@Rocky I have a Snowflake Horizon Iceberg catalog configuration. I can select data from tables but I cannot

show tables

. I get error mysql> show tables; ERROR 1064 (HY000): Failed to list views using REST Catalog ForbiddenException: Forbidden: Authorization failed. Horizon uses Snowflake RBAC and there is no "list" privilege. I tried granting all privileges on TABLES and VIEWS to my role but same error.

The issue you are encountering, specifically the error

Failed to list views using REST Catalog

and the message

ForbiddenException: Forbidden: Authorization failed. Horizon uses Snowflake RBAC and there is no "list" privilege

, is caused by a mismatch between how StarRocks probes for objects and what the Snowflake Horizon Iceberg REST endpoint currently supports or requires. 1. Missing Parent Privileges In Snowflake RBAC, there is no specific "LIST" privilege. To list objects (tables/views), your role must have

USAGE

privileges on the containing objects. Even if you have

ALL PRIVILEGES

on the tables themselves, listing will fail if the role cannot "reach" them. Ensure you have run:

sql
GRANT USAGE ON DATABASE <your_db> TO ROLE <your_role>;
GRANT USAGE ON SCHEMA <your_db>.<your_schema> TO ROLE <your_role>;

2. Role Scope in Catalog Configuration Snowflake Horizon requires a specific OAuth scope to correctly identify your role during REST API calls. Unlike standard Iceberg REST catalogs (like Polaris) which often use

PRINCIPAL_ROLE:ALL

, Snowflake Horizon typically requires: * Property:

"iceberg.catalog.oauth2.scope"

* Value:

'session:role:<YOUR_ROLE_NAME>'

If this property is missing or set to a generic scope, Snowflake may not properly authorize the

listTables

or

listViews

calls even if the underlying credentials are valid for data access. 3. StarRocks Probing for Views StarRocks (starting from v3.4) supports Iceberg views. When you run

SHOW TABLES

, StarRocks attempts to list both tables and views. * Known Limitation: Many Snowflake Horizon implementations do not yet fully support the

listViews

operation via the REST endpoint or return a

403 Forbidden

if views are not enabled/configured for that endpoint. * The Error: The error message you see specifically mentions "list views". StarRocks interprets a

403

or

405

from the REST endpoint as a fatal error for the

SHOW TABLES

command. Recommended Troubleshooting Steps 1. Check

USAGE

Privileges: Confirm the role used in the catalog has

USAGE

on the Database and Schema. 2. Verify Catalog Properties: Ensure your catalog creation statement includes the correct role scope and database name:

sql
    CREATE EXTERNAL CATALOG snowflake_horizon
    PROPERTIES (
        "type" = "iceberg",
        "iceberg.catalog.type" = "rest",
        "iceberg.catalog.uri" = "https://<org>-<account>.<http://snowflakecomputing.com/polaris/api/catalog|snowflakecomputing.com/polaris/api/catalog>",
        "iceberg.catalog.warehouse" = "<SNOWFLAKE_DATABASE_NAME>",
        "iceberg.catalog.oauth2.scope" = "session:role:<YOUR_ROLE>",
        "iceberg.catalog.oauth2.credential" = "<client_id>:<client_secret>",
        "iceberg.catalog.security" = "oauth2"
    );

3. Bypass Listing (Workaround): If you can select data but

SHOW TABLES

remains broken due to the view-listing error, you can still query tables directly by using the fully qualified name:

sql
    SELECT * FROM snowflake_horizon.<schema>.<table>;

You can also use

DESC <table>

or query StarRocks

information_schema.tables

which may have different error-handling behavior. If the issue persists, check if your StarRocks version is 3.4.0 or higher, as these versions introduced more aggressive view probing. If you are on a very recent version, this might be a compatibility issue with Snowflake's specific REST error responses that needs to be addressed in a StarRocks patch. References • data_source/catalog/iceberg/iceberg_catalog.md • data_source/catalog/iceberg/iceberg_rest_security.md