[IMPALA-12584] Add backend config to restrict data file locations for Iceberg tables

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Impala 4.4.0
• Labels: impala-iceberg
• Epic Color: ghx-label-13
• Assignee: Peter Rozsa
• Reporter: Zoltán Borók-Nagy
• Created: 30/Nov/23 15:34
• Updated: 20/Jan/24 16:56
• Resolved: 20/Dec/23 08:21

Description

Similarly to https://github.com/apache/hive/pull/4910, Impala should have a backend flag to restrict the data file locations of Iceberg tables.

If the flag is true, Impala should raise an error for Iceberg tables that have data files outside of the table directory.

We should not limit the location of metadata files, so they could be placed to a different storage system (e.g. Amazon S3 Express).

We must also ensure that users cannot create Iceberg tables at arbitrary locations.

Issue Links

• is related to: HIVE-27323 Iceberg: malformed manifest file or list can cause data breach