The reality for most organizations is that data lives everywhere. As engineering teams expand and adopt specialized platforms for their workloads, enterprise data naturally disperses across multiple clouds and operational systems. When analytical and AI initiatives require context from across the entire organization,these teams traditionally face a difficult trade-off: build complex extraction pipelines to copy data into a central repository or accept fragmented reporting.
Traditional architectures address this fragmentation with scheduled extraction pipelines that copy remote datasets into a central staging warehouse. This approach creates synchronization lag, adds recurring storage costs, and triggers variable network egress fees. When schemas change upstream, pipelines break, and teams spend hours reconciling metrics across out-of-sync dashboards.
BigQuery and Google Cloud’s borderless Lakehouse offer a streamlined way to solve this challenge with a foundation based on the open Apache Iceberg REST catalog specification. Rather than moving data to the compute engine, you can bring Google Cloud compute and generative AI directly to your data, querying it in place across Databricks, Snowflake, and AWS Glue.
In this post, we walk through how to configure Databricks Unity Catalog for federation into BigQuery (AWS Glue and Snowflake set up in appendix), run a single query joining data across all three external catalogs, and use conversational analytics in BigQuery to explore the consolidated data with natural language.
The borderless lakehouse architecture
This solution uses Lakehouse runtime catalog to synchronize metadata from other cloud providers, allowing you to query data with BigQuery or external open source engines through the Apache Iceberg REST catalog endpoint, all without migrating the data. Because Databricks Unity Catalog, Snowflake Horizon Catalog, and AWS Glue Data Catalog support the open Apache Iceberg REST catalog specification, you can apply a consistent connection pattern across all three platforms.
When you run a federated query, Lakehouse runtime catalog separates metadata synchronization from storage access:
Metadata synchronization: Lakehouse runtime catalog periodically syncs schemas, snapshot pointers, and table definitions from the remote catalog based on a refresh schedule you define.
Direct storage access: During query runtime, a compatible engine reads Parquet data files directly from remote object storage, such as Amazon S3, using temporary credentials issued by the remote platform.
All query processing runs within Google cloud compute such as BigQuery or Managed Service for Apache Spark. Remote Databricks clusters, Snowflake virtual warehouses, and AWS compute instances are not invoked during execution.
Authentication follows an explicit three-step deployment pattern: create the federated catalog in Google Cloud, inspect its configuration to retrieve its automatically generated service account, and grant access permissions within the remote platform.
You can use AI to generate sample data. The schema details for tables are provided below.
Configure Databricks Unity Catalog
We begin in Databricks by preparing the catalog and table. In Unity Catalog, federated access requires that your target schema be associated with an external location registered in Databricks:
code_block
<ListValue: [StructValue([('code', "-- Run inside Databricks SQL workspace\r\nCREATE CATALOG IF NOT EXISTS dbx_retail_db;\r\n\r\n-- Declare the managed target location at the schema level\r\nCREATE SCHEMA IF NOT EXISTS dbx_retail_db.dbx_core \r\n MANAGED LOCATION 's3://my-databricks-bucket/retail/data/';\r\n\r\n-- Create the Iceberg dimension table\r\nCREATE TABLE IF NOT EXISTS dbx_retail_db.dbx_core.dim_products (\r\n product_key INT,\r\n product_id STRING,\r\n product_name STRING,\r\n category STRING,\r\n subcategory STRING,\r\n brand STRING,\r\n price DOUBLE,\r\n cost DOUBLE\r\n)\r\nUSING iceberg;"), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fed4b610690>)])]>
You can use AI to generate sample data. The schema details for tables are provided in each section.
Before external engines can read this table, a Databricks metastore administrator must enable External data access on the metastore details tab.
Go to Databricks Admin account and under User Management, create a Databricks Service Principal and make a note of its UUID "6ea7b861-c5a5-xxxx-xxxx-xxxxxxxxxxxx"
Connect Databricks to BigQuery
Next, create the federated catalog inside Google Cloud using the gcloud command-line tool. You will need your Databricks workspace URL and the application ID of your Databricks service principal:
Return to Databricks to assign permissions to your service principal: code_block
<ListValue: [StructValue([('code', '-- Grant catalog traversal permission\r\nGRANT USE CATALOG ON CATALOG dbx_retail_db \r\n TO 6ea7b861-c5a5-xxxx-xxxx-xxxxxxxxxxxx;\r\n\r\n-- Grant schema and read permissions\r\nGRANT USE SCHEMA,EXTERNAL USE SCHEMA, SELECT ON SCHEMA dbx_retail_db.dbx_core \r\n TO 6ea7b861-c5a5-xxxx-xxxx-xxxxxxxxxxxx;'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fed4b226310>)])]>
You must grant the EXTERNAL USE SCHEMA privilege to the Databricks Service Principal on the target schemas or catalog to enable credential vending for external data access.
Finally, to complete the connection, configure the federation policy on the Databricks service principal with the following details -
Subject* - numeric subject ID returned by the catalog describe command eg 1124251400450xxxxxxxx
Audiences - https://accounts.cloud.databricks.com
Run one query across three clouds
Federated Iceberg tables are addressed in BigQuery using four-part paths: project.catalog.namespace.table.
In our environment, sales transactions reside natively in BigQuery:
code_block
<ListValue: [StructValue([('code', 'CREATE SCHEMA IF NOT EXISTS local_retail_dataset\r\nOPTIONS(location="us-central1");\r\n\r\nCREATE OR REPLACE TABLE my-lakehouse-project.local_retail_dataset.fact_sales (\r\n sale_id STRING,\r\n sale_date DATE,\r\n customer_key INT64,\r\n product_key INT64,\r\n store_key INT64,\r\n quantity INT64,\r\n unit_price NUMERIC,\r\n discount NUMERIC,\r\n total_revenue NUMERIC,\r\n total_cost NUMERIC,\r\n margin NUMERIC\r\n)\r\nPARTITION BY sale_date\r\nCLUSTER BY store_key, product_key;'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fed4b225550>)])]>
We can now run a single SQL query joining our native sales transactions with customer records in Snowflake, product lines in Databricks, and store locations in AWS Glue:
code_block
<ListValue: [StructValue([('code', "SELECT \r\n c.first_name || ' ' || c.last_name AS customer_name, -- From Snowflake Iceberg\r\n p.product_name, -- From Databricks Iceberg\r\n s.store_name, -- From AWS S3 Iceberg\r\n SUM(f.quantity) AS total_units_sold, -- From BigQuery native fact\r\n SUM(f.total_revenue) AS total_sales_revenue -- From BigQuery native fact\r\nFROM my-lakehouse-project.local_retail_dataset.fact_sales f\r\nINNER JOIN my-lakehouse-project.sf_retail_db.CORE.DIM_CUSTOMERS c \r\n ON f.customer_key = c.customer_key\r\nINNER JOIN my-lakehouse-project.dbx_retail_db.dbx_core.dim_products p \r\n ON f.product_key = p.product_key\r\nINNER JOIN my-lakehouse-project.glue_retail_db.glue_retail_db.dim_stores s \r\n ON f.store_key = s.store_key\r\nGROUP BY 1, 2, 3\r\nORDER BY total_sales_revenue DESC\r\nLIMIT 10;"), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fed4b2253d0>)])]>
BigQuery processes the joins in place. Notice that Snowflake identifiers appear in uppercase (CORE.DIM_CUSTOMERS), while Databricks and AWS Glue maintain lowercase table paths.
Explore cross-cloud data with natural language
Because federated Iceberg tables behave like native tables within BigQuery, downstream analytical features inherit access directly. You can point conversational analytics in BigQuery at these federated schemas to let team members explore cross-cloud data using natural language prompts.
To give conversational analytics full operational context, we save our federated join as a logical view:
code_block
<ListValue: [StructValue([('code', "CREATE OR REPLACE VIEW my-lakehouse-project.local_retail_dataset.v_omnichannel_sales_pulse AS\r\nSELECT \r\n f.sale_id,\r\n f.sale_date,\r\n c.first_name || ' ' || c.last_name AS customer_name,\r\n c.country AS customer_country,\r\n p.product_name,\r\n p.category AS product_category,\r\n p.brand AS product_brand,\r\n s.store_name,\r\n s.city AS store_city,\r\n s.region AS store_region,\r\n f.quantity,\r\n f.total_revenue,\r\n f.margin\r\nFROM my-lakehouse-project.local_retail_dataset.fact_sales f\r\nINNER JOIN my-lakehouse-project.sf_retail_db.CORE.DIM_CUSTOMERS c \r\n ON f.customer_key = c.customer_key\r\nINNER JOIN my-lakehouse-project.dbx_retail_db.dbx_core.dim_products p \r\n ON f.product_key = p.product_key\r\nINNER JOIN my-lakehouse-project.glue_retail_db.glue_retail_db.dim_stores s \r\n ON f.store_key = s.store_key;"), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fed4b224a90>)])]>
Analyze sales performance in natural language
When you ask conversational analytics in BigQuery:
"Who are our top customers by total sales revenue, what products did they buy, and which stores did they shop at?"
Conversational analytics evaluates the schema across all three remote catalogs, generates the SQL statement, executes the query, and presents the response.
Plan for caching and data residency
Before deploying federated catalogs in production, consider these operational behaviors:
Background refresh timing: The --refresh-interval flag controls metadata synchronization. The minimum interval is 300 seconds. For larger catalogs containing hundreds of tables, metadata retrieval can take longer. If a sync cycle overruns, BigQuery skips the next scheduled run to avoid task queuing.
Automatic query caching: BigQuery caches retrieved cross-cloud data blocks in the region where your federated catalog resides (e.g. us-central1). This helps reduce network transfer on repeated queries. Because cached blocks reside within Google Cloud storage in that region, confirm that this aligns with your organization's data residency policies.
Encryption controls: Cross-cloud cache blocks use Google-managed encryption keys. If your organization enforces the constraints/gcp.restrictNonCmekServices policy constraint, BigQuery bypasses the cache and reads directly from remote storage for every query.
Monitoring access metrics: You can evaluate cache utilization in your query execution plans. Check the objectStorageStats section in BigQuery job statistics to compare cacheBytesRead against objectStorageBytesRead.
Next steps
In summary, Google Cloud’s borderless Lakehouse helps you activate your data regardless of where it lives without costly migrations or building additional data pipelines. Get started today by reviewing theborderless Lakehouse architecture documentation to learn more about supported regions and credential configurations. You can work through theborderless Lakehouse codelab to practice federating external catalogs step-by-step. Finally, connect with your Google Cloud account team or customer engineer to evaluate borderless lakehouse patterns for your specific data platforms or industries.
Appendix
Setting up Snowflake and AWS Glue cross cloud data access
Connect Snowflake and Big Query
Configure Snowflake Horizon Catalog
We begin in Snowflake by creating the database, schema, and Iceberg table. In Snowflake Horizon, managed Iceberg tables expose an open Apache Iceberg REST catalog interface automatically:
code_block
<ListValue: [StructValue([('code', "-- Run inside Snowflake SQL worksheet\r\nCREATE DATABASE IF NOT EXISTS sf_retail_db;\r\nCREATE SCHEMA IF NOT EXISTS sf_retail_db.core;\r\n\r\n-- Create the Iceberg dimension table\r\nCREATE OR REPLACE ICEBERG TABLE sf_retail_db.core.dim_customers (\r\n customer_key INTEGER,\r\n customer_id VARCHAR,\r\n first_name VARCHAR,\r\n last_name VARCHAR,\r\n email VARCHAR,\r\n gender VARCHAR,\r\n country VARCHAR,\r\n signup_date DATE\r\n\r\n)\r\nCATALOG = 'SNOWFLAKE'\r\nEXTERNAL_VOLUME = 'SNOWFLAKE_MANAGED';"), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fed4b2252d0>)])]>
Before external engines can read this catalog, configure a dedicated reader role and grant traversal permissions across the database, schema, and table.
SQL
code_block
<ListValue: [StructValue([('code', '-- Create a dedicated reader role\r\nCREATE ROLE IF NOT EXISTS gcp_lakehouse_reader_role;\r\n\r\n-- Grant database and schema traversal permissions\r\nGRANT USAGE ON DATABASE sf_retail_db TO ROLE gcp_lakehouse_reader_role;\r\nGRANT USAGE ON SCHEMA sf_retail_db.core TO ROLE gcp_lakehouse_reader_role;\r\n\r\n-- Grant read access on the target table\r\nGRANT SELECT ON TABLE sf_retail_db.core.dim_customers TO ROLE gcp_lakehouse_reader_role;'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fed4b2242d0>)])]>
Next, create the federated catalog inside Google Cloud using the gcloud command-line tool. You will need your Snowflake account identifier, the reader role, and the root Iceberg database name:
In the Apache Iceberg REST specification, --snowflake-warehouse references the catalog root database name (SF_RETAIL_DB), not a virtual compute warehouse.
Once created, describe the catalog to view its assigned numeric service account ID:
Return to Snowflake to bind Google Cloud's numeric identity to a passwordless service user via Workload Identity Federation (WIF): SQL
code_block
<ListValue: [StructValue([('code', "-- Run inside Snowflake SQL worksheet\r\nUSE ROLE ACCOUNTADMIN;\r\n\r\n-- Bind Google Cloud's numeric identity to a passwordless service user\r\nCREATE OR REPLACE USER snowflake_service_user\r\n TYPE = SERVICE\r\n WORKLOAD_IDENTITY = (\r\n TYPE = GCP\r\n SUBJECT = '102669xxxxxxxxxxxxxxxxx' -- Numeric subject ID returned by gcloud describe\r\n )\r\n DEFAULT_ROLE = gcp_lakehouse_reader_role\r\n COMMENT = 'Service user for Lakehouse catalog federation over WIF';\r\n\r\n-- Grant the reader role to this service user\r\nGRANT ROLE gcp_lakehouse_reader_role TO USER snowflake_service_user;"), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fed4b224550>)])]>
This establishes passwordless authentication over OpenID Connect, allowing BigQuery to discover table metadata and vend temporary query-time credentials directly from Snowflake Horizon.
Configure AWS Glue Data Catalog
We begin in AWS by preparing the IAM identity, establishing access permissions across AWS Glue and Amazon S3, and registering the Iceberg table.
First, create a placeholder trust policy named trust_policy.json. This allows you to provision the AWS IAM role before Google Cloud assigns the unique catalog service agent:
Create the IAM role using the AWS CLI. Setting a 12-hour session duration (43200 seconds) prevents credential expiration during long-running analytical queries:
Next, define the permissions policy in a file named permissions_policy.json. This policy grants BigQuery permission to read the AWS Glue catalog metadata and access the underlying Parquet data files in Amazon S3:
Important (AWS Lake Formation): If your AWS environment uses AWS Lake Formation, verify that the IAMAllowedPrincipals group has access to the target database and table (or grant explicit Lake Formation permissions to lakehouse_glue_federation_role if the bucket is registered with AWS Lake Formation). Without this, Lake Formation security settings will block the IAM role from accessing catalog metadata.
With permissions in place, create the database and Iceberg table in AWS Glue using Amazon Athena:
code_block
<ListValue: [StructValue([('code', "-- Run inside Amazon Athena\r\nCREATE DATABASE IF NOT EXISTS glue_retail_db;\r\n\r\nCREATE TABLE IF NOT EXISTS glue_retail_db.dim_stores (\r\n store_key INT,\r\n store_id STRING,\r\n store_name STRING,\r\n city STRING,\r\n state STRING,\r\n region STRING,\r\n manager STRING,\r\n opened_date DATE\r\n\r\n)\r\nLOCATION 's3://my-glue-iceberg-bucket/retail/dim_stores/'\r\nTBLPROPERTIES (\r\n 'table_type'='ICEBERG', \r\n 'format'='parquet', \r\n 'write_compression'='zstd' \r\n\r\n);"), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fed4ac97b50>)])]>
Connect AWS Glue to BigQuery
Next, register the federated catalog inside Google Cloud using the gcloud command-line tool. You will need your 12-digit AWS Account ID, AWS Region, and the role ARN created above: