As of April 20th, 2026, BigLake is now called Lakehouse. BigLake metastore is now called the Lakehouse runtime catalog. Lakehouse APIs, client libraries, CLI commands, and IAM names remain unchanged and still reference BigLake.

Table management and security rules

When creating and managing tables in the Apache Iceberg REST catalog endpoint, the following location, permission, and security hardening rules apply:

Table location

Table paths must be nested within the parent namespace path (for example, gs://{namespace_path}/.../{table_name}). This constraint is enforced to help with security and catalog hardening.

Behavior change for table paths: Note that the resulting table location (under which the metadata/ folder is created) automatically has a random string attached as a suffix to prevent conflicts and improve security:

  • If no specific location is provided, the resulting location is gs://{namespace_path}/{table_name}/{random_suffix}.
  • If a specific location is provided (for example, gs://{namespace_path}/.../{table_name}), the resulting location is gs://{namespace_path}/.../{table_name}/{random_suffix}.

Table registration permissions

Both multiple-bucket and single-bucket catalogs require the biglake.tables.register permission to register a table. This permission is restricted to the BigLake Admin (roles/biglake.admin) role to ensure only administrators can perform table registration.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026年08月26日 UTC.