Use the AWS credential chain or a profile

How-to guideApplies to: Unified engine deployments

Use an identity already available on the engine host. SQL saves the choice of authentication method; it does not copy credentials from your laptop.

Prepare the runtime identity

Use an existing S3 bucket containing Parquet files for the TPC-DS SF1 item table. The examples use s3://recipe-data/tpcds-sf1/item/ in us-east-2. Replace the bucket, path, and Region with your real values. The identity needs s3:ListBucket on the bucket and s3:GetObject on that prefix. Add kms:Decrypt when its objects use a customer-managed KMS key. Keep the view and query in the same SQL session. The host running the credential service needs a usable AWS SDK identity, such as Pod Identity, IRSA, environment credentials, or a mounted AWS profile. A named profile must exist on that host. If it uses SSO, its login session must already be available there. Workers must be able to reach the credential service.

Use the default chain

CREATE CREDENTIAL recipe_chain_reader USING aws
OPTIONS (
  'authentication' = 'default_chain',
  'region' = 'us-east-2'
);

CREATE OR REPLACE TEMPORARY VIEW recipe_chain_items
USING parquet
OPTIONS (
  path 's3://recipe-data/tpcds-sf1/item/',
  credential_reference 'recipe_chain_reader',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_chain_items
ORDER BY i_item_sk
LIMIT 5;

The AWS SDK chooses a source from its available chain. Use an explicit method when the recipe must select one identity source rather than use that order.

Select a named profile

Replace analytics with a profile installed on the credential-service host:

CREATE CREDENTIAL recipe_profile_reader USING aws
OPTIONS (
  'authentication' = 'profile',
  'profile' = 'analytics',
  'region' = 'us-east-2'
);

CREATE OR REPLACE TEMPORARY VIEW recipe_profile_items
USING parquet
OPTIONS (
  path 's3://recipe-data/tpcds-sf1/item/',
  credential_reference 'recipe_profile_reader',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_profile_items
ORDER BY i_item_sk
LIMIT 5;

A profile can use SDK-supported role, process, or SSO configuration. Those files and helper programs are runtime setup, not SQL resources. When finished, remove the resources for the variants you ran:

DROP VIEW IF EXISTS recipe_profile_items;
DROP VIEW IF EXISTS recipe_chain_items;
DROP CREDENTIAL IF EXISTS recipe_profile_reader;
DROP CREDENTIAL IF EXISTS recipe_chain_reader;

Transformation Engine

Learn Laminar

Workloads

SQL reference

HTTP API

Recipes

Operations

Use the AWS credential chain or a profile

Prepare the runtime identity

Use the default chain

Select a named profile

​Prepare the runtime identity

​Use the default chain

​Select a named profile

Prepare the runtime identity

Use the default chain

Select a named profile