change ARN Role

[bilec]

Hi, why is it not possible to change ARN Role in already existing catalog?

Problem is that we wanna use STS but till now we were not using it so all our catalogs are created without ARN role. Now when i try to change it exception gets thrown that it is not possible.

[dimas-b]

@bilec : could you post the exact error message you're getting, please?.. and a stack trace, if possible.

[bilec]

2026-02-25 15:42:09,477 INFO  [org.apa.pol.ser.exc.IcebergExceptionMapper] [65498be2-0624-4999-812c-bba8ca2dcdef_0000000000000029381,iup] [,,,] (executor-thread-3305) Handling runtimeException Cannot modify Role ARN in storage config from AwsStorageConfigurationInfo{allowedLocations=[s3a://bucket/], region=irrelevant, endpoint=https://s3.com, pathStyleAccess=true, stsUnavailable=true} to AwsStorageConfigurationInfo{allowedLocations=[s3a://bucket/], roleARN=arn:aws:iam::tenant:role/catalog-role, region=irrelevant, endpoint=https://s3.com, pathStyleAccess=true, stsUnavailable=false}

I am using apache/polaris:1.3.0-incubating

Based on PolarisAdminService.java it looks like its wanted behaviour but I don't get why.

[dimas-b]

This appears to be in the Polaris codebase from the day of the initial code donation to the ASF.

@collado-mike @dennishuo : Could you provide any insight / rationale for this restriction?

[bilec]

The ugly-but-works solution is to hand-edit the DB and then restart Polaris. But I still don't get why it's not possible.

[dimas-b]

@bilec : If you have capacity to open a PR for this, I suggest adding a Feature Flag to allow disabling the ARN change check. Then open a PR and a corresponding discussion on dev (which is a custom for feature flag changes).

[bilec]

Sorry for late reply, but I don't have capacity for that.

[adutra]

I took a quick stab at this: #4019

The PR only allows going from no ARN role to some ARN role. It's still forbidden to change an existing account ID.

If that is not desirable (or not enough), we could maybe look into introducing a FeatureConfiguration to gate the behavior behind a feature flag.