Configuring Iceberg settings in Control Panel

Iceberg table settings are configured per-enrollment in Control Panel. From this interface, relevant administrators can configure Iceberg storage and encryption settings and set defaults for how Iceberg tables are written across projects.

To access Iceberg settings, open Control Panel from the Applications portal and search for the Iceberg table settings page.

Required permissions

Only users with the Enrollment Administrator or Information Security Officer role can modify Iceberg settings in Control Panel.

Verifying Iceberg is enabled

You can verify that Iceberg is available for your enrollment by checking that Enable Foundry Iceberg is toggled on at the top of the Iceberg table settings page.

Iceberg is available by default for standard enterprise Foundry AWS, Azure, and GCP cloud environments. For on-premises or other kinds of cloud Foundry environments, contact Palantir Support for assistance.

Configuring Iceberg encryption settings

Foundry offers two layers of encryption for Iceberg tables:

• Server-side encryption (SSE) [required]: Encrypts data at rest in the storage bucket. SSE is enabled by default for Foundry-managed storage. For customer-managed buckets, you must enable SSE on your bucket to ensure your data is encrypted at rest.
• Client-side encryption (CSE) [optional] Applies Iceberg table encryption ↗ to data files before they are written to the storage location, providing an additional layer of encryption on top of standard server-side encryption.

Configuring storage locations

Foundry supports the following storage options for Iceberg tables:

• Foundry-managed storage: Managed storage provided by Palantir.
• Bring-your-own-bucket (BYOB): Customer-managed storage buckets.

To add a customer-managed storage bucket, first follow the instructions to set up your BYOB source. Once you have your source created, you can select it in the Control Panel interface via Configure buckets in the Iceberg storage buckets section. You can configure multiple storage locations and use them for different projects to organize where Iceberg table data is written.

You can also set advanced storage settings on your BYOB buckets on this page, such as Access delegation details and Custom FileIO configuration properties.

Configuring Iceberg storage and encryption defaults

You can configure default settings for how Iceberg tables are written across your enrollment, and optionally override these defaults for specific projects or namespaces.

Enrollment-wide defaults

In the Configure global Iceberg storage section:

• Allow writing Iceberg tables by default to all projects: When enabled, Iceberg tables can be written to any project by default. When disabled, Iceberg is only available in projects with explicit overrides.
• Default storage for newly created Iceberg tables: Select which storage location to use by default for new Iceberg tables.
• Iceberg table encryption (client-side encryption): Select whether to enable or disable client-side Iceberg table encryption.

Project-level or namespace-level overrides

To override enrollment-level defaults for specific projects or namespaces, select Add project or namespace in the Customize storage section. For each project or namespace, you can override:

• The storage location for Iceberg tables in that project
• The client-side encryption setting for Iceberg tables

Project-level or namespace-level overrides only apply to newly written tables in the project. Existing tables retain their current storage locations and encryption settings.

Modifying existing settings

When you modify storage settings, such as storage location or encryption configuration, the new settings apply only to newly created tables. Existing tables will not be migrated or have their encryption settings altered.