Hi Everyone, I'm encountering an issue with a cross-account Flink SQL setup and would appreciate some clarification on how

assume-role

is handled by the Iceberg catalog. Scenario 1. Account #1: Runs a Flink (1.19.1) job on an EKS cluster. 2. Account #2: Hosts Iceberg tables in an S3 bucket (

<s3://account-2-bucket-iceberg/dbstore1/>

) and manages metadata using the AWS Glue Catalog (

awsAccount2Id

). 3. Permissions: ◦ The Flink EKS pod in Account #1 has a Service Account configured with OIDC. ◦ This Service Account assumes a cross-account role (

arn:aws:iam::awsAccount2Id:role/cross-account-role

) in Account #2. 4. Verification: ◦ I have `exec`'d into the running Flink pod. ◦ From the pod, I can successfully use the AWS CLI to assume the cross-account role. ◦ After assuming the role, I can successfully list the Glue databases and tables in Account #2. ◦ This confirms the underlying EKS OIDC, IAM roles, and network access are all correctly configured. The Challenge In my Flink job, I first define the catalog for Account #2. 1. Create Catalog (Success) This SQL statement executes successfully, and the Flink logs confirm it:

2025-10-22 03:57:00,929 INFO ... - SQL statement executed successfully. sql=CREATE CATALOG \awsAccount2Id

...`` SQL

CREATE CATALOG `awsAccount2Id`
WITH (
  'type' = 'iceberg',
  'catalog-impl' = 'org.apache.iceberg.aws.glue.GlueCatalog',
  'io-impl' = 'org.apache.iceberg.aws.s3.S3FileIO',
  'warehouse' = '<s3://account-2-bucket-iceberg/dbstore1/>',
  'client.assume-role.arn' = 'arn:aws:iam::awsAccount2Id:role/cross-account-role',
  'glue.catalog-id' = 'awsAccount2Id',
  'client.region' = 'us-east-1',
  'client.credentials-provider' = 'software.amazon.awssdk.auth.credentials.WebIdentityTokenFileCredentialsProvider'
);

2. Select from Catalog (Failure) Immediately after the catalog is created, my Flink job executes the following

SELECT

query: SQL

SELECT 
....

FROM `awsAccount2Id`.`dbstore1`.table1
/*+ OPTIONS('streaming'='true', 'monitor-interval'='30s') */;

This query fails with a validation error:

2025-10-22 03:57:06,710 ERROR ... - Failed to execute SQL statement:
SELECT ...
FROM `awsAccount2Id`.`dbstore1`.table1 ...
;
org.apache.flink.table.api.ValidationException: SQL validation failed. From line 11, column 6 to line 11, column 59: Object 'dbstore1' not found within 'awsAccount2Id'

I also noticed that when Flink logs the list of available databases, it only shows databases from Account #1, not the cross-account ones from Account #2. My Question My expectation was that by defining

client.assume-role.arn

and

glue.catalog-id

in the

CREATE CATALOG

statement, any subsequent Flink SQL operations referencing the

awsAccount2Id

catalog (like my

SELECT

query) would automatically use those settings to assume the role and query the Glue catalog in Account #2. Why is Flink reporting that the database

dbstore1

is "not found," even though the catalog was created successfully and configured to assume a role that can see that database? i can see tables from this database when i manually assume-role using aws-cli from that pod. It seems the

SELECT

query is not honoring the catalog's

assume-role

configuration and is somehow still querying the default Glue catalog in Account #1. Is this expected, or am I missing a configuration step for Flink to correctly use the assumed role for metadata discovery after the catalog is created?