> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to Amazon S3 Tables using an assumed role

> Register Amazon S3 Tables and read a table with the selected AWS identity.

How-to guideApplies to: Unified engine deployments

Register Amazon S3 Tables and read a table with the selected AWS identity.

## Before you start

Use an existing catalog with at least one readable Iceberg table. The engine and
workers must reach the catalog and its table storage. Have the remote identity
and permissions ready before creating the Unified registration. Replace the
namespace and table with one you know has data.

The identity comes from the engine runtime, not your browser or laptop. Grant
catalog metadata access and access to the actual table-file prefixes, including
any required KMS keys. The source identity needs permission to assume the target
role, and that role must trust the source. Copy the table bucket ARN and the
REST URI for its region. The signing region must match the ARN. This is an S3
Tables table bucket, not an ordinary S3 bucket.

## Values to collect

* AWS region, namespace, table, and service-specific catalog identifiers.
* Target role ARN and a working source identity.

## Run the SQL

Replace every `<placeholder>` before running. Use unused names for the resources
below. Run the statements in order in Workbench.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CREDENTIAL recipe_s3_tables_assume_role_source USING aws
OPTIONS (
  'authentication' = 'default_chain',
  'region' = '<aws-region>'
);

CREATE CREDENTIAL recipe_s3_tables_assume_role_auth USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'region' = '<aws-region>',
  'source' = 'recipe_s3_tables_assume_role_source',
  'role_arn' = '<role-arn>'
);

CREATE CATALOG recipe_s3_tables_assume_role USING `iceberg-rest`
OPTIONS (
  'uri' = '<catalog-api-uri>',
  'warehouse' = 'arn:aws:s3tables:<aws-region>:<account-id>:bucket/<table-bucket-name>',
  'auth.type' = 'sigv4',
  'rest.signing-name' = 's3tables',
  'rest.signing-region' = '<aws-region>',
  'catalog.type' = 's3-tables',
  'header.x-iceberg-access-delegation' = 'vended-credentials'
)
CREDENTIALS ('auth' = 'recipe_s3_tables_assume_role_auth');

SELECT *
FROM recipe_s3_tables_assume_role.`<namespace>`.`<table>`
LIMIT 5;
```

## Check the result

The SELECT should return up to five rows from the chosen table. Use a nonempty
table for this check. This verifies both metadata and table-file access;
creating the registration alone does not verify either.

## Clean up

This removes only the Unified registrations. It leaves the remote catalog and
its tables in place.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_s3_tables_assume_role;
DROP CREDENTIAL recipe_s3_tables_assume_role_auth;
DROP CREDENTIAL recipe_s3_tables_assume_role_source;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.