# Configuring Iceberg settings in Control Panel

Iceberg table settings are configured per-enrollment in [Control Panel](../../administration/control-panel/index.md). From this interface, relevant administrators can configure Iceberg storage and encryption settings and set defaults for how Iceberg tables are written across projects.

To access Iceberg settings, open **Control Panel** from the **Applications** portal and search for the **Iceberg table settings** page.

## Required permissions

Only users with the **`Enrollment Administrator`** or **`Information Security Officer`** role can modify Iceberg settings in Control Panel.

## Verifying Iceberg is enabled

You can verify that Iceberg is available for your enrollment by checking that **Enable Foundry Iceberg** is toggled on at the top of the Iceberg table settings page.

Iceberg is available by default for standard enterprise Foundry AWS, Azure, and GCP cloud environments. For on-premises or other kinds of cloud Foundry environments, contact Palantir Support for assistance.

## Configuring Iceberg encryption settings

Foundry offers two layers of encryption for Iceberg tables:

* **Server-side encryption (SSE) \[required]:** Encrypts data at rest in the storage bucket. SSE is enabled by default for Foundry-managed storage. For customer-managed buckets, you must enable SSE on your bucket to ensure your data is encrypted at rest.
* **Client-side encryption (CSE) \[optional]** Applies [Iceberg table encryption ↗](https://iceberg.apache.org/docs/latest/encryption) to data files before they are written to the storage location, providing an additional layer of encryption on top of standard server-side encryption.

:::callout{theme="warning"}
Client-side Iceberg table encryption is a new and evolving capability that is not yet supported by all Foundry features, external compute engines, or tools that connect to Iceberg tables. Enabling it may limit functionality until broader compatibility is available.
:::

## Configuring storage locations

Foundry supports the following [storage options](../storage/index.md) for Iceberg tables:

* **Foundry-managed storage:** Managed storage provided by Palantir.
* **Bring-your-own-bucket (BYOB):** Customer-managed storage buckets.

To add a customer-managed storage bucket, first follow the instructions to set up your [BYOB source](../iceberg-byob/index.md). Once you have your source created, you can select it in the Control Panel interface via **Configure buckets** in the Iceberg storage buckets section. You can configure multiple storage locations and use them for different projects to organize where Iceberg table data is written.

You can also set advanced storage settings on your BYOB buckets on this page, such as Access delegation details and Custom FileIO configuration properties.

## Configuring Iceberg storage and encryption defaults

You can configure default settings for how Iceberg tables are written across your enrollment, and optionally override these defaults for specific projects or namespaces.

### Enrollment-wide defaults

In the **Configure global Iceberg storage** section:

* **Allow writing Iceberg tables by default to all projects:** When enabled, Iceberg tables can be written to any project by default. When disabled, Iceberg is only available in projects with explicit overrides.
* **Default storage for newly created Iceberg tables:** Select which storage location to use by default for new Iceberg tables.
* **Iceberg table encryption (client-side encryption):** Select whether to enable or disable [client-side Iceberg table encryption](#configuring-iceberg-encryption-settings).

### Project-level or namespace-level overrides

To override enrollment-level defaults for specific projects or namespaces, select **Add project or namespace** in the **Customize storage** section. For each project or namespace, you can override:

* The storage location for Iceberg tables in that project
* The client-side encryption setting for Iceberg tables

Project-level or namespace-level overrides only apply to newly written tables in the project. Existing tables retain their current storage locations and encryption settings.

## Modifying existing settings

When you modify storage settings, such as storage location or encryption configuration, the new settings apply only to newly created tables. Existing tables will not be migrated or have their encryption settings altered.