tinybird 4.5.11.dev0__tar.gz → 4.6.0__tar.gz

{tinybird-4.5.11.dev0 → tinybird-4.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: tinybird
-Version: 4.5.11.dev0
+Version: 4.6.0
 Summary: Tinybird Command Line Tool
 Home-page: https://www.tinybird.co/docs/forward/commands
 Author: Tinybird
@@ -52,10 +52,26 @@ The Tinybird command-line tool allows you to use all the Tinybird functionality
 Changelog
 ----------
 
-4.5.10
+4.6.0
 *******
 
+- `Added` Support for AWS DynamoDB datasource creation and management.
+
+4.5.12
+*******
+
+- `Fixed` `tb info` now lists branches and marks the current branch correctly when running on a branch.
+
+4.5.11
+*******
+
+- `Added` `tb connection create kafka` now supports SASL ``OAUTHBEARER`` for Amazon MSK clusters with IAM-based authentication. The wizard asks up-front whether the user already has an IAM role for the cluster — if yes, it collects region + role ARN + external ID directly; if no, it walks the user through creating the IAM access policy and trust policy in the AWS Console, copying them to the clipboard.
+- `Added` ``--oauthbearer-aws-external-id`` flag (and matching interactive prompt) so users can supply a pre-shared external ID instead of the one Tinybird auto-generates for the connection.
+- `Added` ``PLAINTEXT`` security protocol now skips the SASL mechanism prompt entirely.
+- `Added` ``.connection`` files generated by the wizard now emit ``KAFKA_SASL_OAUTHBEARER_METHOD``, ``KAFKA_SASL_OAUTHBEARER_AWS_REGION``, ``KAFKA_SASL_OAUTHBEARER_AWS_ROLE_ARN``, and ``KAFKA_SASL_OAUTHBEARER_AWS_EXTERNAL_ID``, with the role ARN stored as a ``tb_secret``.
+- `Fixed` ``tb connection create kafka`` now accepts comma-separated bootstrap-server lists (e.g. ``b-1.kafka:9092,b-2.kafka:9092``) instead of rejecting them as malformed. Validation passes as soon as any one broker is reachable, matching Kafka bootstrap semantics.
 - `Fixed` `tb init` now persists `folder` in `tinybird.config.json`, so subsequent resource creation targets the configured project folder instead of the repository root.
+- `Fixed` Branch names derived from Git refs are now sanitized in `tb preview --name` and `tb branch create/rm/clear`, preventing CI/CD failures with invalid workspace names.
 
 4.5.9
 *******

{tinybird-4.5.11.dev0 → tinybird-4.6.0}/tinybird/datafile/common.py

@@ -277,6 +277,13 @@ VALID_BLOB_STORAGE_CRON_VALUES = {
     "@auto",
 }
 
+REQUIRED_DYNAMODB_PARAMS = {
+    "import_connection_name",
+    "import_table_arn",
+    "import_export_bucket",
+}
+DYNAMODB_PARAMS = REQUIRED_DYNAMODB_PARAMS
+
 
 def extract_column_names_from_sorting_key_part(part: str) -> List[str]:
     """
@@ -575,8 +582,15 @@ class Datafile:
                 )
             if "kafka_group_id" in node and not str(node["kafka_group_id"]).strip():
                 raise DatafileValidationError("KAFKA_GROUP_ID cannot be empty")
+            # Validate DynamoDB params first since import_connection_name is shared with blob storage.
+            is_dynamodb = any(param in node for param in ("import_table_arn", "import_export_bucket"))
+            if is_dynamodb:
+                if missing := [param for param in REQUIRED_DYNAMODB_PARAMS if param not in node]:
+                    raise DatafileValidationError(
+                        f"Some DynamoDB params have been provided, but the following required ones are missing: {missing}"
+                    )
             # Validate S3 params
-            if any(param in node for param in BLOB_STORAGE_PARAMS):
+            elif any(param in node for param in BLOB_STORAGE_PARAMS):
                 if missing := [param for param in REQUIRED_BLOB_STORAGE_PARAMS if param not in node]:
                     raise DatafileValidationError(
                         f"Some connection params have been provided, but the following required ones are missing: {missing}"
@@ -2097,6 +2111,8 @@ def parse(
             "s3_arn": assign_var("s3_arn"),
             "s3_access_key": assign_var("s3_access_key"),
             "s3_secret": assign_var("s3_secret"),
+            "dynamodb_arn": assign_var("dynamodb_arn"),
+            "dynamodb_region": assign_var("dynamodb_region"),
             "gcs_service_account_credentials_json": assign_var_json("gcs_service_account_credentials_json"),
             "gcs_access_id": assign_var("gcs_hmac_access_id"),
             "gcs_secret": assign_var("gcs_hmac_secret"),

{tinybird-4.5.11.dev0 → tinybird-4.6.0}/tinybird/service_datasources.py

@@ -219,7 +219,9 @@ def get_tinybird_service_datasources() -> List[Dict[str, Any]]:
                 {"name": "processed_messages", "type": "Int32"},
                 {"name": "processed_bytes", "type": "Int32"},
                 {"name": "committed_messages", "type": "Int32"},
+                {"name": "time_read", "type": "Float32"},
                 {"name": "time_process", "type": "Float32"},
+                {"name": "time_write", "type": "Float32"},
                 {"name": "msg", "type": "String"},
             ],
         },
@@ -880,7 +882,9 @@ def get_organization_service_datasources() -> List[Dict[str, Any]]:
                 {"name": "processed_messages", "type": "Int32"},
                 {"name": "processed_bytes", "type": "Int32"},
                 {"name": "committed_messages", "type": "Int32"},
+                {"name": "time_read", "type": "Float32"},
                 {"name": "time_process", "type": "Float32"},
+                {"name": "time_write", "type": "Float32"},
                 {"name": "msg", "type": "String"},
             ],
         },

{tinybird-4.5.11.dev0 → tinybird-4.6.0}/tinybird/sql.py

@@ -398,6 +398,14 @@ def parse_table_structure(schema: str) -> List[Dict[str, Any]]:
     >>> parse_table_structure('c Nullable(Float32) DEFAULT NULL')
     [{'name': 'c', 'type': 'Float32', 'codec': None, 'default_value': None, 'jsonpath': None, 'nullable': True, 'normalized_name': 'c'}]
 
+    >>> parse_table_structure('c LowCardinality(Nullable(String))')
+    [{'name': 'c', 'type': 'LowCardinality(Nullable(String))', 'codec': None, 'default_value': None, 'jsonpath': None, 'nullable': False, 'normalized_name': 'c'}]
+
+    >>> parse_table_structure('c Nullable(LowCardinality(Nullable(String)))')
+    Traceback (most recent call last):
+    ...
+    ValueError: Nested type LowCardinality(Nullable(String)) cannot be inside Nullable type
+
     >>> parse_table_structure("c String DEFAULT 'bla'")
     [{'name': 'c', 'type': 'String', 'codec': None, 'default_value': "DEFAULT 'bla'", 'jsonpath': None, 'nullable': False, 'normalized_name': 'c'}]
 

{tinybird-4.5.11.dev0 → tinybird-4.6.0}/tinybird/tb/__cli__.py

@@ -4,5 +4,5 @@ __description__ = 'Tinybird Command Line Tool'
 __url__ = 'https://www.tinybird.co/docs/forward/commands'
 __author__ = 'Tinybird'
 __author_email__ = 'support@tinybird.co'
-__version__ = '4.5.11.dev0'
-__revision__ = 'e0b2a62'
+__version__ = '4.6.0'
+__revision__ = '1d9f802'

{tinybird-4.5.11.dev0 → tinybird-4.6.0}/tinybird/tb/client.py

@@ -1010,16 +1010,29 @@ class TinyB:
         kafka_sasl_mechanism="PLAIN",
         kafka_security_protocol="SASL_SSL",
         kafka_ssl_ca_pem=None,
+        kafka_sasl_oauthbearer_method=None,
+        kafka_sasl_oauthbearer_aws_region=None,
+        kafka_sasl_oauthbearer_aws_role_arn=None,
+        kafka_sasl_oauthbearer_aws_external_id=None,
     ):
+        is_oauthbearer = kafka_sasl_mechanism == "OAUTHBEARER"
         params = {
             "service": "kafka",
             "kafka_security_protocol": kafka_security_protocol,
             "kafka_sasl_mechanism": kafka_sasl_mechanism,
             "kafka_bootstrap_servers": kafka_bootstrap_servers,
-            "kafka_sasl_plain_username": kafka_key,
-            "kafka_sasl_plain_password": kafka_secret,
             "name": kafka_connection_name,
         }
+        if is_oauthbearer:
+            params["kafka_sasl_oauthbearer_method"] = kafka_sasl_oauthbearer_method
+            params["kafka_sasl_oauthbearer_aws_region"] = kafka_sasl_oauthbearer_aws_region
+            params["kafka_sasl_oauthbearer_aws_role_arn"] = kafka_sasl_oauthbearer_aws_role_arn
+            # external_id is optional; the server fills it in from the workspace if absent.
+            if kafka_sasl_oauthbearer_aws_external_id:
+                params["kafka_sasl_oauthbearer_aws_external_id"] = kafka_sasl_oauthbearer_aws_external_id
+        else:
+            params["kafka_sasl_plain_username"] = kafka_key
+            params["kafka_sasl_plain_password"] = kafka_secret
 
         if kafka_schema_registry_url:
             params["kafka_schema_registry_url"] = kafka_schema_registry_url
@@ -1170,6 +1183,21 @@ class TinyB:
         except Exception:
             return False
 
+    def validate_dynamodb(
+        self, table_arn: str, region: str, role_arn: str, external_id_seed: Optional[str] = None
+    ) -> Dict[str, Any]:
+        body: Dict[str, Any] = {"table_arn": table_arn, "region": region, "role_arn": role_arn}
+        if external_id_seed:
+            body["external_id_seed"] = external_id_seed
+        response = self._req_raw(
+            "/v1/integrations/dynamodb/validate",
+            method="POST",
+            data=json.dumps(body),
+        )
+        if response.status_code >= 400:
+            raise requests.HTTPError(parse_error_response(response), response=response)
+        return response.json()
+
     def get_trust_policy(self, service: str, external_id_seed: Optional[str] = None) -> Dict[str, Any]:
         params = {}
         if external_id_seed:
@@ -1182,10 +1210,15 @@ class TinyB:
             params["bucket"] = bucket
         return self._req(f"/v0/integrations/{service}/policies/write-access-policy?{urlencode(params)}")
 
-    def get_access_read_policy(self, service: str, bucket: Optional[str] = None) -> Dict[str, Any]:
+    def get_access_read_policy(
+        self, service: str, bucket: Optional[str] = None, table_name: Optional[str] = None
+    ) -> Dict[str, Any]:
         params = {}
         if bucket:
-            params["bucket"] = bucket
+            # The Kafka endpoint scopes the policy via `msk_cluster_arn`, not `bucket`.
+            params["msk_cluster_arn" if service == "kafka" else "bucket"] = bucket
+        if table_name:
+            params["table_name"] = table_name
         return self._req(f"/v0/integrations/{service}/policies/read-access-policy?{urlencode(params)}")
 
     def sql_get_format(self, sql: str, with_clickhouse_format: bool = False) -> str:

{tinybird-4.5.11.dev0 → tinybird-4.6.0}/tinybird/tb/modules/branch.py

@@ -7,7 +7,7 @@ from typing import Any, Dict, List, Optional, Tuple
 
 import click
 
-from tinybird.tb.modules.cli import cli
+from tinybird.tb.modules.cli import _looks_like_uuid, cli, ensure_valid_workspace_name
 from tinybird.tb.modules.common import (
     MAIN_BRANCH,
     create_workspace_branch,
@@ -93,7 +93,8 @@ def branch_ls(sort: bool) -> None:
     help="Wait for data branch jobs to finish, showing a progress bar. Disabled by default.",
 )
 def create_branch(branch_name: Optional[str], last_partition: bool, ignore_datasources: List[str], wait: bool) -> None:
-    create_workspace_branch(branch_name, last_partition, False, list(ignore_datasources), wait)
+    normalized_branch_name = ensure_valid_workspace_name(branch_name) if branch_name else branch_name
+    create_workspace_branch(normalized_branch_name, last_partition, False, list(ignore_datasources), wait)
 
 
 @branch.command(name="rm", short_help="Removes an branch from the workspace. It can't be recovered.")
@@ -194,11 +195,14 @@ def clear_branch(
     if branch_name_or_id:
         if branch_name_or_id == MAIN_BRANCH:
             raise CLIException(FeedbackManager.error_not_allowed_in_main_branch())
+        lookup_branch_name_or_id = (
+            branch_name_or_id if _looks_like_uuid(branch_name_or_id) else ensure_valid_workspace_name(branch_name_or_id)
+        )
         workspace_to_clear = next(
             (
                 workspace
                 for workspace in workspace_branches
-                if workspace["name"] == branch_name_or_id or workspace["id"] == branch_name_or_id
+                if workspace["name"] == lookup_branch_name_or_id or workspace["id"] == lookup_branch_name_or_id
             ),
             None,
         )
@@ -210,11 +214,16 @@ def clear_branch(
             raise CLIBranchException(FeedbackManager.error_not_a_branch(cli=get_cli_name()))
 
     if not workspace_to_clear:
-        raise CLIBranchException(FeedbackManager.error_branch(branch=branch_name_or_id or "", cli=get_cli_name()))
+        raise CLIBranchException(
+            FeedbackManager.error_branch(
+                branch=lookup_branch_name_or_id if branch_name_or_id else "",
+                cli=get_cli_name(),
+            )
+        )
 
     branch_name = workspace_to_clear["name"]
     if yes or click.confirm(FeedbackManager.warning_confirm_clear_workspace()):
-        was_current_branch = workspace_to_clear["id"] == config.get("id")
+        was_current_branch = workspace_to_clear["id"] == config["id"]
         client = config.get_client(token=current_main_workspace.get("token"))
         try:
             client.delete_branch(workspace_to_clear["id"])

{tinybird-4.5.11.dev0 → tinybird-4.6.0}/tinybird/tb/modules/build_common.py

@@ -247,6 +247,8 @@ def build_project(
             if load_fixtures:
                 append_project_fixtures(project, tb_client, project_files)
             echo_build_feedback(build.get("feedback", []))
+            if with_connections:
+                echo_dynamodb_local_backfill_feedback(build)
             return True
         elif build_result == "failed":
             error = format_build_errors(result.get("errors", []))
@@ -461,6 +463,29 @@ def echo_build_feedback(feedback: list[dict[str, Any]]) -> None:
         )
 
 
+def echo_dynamodb_local_backfill_feedback(build: dict[str, Any]) -> None:
+    datasources_by_id = {datasource.get("id"): datasource.get("name") for datasource in build.get("datasources", [])}
+    for data_linker in build.get("data_linkers", []):
+        if data_linker.get("service") != "dynamodb":
+            continue
+
+        settings = data_linker.get("settings") or {}
+        export_arn = settings.get("initial_export_arn")
+        if not export_arn:
+            continue
+
+        datasource_name = datasources_by_id.get(data_linker.get("datasource_id")) or "unknown"
+        click.echo(
+            FeedbackManager.warning(
+                message=(
+                    f"△ DynamoDB initial export backfill started for datasource '{datasource_name}'. "
+                    "AWS exports can stay in progress for several minutes; Tinybird Local will keep retrying "
+                    f"the import until AWS marks the export as completed. Export ARN: {export_arn}."
+                )
+            )
+        )
+
+
 def format_build_errors(build_errors: list[dict[str, Any]]) -> str:
     full_error_msg = ""
     for build_error in build_errors:

{tinybird-4.5.11.dev0 → tinybird-4.6.0}/tinybird/tb/modules/cli.py

@@ -68,6 +68,7 @@ PROJECT_TYPE_TYPESCRIPT = "ts-sdk"
 PROJECT_TYPE_PYTHON = "python-sdk"
 PROJECT_TYPE_CLI = "cli"
 PROJECT_TYPES = {PROJECT_TYPE_TYPESCRIPT, PROJECT_TYPE_PYTHON, PROJECT_TYPE_CLI}
+UUID_PATTERN = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.IGNORECASE)
 
 
 CLI_PROJECT_MARKERS = (
@@ -163,16 +164,44 @@ def is_main_git_branch(branch_name: Optional[str]) -> bool:
     return branch_name in {"main", "master"}
 
 
-def sanitize_branch_name(branch_name: str) -> str:
+def sanitize_branch_name(branch_name: str, *, enforce_workspace_prefix_rules: bool = True) -> str:
     sanitized = re.sub(r"[^a-zA-Z0-9_]", "_", branch_name)
     sanitized = re.sub(r"_+", "_", sanitized)
-    return sanitized.strip("_")
+    sanitized = sanitized.strip("_")
+    if enforce_workspace_prefix_rules:
+        if sanitized and sanitized[0].isdigit():
+            sanitized = f"branch_{sanitized}"
+        if sanitized.startswith("d_"):
+            sanitized = f"branch_{sanitized}"
+    return sanitized
+
+
+def _looks_like_uuid(value: str) -> bool:
+    return bool(UUID_PATTERN.fullmatch(value))
+
+
+def ensure_valid_workspace_name(name: str, *, context: str = "Branch") -> str:
+    sanitized = sanitize_branch_name(name)
+    if not sanitized:
+        raise CLIException(
+            FeedbackManager.error(
+                message=(
+                    f"{context} name '{name}' is not valid. "
+                    "Name must start with a letter and contain only letters, numbers, and underscores."
+                )
+            )
+        )
+
+    if sanitized != name:
+        click.echo(FeedbackManager.warning_branch_name_sanitized(context=context, original=name, sanitized=sanitized))
+
+    return sanitized
 
 
 def get_tinybird_branch_name_from_git_branch(branch_name: Optional[str]) -> Optional[str]:
     if not branch_name:
         return None
-    sanitized = sanitize_branch_name(branch_name)
+    sanitized = sanitize_branch_name(branch_name, enforce_workspace_prefix_rules=False)
     return sanitized or None
 
 

{tinybird-4.5.11.dev0 → tinybird-4.6.0}/tinybird/tb/modules/common.py

@@ -1105,26 +1105,57 @@ def is_url_valid(url):
         return False
 
 
-def validate_kafka_bootstrap_servers(host_and_port):
-    if not isinstance(host_and_port, str):
-        raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
-    parts = host_and_port.split(":")
+def _parse_kafka_host_port(entry: str) -> tuple[str, int]:
+    """Parse a single Kafka bootstrap entry of the form 'host' or 'host:port'.
+
+    Raises CLIException on malformed input. Defaults the port to 9092 when omitted.
+    """
+    parts = entry.split(":")
     if len(parts) > 2:
         raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
     host = parts[0]
     port_str = parts[1] if len(parts) == 2 else "9092"
     try:
-        port = int(port_str)
+        return host, int(port_str)
     except Exception:
         raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
-    with closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:
-        try:
-            sock.settimeout(3)
-            sock.connect((host, port))
-        except TimeoutError:
-            raise CLIException(FeedbackManager.error_kafka_bootstrap_server_conn_timeout(host=host, port=port))
-        except Exception:
-            raise CLIException(FeedbackManager.error_kafka_bootstrap_server_conn(host=host, port=port))
+
+
+def validate_kafka_bootstrap_servers(host_and_port):
+    """Validate a Kafka bootstrap-servers string (single entry or comma-separated list).
+
+    Format is checked for every entry. Connectivity is then probed per entry — Kafka
+    only needs one reachable bootstrap broker to discover the rest of the cluster,
+    so the validator passes as long as at least one host accepts a TCP connection.
+    The last connection error is re-raised when every host is unreachable.
+    """
+    if not isinstance(host_and_port, str):
+        raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
+
+    entries = [e.strip() for e in host_and_port.split(",") if e.strip()]
+    if not entries:
+        raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
+
+    # Format-check every entry up front so the user hears about all bad ones at
+    # once rather than discovering them sequentially.
+    hosts = [_parse_kafka_host_port(e) for e in entries]
+
+    last_error: Optional[CLIException] = None
+    for host, port in hosts:
+        with closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:
+            try:
+                sock.settimeout(3)
+                sock.connect((host, port))
+                return  # at least one reachable broker is enough
+            except TimeoutError:
+                last_error = CLIException(
+                    FeedbackManager.error_kafka_bootstrap_server_conn_timeout(host=host, port=port)
+                )
+            except Exception:
+                last_error = CLIException(FeedbackManager.error_kafka_bootstrap_server_conn(host=host, port=port))
+
+    if last_error is not None:
+        raise last_error
 
 
 def validate_kafka_key(s):
@@ -1137,9 +1168,11 @@ def validate_kafka_secret(s):
         raise CLIException("Password format is not correct, it must be a string")
 
 
-def validate_string_connector_param(param, s):
+def validate_string_connector_param(param: str, s: str) -> None:
     if not isinstance(s, str):
         raise CLIConnectionException(param + " format is not correct, it must be a string")
+    if not s or not s.strip():
+        raise CLIConnectionException(param + " cannot be empty")
 
 
 def validate_connection_name(client, connection_name, service):
@@ -1590,7 +1623,7 @@ def run_aws_iamrole_connection_flow(
     local_unavailable: bool = False,
 ) -> Tuple[str, str, Optional[TinyB], Optional[TinyB]]:
     """
-    Run the interactive AWS IAM Role connection flow for S3.
+    Run the interactive AWS IAM Role connection flow for S3 or DynamoDB.
 
     Guides the user through creating an IAM policy and role with the appropriate
     trust policy that includes AWS account IDs from the selected environments.
@@ -1598,7 +1631,7 @@ def run_aws_iamrole_connection_flow(
     Args:
         config: The CLI configuration dictionary.
         client: The TinyB client instance.
-        service: The data connector service type (e.g., 's3').
+        service: The data connector service type (e.g., 's3' or 'dynamodb').
         connection_name: The name for the connection being created.
         policy: The access policy type ('read' or 'write').
         local_unavailable: If True, local environment is unavailable (e.g., missing AWS credentials).
@@ -1606,23 +1639,41 @@ def run_aws_iamrole_connection_flow(
     Returns:
         A tuple containing:
             - role_arn (str): The AWS IAM Role ARN entered by the user.
-            - region (str): The AWS region where the bucket is located.
+            - region (str): The AWS region where the resource is located.
             - cloud_client (Optional[TinyB]): The TinyB client instance for the cloud environment.
             - local_client (Optional[TinyB]): The TinyB client instance for the local environment.
     """
+    bucket_name: Optional[str]
+    table_name: Optional[str] = None
+    region_prompt: str
     if service == DataConnectorType.AMAZON_DYNAMODB:
-        raise NotImplementedError("DynamoDB is not supported")
-
-    bucket_name = click.prompt(
-        FeedbackManager.highlight(
-            message="? Bucket name (specific name recommended, use '*' for unrestricted access in IAM policy)"
-        ),
-        prompt_suffix="\n> ",
-    )
-    validate_string_connector_param("Bucket", bucket_name)
+        table_name = click.prompt(
+            FeedbackManager.highlight(
+                message="? DynamoDB table name (specific name recommended, use '*' for unrestricted access in IAM policy)"
+            ),
+            prompt_suffix="\n> ",
+        )
+        validate_string_connector_param("DynamoDB table name", table_name)
+        bucket_name = click.prompt(
+            FeedbackManager.highlight(
+                message="? Export bucket name (specific name recommended, use '*' for unrestricted access in IAM policy)"
+            ),
+            prompt_suffix="\n> ",
+        )
+        validate_string_connector_param("Export bucket name", bucket_name)
+        region_prompt = "? Region (the region where the DynamoDB table is located)"
+    else:
+        bucket_name = click.prompt(
+            FeedbackManager.highlight(
+                message="? Bucket name (specific name recommended, use '*' for unrestricted access in IAM policy)"
+            ),
+            prompt_suffix="\n> ",
+        )
+        validate_string_connector_param("Bucket", bucket_name)
+        region_prompt = "? Region (the region where the bucket is located)"
 
     region = click.prompt(
-        FeedbackManager.highlight(message="? Region (the region where the bucket is located)"),
+        FeedbackManager.highlight(message=region_prompt),
         default="us-east-1",
         show_default=True,
         prompt_suffix="\n> ",
@@ -1705,15 +1756,27 @@ def run_aws_iamrole_connection_flow(
     # Use cloud_client as the main client if local is unavailable
     policy_client = cloud_client if local_unavailable and cloud_client else client
 
-    access_policy, trust_policy, _ = get_aws_iamrole_policies(
-        policy_client,
-        service=service,
-        policy=policy,
-        bucket=bucket_name,
-        external_id_seed=connection_name,
-        cloud_client=cloud_client if not local_unavailable else None,
-        local_client=local_client,
-    )
+    if table_name is not None:
+        access_policy, trust_policy, _ = get_aws_iamrole_policies(
+            policy_client,
+            service=service,
+            policy=policy,
+            bucket=bucket_name,
+            table_name=table_name,
+            external_id_seed=connection_name,
+            cloud_client=cloud_client if not local_unavailable else None,
+            local_client=local_client,
+        )
+    else:
+        access_policy, trust_policy, _ = get_aws_iamrole_policies(
+            policy_client,
+            service=service,
+            policy=policy,
+            bucket=bucket_name,
+            external_id_seed=connection_name,
+            cloud_client=cloud_client if not local_unavailable else None,
+            local_client=local_client,
+        )
 
     click.echo(FeedbackManager.gray(message="\n» Step 1: AWS Authentication"))
     click.echo(
@@ -1723,7 +1786,10 @@ def run_aws_iamrole_connection_flow(
     )
     click.echo(
         FeedbackManager.info(
-            message="You'll be creating a single IAM Policy and Role to access your S3 data. Using IAM Roles improves security by providing temporary credentials and following least privilege principles."
+            message=(
+                "You'll be creating a single IAM Policy and Role to access your data. "
+                "Using IAM Roles improves security by providing temporary credentials and following least privilege principles."
+            )
         )
     )
     click.echo(FeedbackManager.click_enter_to_continue())
@@ -1748,7 +1814,7 @@ def run_aws_iamrole_connection_flow(
         click.echo(FeedbackManager.info(message="3. Copy and paste the following policy:"))
     click.echo(FeedbackManager.highlight(message=f"\n{access_policy}\n"))
     click.echo(
-        FeedbackManager.info(message=f"4. Name the policy something meaningful (e.g., TinybirdS3Access-{bucket_name})")
+        FeedbackManager.info(message=f"4. Name the policy something meaningful (e.g., TinybirdAccess-{bucket_name})")
     )
     click.echo(FeedbackManager.info(message="5. Click 'Create policy'"))
     click.echo(FeedbackManager.click_enter_to_continue())
@@ -1774,7 +1840,7 @@ def run_aws_iamrole_connection_flow(
     click.echo(FeedbackManager.highlight(message=f"\n{trust_policy}\n"))
     click.echo(FeedbackManager.info(message="4. Click Next, search for and select the policy you just created"))
     click.echo(
-        FeedbackManager.info(message=f"5. Name the role something meaningful (e.g., TinybirdS3Role-{bucket_name})")
+        FeedbackManager.info(message=f"5. Name the role something meaningful (e.g., TinybirdRole-{bucket_name})")
     )
     click.echo(FeedbackManager.info(message="6. Click 'Create role'"))
     click.echo(FeedbackManager.info(message="7. Copy the Role ARN from the role details page"))
@@ -1921,6 +1987,7 @@ def get_aws_iamrole_policies(
     service: str,
     policy: str = "write",
     bucket: Optional[str] = None,
+    table_name: Optional[str] = None,
     external_id_seed: Optional[str] = None,
     cloud_client: Optional[TinyB] = None,
     local_client: Optional[TinyB] = None,
@@ -1946,7 +2013,7 @@ def get_aws_iamrole_policies(
         if policy == "write":
             access_policy = client.get_access_write_policy(service, bucket)
         elif policy == "read":
-            access_policy = client.get_access_read_policy(service, bucket)
+            access_policy = client.get_access_read_policy(service, bucket, table_name=table_name)
         else:
             raise Exception(f"Access policy {policy} not supported. Choose from 'read' or 'write'")
         if not len(access_policy) > 0: