How-to guideApplies to: Unified engine deployments
Use one named AWS identity to obtain temporary credentials for another IAM role.
Prepare the source and target
Use an existing S3 bucket containing Parquet files for the TPC-DS SF1 item
table. The examples use s3://recipe-data/tpcds-sf1/item/ in us-east-2.
Replace the bucket, path, and Region with your real values. The identity needs
s3:ListBucket on the bucket and s3:GetObject on that prefix. Add kms:Decrypt
when its objects use a customer-managed KMS key. Keep the view and query in the
same SQL session.
This example uses an existing EKS Pod Identity as the source. Complete its
runtime setup first. Use an existing
target role whose trust policy accepts that source, and grant the source
sts:AssumeRole on the target. Give the target access to the input S3 prefix.
Replace the sample role ARN with your real role ARN. The example uses a
same-account role; SQL does not create either role or its policies.
Define the source before the derived credential
source is the name of another credential, not an AWS role ARN. Source chains
must not refer back to themselves.
Read with the assumed role
The data read uses the role credential selected by the view. To supply an
external ID required by the target’s trust policy, set it on that credential:
Only run that block when the role requires the supplied value, then repeat the
SELECT. Optional duration_seconds, policy, and policy_arns also belong to
the role credential. They do not grant permissions beyond the role’s policy.
When finished:
Last modified on November 4, 2026
