@Rocky does starrocks 3.5.16 support iam roles instead of iam users keys and passes for creating external catalogs in shared architechture?

Yes, StarRocks 3.5.16 supports using AWS IAM roles (both Instance Profiles and Assumed Roles) instead of static IAM user access keys/secret keys for creating external catalogs in a shared-data (shared architecture) cluster. In StarRocks 3.x, the authentication mechanism for external catalogs is decoupled from the cluster architecture (Shared-Nothing vs. Shared-Data). The compute nodes (CN) in a shared-data cluster can use IAM roles to access both the internal storage and external data lake resources. Supported IAM Role Methods You can use two primary role-based methods to avoid using access keys: 1. Instance Profile-based Authentication This uses the IAM role already attached to the EC2 instances or EKS pods where StarRocks is running.

sql
CREATE EXTERNAL CATALOG hive_catalog
PROPERTIES (
    "type" = "hive",
    "aws.s3.use_instance_profile" = "true",
    "aws.s3.region" = "us-west-2",
    "hive.metastore.uris" = "thrift://<metastore_ip>:9083"
);

2. Assumed Role-based Authentication This allows the cluster to assume a specific IAM role (cross-account or restricted role) using its own instance profile.

sql
CREATE EXTERNAL CATALOG iceberg_catalog
PROPERTIES (
    "type" = "iceberg",
    "aws.s3.use_instance_profile" = "true",
    "aws.s3.iam_role_arn" = "arn:aws:iam::123456789012:role/target_s3_role",
    "aws.s3.region" = "us-west-2",
    "iceberg.catalog.type" = "glue",
    "aws.glue.use_instance_profile" = "true",
    "aws.glue.iam_role_arn" = "arn:aws:iam::123456789012:role/target_glue_role"
);

Key Considerations for Shared-Data Architecture * Uniformity: In shared-data clusters, the properties defined in the

CREATE EXTERNAL CATALOG

command are used by both the Frontends (FE) for metadata discovery and the Compute Nodes (CN) for data scanning. * EKS/K8s: If you are running on EKS, ensure your CN/FE pods are configured with IRSA (IAM Roles for Service Accounts) so that

aws.s3.use_instance_profile

correctly maps to the OIDC-provided credentials. * Version Note: While 3.5.16 includes various stability and performance improvements (like those for

WarehouseManager

and Routine Load), IAM role support for catalogs has been a stable feature since StarRocks 2.5 and 3.0. References • table_design/data_distribution/Data_distribution.md • faq/Sql_faq.md • deployment/shared_data/feature-support-shared-data.md • loading/loading_introduction/troubleshooting_loading.md