> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Assume an AWS role

> Use one named AWS identity to obtain temporary credentials for another IAM role.

How-to guideApplies to: Unified engine deployments

Use one named AWS identity to obtain temporary credentials for another IAM role.

## Prepare the source and target

Use an existing S3 bucket containing Parquet files for the TPC-DS SF1 `item`
table. The examples use `s3://recipe-data/tpcds-sf1/item/` in `us-east-2`.
Replace the bucket, path, and Region with your real values. The identity needs
`s3:ListBucket` on the bucket and `s3:GetObject` on that prefix. Add `kms:Decrypt`
when its objects use a customer-managed KMS key. Keep the view and query in the
same SQL session.

This example uses an existing EKS Pod Identity as the source. Complete its
[runtime setup](https://docs.e6data.com/transformation/recipes/credentials/eks-pod-identity.md#prepare-the-eks-identity) first. Use an existing
target role whose trust policy accepts that source, and grant the source
`sts:AssumeRole` on the target. Give the target access to the input S3 prefix.
Replace the sample role ARN with your real role ARN. The example uses a
same-account role; SQL does not create either role or its policies.

## Define the source before the derived credential

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CREDENTIAL recipe_role_source USING aws
OPTIONS (
  'authentication' = 'pod_identity',
  'region' = 'us-east-2'
);

CREATE CREDENTIAL recipe_warehouse_role USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'source' = 'recipe_role_source',
  'region' = 'us-east-2',
  'role_arn' = 'arn:aws:iam::123456789012:role/RecipeWarehouseReader',
  'session_name' = 'laminar-recipes'
);
```

`source` is the name of another credential, not an AWS role ARN. Source chains
must not refer back to themselves.

## Read with the assumed role

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE OR REPLACE TEMPORARY VIEW recipe_role_items
USING parquet
OPTIONS (
  path 's3://recipe-data/tpcds-sf1/item/',
  credential_reference 'recipe_warehouse_role',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_role_items
ORDER BY i_item_sk
LIMIT 5;
```

The data read uses the role credential selected by the view. To supply an
external ID required by the target's trust policy, set it on that credential:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
ALTER CREDENTIAL recipe_warehouse_role
SET OPTIONS ('external_id' = '<required-external-id>');
```

Only run that block when the role requires the supplied value, then repeat the
SELECT. Optional `duration_seconds`, `policy`, and `policy_arns` also belong to
the role credential. They do not grant permissions beyond the role's policy.

When finished:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP VIEW recipe_role_items;
DROP CREDENTIAL recipe_warehouse_role;
DROP CREDENTIAL recipe_role_source;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.