Cross-cloud conversational analytics made simple with open standards

Google Cloud detailed a borderless Lakehouse architecture that lets BigQuery query data in place across Databricks Unity Catalog, Snowflake Horizon Catalog, and AWS Glue Data Catalog using the open Apache Iceberg REST catalog specification, avoiding extraction pipelines that cause synchronization lag, recurring storage costs, and network egress fees. The setup requires a three-step deployment pattern: create the federated catalog in Google Cloud, inspect its configuration to retrieve its automatically generated service account, and grant access permissions in the remote platform. Metadata synchronization runs on a user-defined refresh schedule while query processing stays within Google Cloud compute, with remote Databricks clusters, Snowflake virtual warehouses, and AWS compute instances not invoked during execution.

The reality for most organizations is that data lives everywhere. As engineering teams expand and adopt specialized platforms for their workloads, enterprise data naturally disperses across multiple clouds and operational systems. When analytical and AI initiatives require context from across the entire organization,these teams traditionally face a difficult trade-off: build complex extraction pipelines to copy data into a central repository or accept fragmented reporting. Traditional architectures address this fragmentation with scheduled extraction pipelines that copy remote datasets into a central staging warehouse. This approach creates synchronization lag, adds recurring storage costs, and triggers variable network egress fees. When schemas change upstream, pipelines break, and teams spend hours reconciling metrics across out-of-sync dashboards. BigQuery and Google Cloud’s borderless Lakehouse offer a streamlined way to solve this challenge with a foundation based on the open Apache Iceberg REST catalog specification. Rather than moving data to the compute engine, you can bring Google Cloud compute and generative AI directly to your data, querying it in place across Databricks, Snowflake, and AWS Glue. In this post, we walk through how to configure Databricks Unity Catalog for federation into BigQuery AWS Glue and Snowflake set up in appendix , run a single query joining data across all three external catalogs, and use conversational analytics in BigQuery to explore the consolidated data with natural language. The borderless lakehouse architecture This solution uses Lakehouse runtime catalog to synchronize metadata from other cloud providers, allowing you to query data with BigQuery or external open source engines through the Apache Iceberg REST catalog endpoint, all without migrating the data. Because Databricks Unity Catalog, Snowflake Horizon Catalog, and AWS Glue Data Catalog support the open Apache Iceberg REST catalog specification, you can apply a consistent connection pattern across all three platforms. When you run a federated query, Lakehouse runtime catalog separates metadata synchronization from storage access: Metadata synchronization: Lakehouse runtime catalog periodically syncs schemas, snapshot pointers, and table definitions from the remote catalog based on a refresh schedule you define. Direct storage access: During query runtime, a compatible engine reads Parquet data files directly from remote object storage, such as Amazon S3, using temporary credentials issued by the remote platform. All query processing runs within Google cloud compute such as BigQuery or Managed Service for Apache Spark. Remote Databricks clusters, Snowflake virtual warehouses, and AWS compute instances are not invoked during execution. Authentication follows an explicit three-step deployment pattern: create the federated catalog in Google Cloud, inspect its configuration to retrieve its automatically generated service account, and grant access permissions within the remote platform. You can use AI to generate sample data. The schema details for tables are provided below. Configure Databricks Unity Catalog We begin in Databricks by preparing the catalog and table. In Unity Catalog, federated access requires that your target schema be associated with an external location registered in Databricks: code block <ListValue: StructValue 'code', "-- Run inside Databricks SQL workspace\r\nCREATE CATALOG IF NOT EXISTS dbx retail db;\r\n\r\n-- Declare the managed target location at the schema level\r\nCREATE SCHEMA IF NOT EXISTS dbx retail db.dbx core \r\n MANAGED LOCATION 's3://my-databricks-bucket/retail/data/';\r\n\r\n-- Create the Iceberg dimension table\r\nCREATE TABLE IF NOT EXISTS dbx retail db.dbx core.dim products \r\n product key INT,\r\n product id STRING,\r\n product name STRING,\r\n category STRING,\r\n subcategory STRING,\r\n brand STRING,\r\n price DOUBLE,\r\n cost DOUBLE\r\n \r\nUSING iceberg;" , 'language', '' , 'caption', <wagtail.rich text.RichText object at 0x7fed4b610690 You can use AI to generate sample data. The schema details for tables are provided in each section. Before external engines can read this table, a Databricks metastore administrator must enable External data access on the metastore details tab. Go to Databricks Admin account and under User Management, create a Databricks Service Principal and make a note of its UUID "6ea7b861-c5a5-xxxx-xxxx-xxxxxxxxxxxx" Connect Databricks to BigQuery Next, create the federated catalog inside Google Cloud using the gcloud command-line tool. You will need your Databricks workspace URL and the application ID of your Databricks service principal: Return to Databricks to assign permissions to your service principal: code block <ListValue: StructValue 'code', '-- Grant catalog traversal permission\r\nGRANT USE CATALOG ON CATALOG dbx retail db \r\n TO 6ea7b861-c5a5-xxxx-xxxx-xxxxxxxxxxxx ;\r\n\r\n-- Grant schema and read permissions\r\nGRANT USE SCHEMA,EXTERNAL USE SCHEMA, SELECT ON SCHEMA dbx retail db.dbx core \r\n TO 6ea7b861-c5a5-xxxx-xxxx-xxxxxxxxxxxx ;' , 'language', '' , 'caption', <wagtail.rich text.RichText object at 0x7fed4b226310 You must grant the EXTERNAL USE SCHEMA privilege to the Databricks Service Principal on the target schemas or catalog to enable credential vending for external data access. Finally, to complete the connection, configure the federation policy on the Databricks service principal with the following details - Subject - numeric subject ID returned by the catalog describe command eg 1124251400450xxxxxxxx Audiences - https://accounts.cloud.databricks.com Run one query across three clouds Federated Iceberg tables are addressed in BigQuery using four-part paths: project.catalog.namespace.table. In our environment, sales transactions reside natively in BigQuery: code block <ListValue: StructValue 'code', 'CREATE SCHEMA IF NOT EXISTS local retail dataset\r\nOPTIONS location="us-central1" ;\r\n\r\nCREATE OR REPLACE TABLE my-lakehouse-project.local retail dataset.fact sales \r\n sale id STRING,\r\n sale date DATE,\r\n customer key INT64,\r\n product key INT64,\r\n store key INT64,\r\n quantity INT64,\r\n unit price NUMERIC,\r\n discount NUMERIC,\r\n total revenue NUMERIC,\r\n total cost NUMERIC,\r\n margin NUMERIC\r\n \r\nPARTITION BY sale date\r\nCLUSTER BY store key, product key;' , 'language', '' , 'caption', <wagtail.rich text.RichText object at 0x7fed4b225550 We can now run a single SQL query joining our native sales transactions with customer records in Snowflake, product lines in Databricks, and store locations in AWS Glue: code block <ListValue: StructValue 'code', "SELECT \r\n c.first name || ' ' || c.last name AS customer name, -- From Snowflake Iceberg\r\n p.product name, -- From Databricks Iceberg\r\n s.store name, -- From AWS S3 Iceberg\r\n SUM f.quantity AS total units sold, -- From BigQuery native fact\r\n SUM f.total revenue AS total sales revenue -- From BigQuery native fact\r\nFROM my-lakehouse-project.local retail dataset.fact sales f\r\nINNER JOIN my-lakehouse-project.sf retail db.CORE.DIM CUSTOMERS c \r\n ON f.customer key = c.customer key\r\nINNER JOIN my-lakehouse-project.dbx retail db.dbx core.dim products p \r\n ON f.product key = p.product key\r\nINNER JOIN my-lakehouse-project.glue retail db.glue retail db.dim stores s \r\n ON f.store key = s.store key\r\nGROUP BY 1, 2, 3\r\nORDER BY total sales revenue DESC\r\nLIMIT 10;" , 'language', '' , 'caption', <wagtail.rich text.RichText object at 0x7fed4b2253d0 BigQuery processes the joins in place. Notice that Snowflake identifiers appear in uppercase CORE.DIM CUSTOMERS , while Databricks and AWS Glue maintain lowercase table paths. Explore cross-cloud data with natural language Because federated Iceberg tables behave like native tables within BigQuery, downstream analytical features inherit access directly. You can point conversational analytics in BigQuery at these federated schemas to let team members explore cross-cloud data using natural language prompts. To give conversational analytics full operational context, we save our federated join as a logical view: code block <ListValue: StructValue 'code', "CREATE OR REPLACE VIEW my-lakehouse-project.local retail dataset.v omnichannel sales pulse AS\r\nSELECT \r\n f.sale id,\r\n f.sale date,\r\n c.first name || ' ' || c.last name AS customer name,\r\n c.country AS customer country,\r\n p.product name,\r\n p.category AS product category,\r\n p.brand AS product brand,\r\n s.store name,\r\n s.city AS store city,\r\n s.region AS store region,\r\n f.quantity,\r\n f.total revenue,\r\n f.margin\r\nFROM my-lakehouse-project.local retail dataset.fact sales f\r\nINNER JOIN my-lakehouse-project.sf retail db.CORE.DIM CUSTOMERS c \r\n ON f.customer key = c.customer key\r\nINNER JOIN my-lakehouse-project.dbx retail db.dbx core.dim products p \r\n ON f.product key = p.product key\r\nINNER JOIN my-lakehouse-project.glue retail db.glue retail db.dim stores s \r\n ON f.store key = s.store key;" , 'language', '' , 'caption', <wagtail.rich text.RichText object at 0x7fed4b224a90 Analyze sales performance in natural language When you ask conversational analytics in BigQuery: "Who are our top customers by total sales revenue, what products did they buy, and which stores did they shop at?" Conversational analytics evaluates the schema across all three remote catalogs, generates the SQL statement, executes the query, and presents the response. Plan for caching and data residency Before deploying federated catalogs in production, consider these operational behaviors: Background refresh timing: The --refresh-interval flag controls metadata synchronization. The minimum interval is 300 seconds. For larger catalogs containing hundreds of tables, metadata retrieval can take longer. If a sync cycle overruns, BigQuery skips the next scheduled run to avoid task queuing. Automatic query caching: BigQuery caches retrieved cross-cloud data blocks in the region where your federated catalog resides e.g. us-central1 . This helps reduce network transfer on repeated queries. Because cached blocks reside within Google Cloud storage in that region, confirm that this aligns with your organization's data residency policies. Encryption controls: Cross-cloud cache blocks use Google-managed encryption keys. If your organization enforces the constraints/gcp.restrictNonCmekServices policy constraint, BigQuery bypasses the cache and reads directly from remote storage for every query. Monitoring access metrics: You can evaluate cache utilization in your query execution plans. Check the objectStorageStats section in BigQuery job statistics to compare cacheBytesRead against objectStorageBytesRead. Next steps In summary, Google Cloud’s borderless Lakehouse helps you activate your data regardless of where it lives without costly migrations or building additional data pipelines. Get started today by reviewing theborderless Lakehouse architecture documentation to learn more about supported regions and credential configurations. You can work through theborderless Lakehouse codelab to practice federating external catalogs step-by-step. Finally, connect with your Google Cloud account team or customer engineer to evaluate borderless lakehouse patterns for your specific data platforms or industries. Appendix Setting up Snowflake and AWS Glue cross cloud data access Connect Snowflake and Big Query Configure Snowflake Horizon Catalog We begin in Snowflake by creating the database, schema, and Iceberg table. In Snowflake Horizon, managed Iceberg tables expose an open Apache Iceberg REST catalog interface automatically: code block <ListValue: StructValue 'code', "-- Run inside Snowflake SQL worksheet\r\nCREATE DATABASE IF NOT EXISTS sf retail db;\r\nCREATE SCHEMA IF NOT EXISTS sf retail db.core;\r\n\r\n-- Create the Iceberg dimension table\r\nCREATE OR REPLACE ICEBERG TABLE sf retail db.core.dim customers \r\n customer key INTEGER,\r\n customer id VARCHAR,\r\n first name VARCHAR,\r\n last name VARCHAR,\r\n email VARCHAR,\r\n gender VARCHAR,\r\n country VARCHAR,\r\n signup date DATE\r\n\r\n \r\nCATALOG = 'SNOWFLAKE'\r\nEXTERNAL VOLUME = 'SNOWFLAKE MANAGED';" , 'language', '' , 'caption', <wagtail.rich text.RichText object at 0x7fed4b2252d0 Before external engines can read this catalog, configure a dedicated reader role and grant traversal permissions across the database, schema, and table. SQL code block <ListValue: StructValue 'code', '-- Create a dedicated reader role\r\nCREATE ROLE IF NOT EXISTS gcp lakehouse reader role;\r\n\r\n-- Grant database and schema traversal permissions\r\nGRANT USAGE ON DATABASE sf retail db TO ROLE gcp lakehouse reader role;\r\nGRANT USAGE ON SCHEMA sf retail db.core TO ROLE gcp lakehouse reader role;\r\n\r\n-- Grant read access on the target table\r\nGRANT SELECT ON TABLE sf retail db.core.dim customers TO ROLE gcp lakehouse reader role;' , 'language', '' , 'caption', <wagtail.rich text.RichText object at 0x7fed4b2242d0 Next, create the federated catalog inside Google Cloud using the gcloud command-line tool. You will need your Snowflake account identifier, the reader role, and the root Iceberg database name: In the Apache Iceberg REST specification, --snowflake-warehouse references the catalog root database name SF RETAIL DB , not a virtual compute warehouse. Once created, describe the catalog to view its assigned numeric service account ID: Return to Snowflake to bind Google Cloud's numeric identity to a passwordless service user via Workload Identity Federation WIF : SQL code block <ListValue: StructValue 'code', "-- Run inside Snowflake SQL worksheet\r\nUSE ROLE ACCOUNTADMIN;\r\n\r\n-- Bind Google Cloud's numeric identity to a passwordless service user\r\nCREATE OR REPLACE USER snowflake service user\r\n TYPE = SERVICE\r\n WORKLOAD IDENTITY = \r\n TYPE = GCP\r\n SUBJECT = '102669xxxxxxxxxxxxxxxxx' -- Numeric subject ID returned by gcloud describe\r\n \r\n DEFAULT ROLE = gcp lakehouse reader role\r\n COMMENT = 'Service user for Lakehouse catalog federation over WIF';\r\n\r\n-- Grant the reader role to this service user\r\nGRANT ROLE gcp lakehouse reader role TO USER snowflake service user;" , 'language', '' , 'caption', <wagtail.rich text.RichText object at 0x7fed4b224550 This establishes passwordless authentication over OpenID Connect, allowing BigQuery to discover table metadata and vend temporary query-time credentials directly from Snowflake Horizon. Configure AWS Glue Data Catalog We begin in AWS by preparing the IAM identity, establishing access permissions across AWS Glue and Amazon S3, and registering the Iceberg table. First, create a placeholder trust policy named trust policy.json. This allows you to provision the AWS IAM role before Google Cloud assigns the unique catalog service agent: Create the IAM role using the AWS CLI. Setting a 12-hour session duration 43200 seconds prevents credential expiration during long-running analytical queries: Next, define the permissions policy in a file named permissions policy.json. This policy grants BigQuery permission to read the AWS Glue catalog metadata and access the underlying Parquet data files in Amazon S3: Important AWS Lake Formation : If your AWS environment uses AWS Lake Formation, verify that the IAMAllowedPrincipals group has access to the target database and table or grant explicit Lake Formation permissions to lakehouse glue federation role if the bucket is registered with AWS Lake Formation . Without this, Lake Formation security settings will block the IAM role from accessing catalog metadata. With permissions in place, create the database and Iceberg table in AWS Glue using Amazon Athena: code block <ListValue: StructValue 'code', "-- Run inside Amazon Athena\r\nCREATE DATABASE IF NOT EXISTS glue retail db;\r\n\r\nCREATE TABLE IF NOT EXISTS glue retail db.dim stores \r\n store key INT,\r\n store id STRING,\r\n store name STRING,\r\n city STRING,\r\n state STRING,\r\n region STRING,\r\n manager STRING,\r\n opened date DATE\r\n\r\n \r\nLOCATION 's3://my-glue-iceberg-bucket/retail/dim stores/'\r\nTBLPROPERTIES \r\n 'table type'='ICEBERG', \r\n 'format'='parquet', \r\n 'write compression'='zstd' \r\n\r\n ;" , 'language', '' , 'caption', <wagtail.rich text.RichText object at 0x7fed4ac97b50 Connect AWS Glue to BigQuery Next, register the federated catalog inside Google Cloud using the gcloud command-line tool. You will need your 12-digit AWS Account ID, AWS Region, and the role ARN created above: