}
iceberg.catalog.rest.secret-access-key: {access_key_secret}
# --- Force S3FileIO (catalog returns oss:// but storage is S3-compatible) ---
iceberg.catalog.io-impl: org.apache.iceberg.aws.s3.S3FileIO
# --- S3FileIO storage configuration ---
iceberg.catalog.s3.endpoint: https://oss-{region}-internal.aliyuncs.com
iceberg.catalog.s3.access-key-id: {access_key_id}
iceberg.catalog.s3.secret-access-key: {access_key_secret}
iceberg.catalog.s3.path-style-access: true
iceberg.catalog.client.region: {region}
# --- Data format conversion ---
key.converter: org.apache.kafka.connect.json.JsonConverter
key.converter.schemas.enable: false
value.converter: org.apache.kafka.connect.json.JsonConverter
value.converter.schemas.enable: falseIf you use AWS SDK version 2.20 or later, you might encounter the following signing error: aws-chunked encoding is not supported with the specified x-amz-content-sha256 value. To resolve this issue, add the following JVM options to the Java startup parameters for Kafka Connect:
-Daws.requestChecksumCalculation=when_required
-Daws.responseChecksumValidation=when_requiredParameters
Parameter | Required | Description |
| Yes | Specifies the catalog type. Set to |
| Yes | The REST Catalog endpoint URL.
|
| Yes | The Table Bucket ARN. Format: |
| Yes | Set this to |
| Yes | The SigV4 signing service name for the OSS Tables endpoint. Set this to |
| Yes | Set this to |
| Yes | The OSS data plane endpoint.
|
| Yes | Set this to |
Permissions
If you use a RAM user or an STS temporary credential to access OSS Tables, ensure that the identity has the required permissions.
Resource definitions
Table Bucket ARN:
acs:osstables:{region}:{alibaba_cloud_account_id}:bucket/{table_bucket_name}Table ARN:
acs:osstables:{region}:{alibaba_cloud_account_id}:bucket/{table_bucket_name}/table/{table_id}
Action definitions
The following table lists the OSS Tables actions and indicates which ones support cross-account authorization.
Category | Action | Cross-account access |
Table Bucket-level |
| Not allowed |
| Allowed | |
| Not allowed | |
| Allowed | |
| Allowed | |
| Allowed | |
| Allowed | |
| Allowed | |
| Not allowed | |
| Not allowed | |
| Not allowed | |
| Allowed | |
| Allowed | |
| Not allowed | |
| Not allowed | |
| Not allowed | |
Table-level |
| Allowed |
| Allowed | |
| Not allowed | |
| Not allowed | |
| Not allowed | |
| Allowed | |
| Allowed | |
| Allowed | |
| Allowed | |
| Allowed | |
| Allowed | |
| Allowed | |
| Allowed | |
| Not allowed | |
| Not allowed | |
| Allowed |
Permission mapping for REST operations
The following table lists the required OSS actions for each Iceberg REST Catalog operation.
Iceberg REST operation | Required OSS action |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|