> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use the AWS credential chain or a profile

> Use an identity already available on the engine host. SQL saves the choice of

How-to guideApplies to: Unified engine deployments

Use an identity already available on the engine host. SQL saves the choice of
authentication method; it does not copy credentials from your laptop.

## Prepare the runtime identity

Use an existing S3 bucket containing Parquet files for the TPC-DS SF1 `item`
table. The examples use `s3://recipe-data/tpcds-sf1/item/` in `us-east-2`.
Replace the bucket, path, and Region with your real values. The identity needs
`s3:ListBucket` on the bucket and `s3:GetObject` on that prefix. Add `kms:Decrypt`
when its objects use a customer-managed KMS key. Keep the view and query in the
same SQL session.

The host running the credential service needs a usable AWS SDK identity, such
as Pod Identity, IRSA, environment credentials, or a mounted AWS profile. A
named profile must exist on that host. If it uses SSO, its login session must
already be available there. Workers must be able to reach the credential service.

## Use the default chain

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CREDENTIAL recipe_chain_reader USING aws
OPTIONS (
  'authentication' = 'default_chain',
  'region' = 'us-east-2'
);
```

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE OR REPLACE TEMPORARY VIEW recipe_chain_items
USING parquet
OPTIONS (
  path 's3://recipe-data/tpcds-sf1/item/',
  credential_reference 'recipe_chain_reader',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_chain_items
ORDER BY i_item_sk
LIMIT 5;
```

The AWS SDK chooses a source from its available chain. Use an explicit method
when the recipe must select one identity source rather than use that order.

## Select a named profile

Replace `analytics` with a profile installed on the credential-service host:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CREDENTIAL recipe_profile_reader USING aws
OPTIONS (
  'authentication' = 'profile',
  'profile' = 'analytics',
  'region' = 'us-east-2'
);
```

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE OR REPLACE TEMPORARY VIEW recipe_profile_items
USING parquet
OPTIONS (
  path 's3://recipe-data/tpcds-sf1/item/',
  credential_reference 'recipe_profile_reader',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_profile_items
ORDER BY i_item_sk
LIMIT 5;
```

A profile can use SDK-supported role, process, or SSO configuration. Those files
and helper programs are runtime setup, not SQL resources.

When finished, remove the resources for the variants you ran:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP VIEW IF EXISTS recipe_profile_items;
DROP VIEW IF EXISTS recipe_chain_items;
DROP CREDENTIAL IF EXISTS recipe_profile_reader;
DROP CREDENTIAL IF EXISTS recipe_chain_reader;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.