Skip to main content
Use the data in your AWS Glue Catalog in Wherobots. Connect it once from Data Catalogs, then read and write tables in Glue from your Wherobots Spark workloads. Wherobots connects to AWS Glue through a Cloud Connection, which is a reusable IAM role that Wherobots assumes in your AWS account. The Data Catalogs wizard provisions everything with AWS CloudFormation, so there’s no IAM policy or Spark configuration to write by hand.

Before you start

The following requirements must be met within both your Wherobots Organization and AWS account before you can connect to a Glue catalog.
  • A Wherobots account with the Admin role to create catalogs and Cloud Connections.
    Wherobots Organization members with the User role can use existing catalogs and Cloud Connections set up by Admins but cannot create new ones. See Organization Roles.
  • An existing Cloud Connection to your AWS account, or permission to create one. For more information, see Cloud Connections.
  • Your Organization ID, found at cloud.wherobots.com/organization.
  • An AWS account with an existing Glue database and an S3 bucket that holds your Glue table data.
  • Permission to create CloudFormation stacks that provision IAM resources (typically AdministratorAccess), so Wherobots can set up the Cloud Connection and grant it Glue access. CloudFormation creates the IAM role and policies for you, so you don’t edit them by hand.
    The pre-filled templates create or modify IAM resources on your behalf. The actions they perform typically require AdministratorAccess:For a complete list of IAM Actions, see Actions defined by AWS Identity and Access Management in the AWS Documentation.

Cloud Connections

Before you can connect to an AWS Glue catalog, Wherobots needs a Cloud Connection to your AWS account.
A Cloud Connection is a single, reusable trust relationship between your Wherobots Organization and a cloud provider account. For AWS, it’s a first-class object that stores your AWS account ID and an IAM role (with an external ID) that Wherobots assumes on your behalf to access resources in your account.
Create one Cloud Connection per AWS account and reuse it across all of your S3 storage integrations and AWS Glue catalogs in that account, instead of configuring credentials separately for each one.
Trust is established with AWS CloudFormation. Create the connection directly in the Wherobots UI, or download the CloudFormation template (YAML) so your security team can review it before deploying.

Manage Cloud Connections

Cloud Connections live in Organization Settings under Cloud Connections, where Admins can create, list, verify, and delete them.
  • Verify: Confirms Wherobots can assume your IAM role through the two-hop AWS STS AssumeRole chain.
  • Delete: Blocked while any storage integration or Glue catalog is still bound to the connection. You must remove any resources bound to that Cloud Connection prior to its deletion.

Connect to the AWS Glue catalog

Connect your AWS Glue Catalog to your Wherobots Organization in order to read and write to it from your Wherobots workloads. The Data Catalogs wizard provisions the connection with a CloudFormation stack, so you don’t have to write IAM policies or Spark configs by hand.
1

Open the Add Amazon Glue Catalog wizard

In Wherobots Cloud, open Data Catalogs.Start adding a catalog using either the Data Catalogs explorer or the Add Catalog button:
With no catalog selected, the details pane shows Add data cards. Select the Amazon Glue card.The Data Catalogs empty state showing the Unity Catalog, Amazon Glue, and Storage Integration cards
Either method opens the Add Amazon Glue Catalog wizard.
2

Enter the catalog details

On the Details step, enter:
  • Name: The name of the catalog in Wherobots.
    • This affects the Fully Qualified Name (FQN) used to reference this catalog in Wherobots: CATALOG_NAME.DATABASE_NAME.TABLE_NAME
    • A name can contain any character. But if it includes anything other than letters, numbers, or underscores — such as a space, dash, or period — you must wrap the name in backticks wherever you reference it in the FQN. For example, a catalog named My-Catalog is referenced as `My-Catalog`.database.table.
    For simplicity and to avoid quoting issues, it’s recommended to use only alphanumeric characters or underscores.
  • AWS Region: The region your Glue catalog is in.
  • S3 Path: The bucket (and optional prefix) that holds your Glue table data.
  • Access level: The level of access Wherobots has to the catalog.
    • Choose Read-only to allow Wherobots to read tables in your Glue catalog, but not create or modify them.
    • Choose Read-write to allow Wherobots to read, create, and modify tables in your Glue catalog.
  • Click Continue.
The Details step of the Add Amazon Glue Catalog wizard

Step 1, Details: name the catalog, then set the AWS region, S3 path, and access level.

3

Choose a Cloud Connection

On the Connection step, pick an existing Cloud Connection or create a new one, then click Continue.
The Connection step of the Add Amazon Glue Catalog wizard

Step 2, Connection: select the Cloud Connection Wherobots uses to reach Glue.

Create a new Cloud Connection

Creating a connection takes two steps inside the Create Cloud Connection dialog.
1

Enter the connection details

  • Connection Name — a label that identifies the trust relationship in Wherobots.
  • AWS Account ID — the 12-digit AWS account you’re connecting to.
Click Create Connection.
The Create Cloud Connection dialog

Connection details: name the connection and enter your AWS Account ID.

2

Grant access in AWS

Wherobots generates a pre-filled CloudFormation stack that creates the connection’s IAM role. Click Open in AWS Console to launch it in a new tab, or Download Template to run it yourself.
The Grant access in AWS step of the Create Cloud Connection dialog, with Open in AWS Console and Download Template buttons

Grant access in AWS: launch the pre-filled CloudFormation stack that creates the Cloud Connection role.

On the AWS Quick create stack page, everything is pre-filled. Scroll to the bottom, select I acknowledge that AWS CloudFormation might create IAM resources, and click Create stack.
The Capabilities section of the AWS Quick create stack page with the IAM acknowledgment checkbox selected

On the AWS Quick create stack page, acknowledge the IAM capability and click Create stack.

Back in Wherobots, click Done to finish creating the connection.
4

Deploy the catalog stack

On the Deploy step, launch the pre-filled CloudFormation stack (named wherobots-glue-readonly-<name> or wherobots-glue-readwrite-<name>). It attaches Glue and S3 access to your Cloud Connection.
  1. Click Open in AWS Console (or Download Template to manually paste it into the AWS CloudFormation console).
  2. On the AWS Quick create stack page, select I acknowledge that AWS CloudFormation might create IAM resources, and click Create stack.
  3. Return to Wherobots and click Create catalog.
The Deploy step of the Add Amazon Glue Catalog wizard, with Open in AWS Console and Create catalog

Step 3, Deploy: launch the CloudFormation stack, then create the catalog.

5

Verify and finish

After the stack completes, Wherobots verifies it can access your Glue catalog. Once verified, the catalog appears in Data Catalogs and is ready to use.
IAM changes can take a few minutes to propagate across AWS. If verification fails immediately, wait a moment and retry.

Next Steps

After you connect your Glue catalog, you can query its tables from a Wherobots notebook. See Query AWS Glue Catalog in a Notebook for guidance and starter code.
Runtime Restart Required After Data IntegrationTo use new storage integrations or catalogs in your notebooks, destroy the existing runtime and start a new one. Notebooks can only access storage integrations or catalogs that were created before the runtime started.

Geometry and geography columns

You can create tables with GEOMETRY(<srid>) and GEOGRAPHY(<srid>) columns in a Glue catalog, then write and read them, from your Wherobots workloads.
Create a Glue table with a geometry column
  • Set a table location. When the Glue database has no default location, a CREATE TABLE without LOCATION fails with Location information cannot be null while creating an iceberg table.
  • Grant Lake Formation permission on the location. If AWS Lake Formation manages the location, the IAM role of the catalog’s Cloud Connection needs Lake Formation permission on it. Otherwise the create fails with Insufficient Lake Formation permission(s).
  • The table stays at format-version 3. A table created or replaced with a GEOMETRY(<srid>) or GEOGRAPHY(<srid>) column is format-version 3 and can’t go back to format-version 2. Amazon Athena can’t read format-version 3 tables, and Amazon Redshift can’t read Iceberg V3 geometry columns. Every Wherobots runtime can read them.
A scheduled CREATE OR REPLACE TABLE ... AS SELECT whose source has GEOMETRY(<srid>) columns turns an existing format-version 2 Glue table into a format-version 3 table on its first run, and the change can’t be undone. Athena can no longer read the table after that run.
To stop one workload from creating these columns in the catalog, set the Spark configuration spark.sql.catalog.<catalog_name>.havasu.geo.v3-write-enabled to false, where <catalog_name> is the name of the catalog in Wherobots: To turn these columns off for every workload in your Organization, contact Wherobots Support. To copy geometries that a Glue table stores as WKB, WKT, or GeoJSON into a table with a GEOMETRY(<srid>) column, see Upgrade Existing Geometry Tables.

Known Limitations

The following limitations apply to Glue catalogs connected to Wherobots:
  • Glue REST API doesn’t support staged creates, i.e. no CREATE TABLE foo AS SELECT ...
    • Glue can’t create a new table from a query result. These all fail with Malformed request: Stage create is not supported:
      • CREATE TABLE ... AS SELECT (CTAS)
      • CREATE OR REPLACE TABLE ... AS SELECT, when the table doesn’t exist yet
      • The DataFrame equivalents .writeTo(...).create() and .writeTo(...).createOrReplace(), when the table doesn’t exist yet
      • df.write.mode("overwrite").saveAsTable(...), when the table doesn’t exist yet
      Setting an explicit LOCATION doesn’t help — the request is rejected before any data files are written.
    • Once the table exists, replacing it works normally: REPLACE TABLE ... AS SELECT, CREATE OR REPLACE TABLE ... AS SELECT, .replace(), and .createOrReplace() all succeed, including when the new query changes the schema. Use one of these when the query’s columns no longer line up with the table’s, since they rebuild the table; INSERT OVERWRITE below keeps the existing schema and fails if the columns don’t match.
    • Watch for a query that returns a geometry column with no declared CRS, such as one computed with an ST_ function. Glue stores that column as binary, so replacing a table with such a query turns its geometry column, including a GEOMETRY(<srid>) column, into a binary column that ST_ functions can’t read. If the table already has the same columns with that column as binary, the replacement can fail instead, with Malformed request: Cannot set last added schema: no schema has been added. To keep a geometry column, declare it as GEOMETRY(<srid>) in CREATE TABLE and load it with INSERT INTO, as described in Geometry and geography columns.
    • To create a table, declare the schema first, then load it with INSERT OVERWRITE:
      Create a Glue table in place of CTAS
      Written this way the pair is safe to re-run: the create is a no-op once the table exists, and the overwrite replaces whatever an earlier attempt left behind. LOCATION is required. Without it, the create fails with Malformed request: Location information cannot be null while creating an iceberg table. For a worked example, see Query AWS Glue Catalog in a Notebook.
    • To replace the contents of a table that already exists, use INSERT OVERWRITE for an atomic swap:
      Replace the contents of an existing Glue table
      The query’s columns must match the table’s schema. To change the schema, use REPLACE TABLE ... AS SELECT instead. This replaces the whole table under the default spark.sql.sources.partitionOverwriteMode of STATIC. On a partitioned table in a session that sets it to DYNAMIC, INSERT OVERWRITE replaces only the partitions the query produces and leaves the rest in place.
  • Glue REST API doesn’t support reading or writing views
  • Glue REST API doesn’t support ALTER TABLE … RENAME TO
  • A new Glue table is format-version 2 unless it has a GEOMETRY(<srid>) or GEOGRAPHY(<srid>) column or sets 'format-version' = '3'. Format-version 3 tables with geometry, geography, or variant columns can be read and written, and merge-on-read DELETE, UPDATE, and MERGE write deletion vectors on them; see Geometry and geography columns. Tables with timestamp_ns columns can’t be read.