> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Read S3 using saved AWS keys

> Create a named credential from secret references, then bind that credential to

How-to guideApplies to: Unified engine deployments

Create a named credential from secret references, then bind that credential to
a Parquet view.

## Have keys and a data prefix ready

Use an existing S3 bucket containing Parquet files for the TPC-DS SF1 `item`
table. The examples use `s3://recipe-data/tpcds-sf1/item/` in `us-east-2`.
Replace the bucket, path, and Region with your real values. The identity needs
`s3:ListBucket` on the bucket and `s3:GetObject` on that prefix. Add `kms:Decrypt`
when its objects use a customer-managed KMS key. Keep the view and query in the
same SQL session.

Obtain the key pair from AWS outside SQL. This recipe does not create IAM users
or access keys. For temporary credentials, also obtain their session token and
keep all three values from the same session. Local secrets need the
[encrypted secret store](https://docs.e6data.com/transformation/recipes/overview.md#running-the-sql).

## Save the key references

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_aws_access_key AS '<access-key-id>';
CREATE SECRET recipe_aws_secret_key AS '<secret-access-key>';

CREATE CREDENTIAL recipe_saved_reader USING aws
OPTIONS ('authentication' = 'saved')
SECRETS (
  'access_key_id' = 'recipe_aws_access_key',
  'secret_access_key' = 'recipe_aws_secret_key'
);
```

For temporary keys, add their session token before running the data query:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_aws_session_token AS '<session-token>';
ALTER CREDENTIAL recipe_saved_reader
SET SECRETS ('session_token' = 'recipe_aws_session_token');
```

Omit this optional block for long-lived keys. A saved session token is not
automatically renewed. Replace all session values together when they expire.

## Read using the named credential

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE OR REPLACE TEMPORARY VIEW recipe_saved_items
USING parquet
OPTIONS (
  path 's3://recipe-data/tpcds-sf1/item/',
  credential_reference 'recipe_saved_reader',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_saved_items
ORDER BY i_item_sk
LIMIT 5;
```

Expect up to five item rows. The credential selects the keys; the view's Region
selects the S3 endpoint. Saved AWS credentials do not accept a Region option.

When finished:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP VIEW recipe_saved_items;
DROP CREDENTIAL recipe_saved_reader;
DROP SECRET IF EXISTS recipe_aws_session_token;
DROP SECRET recipe_aws_secret_key;
DROP SECRET recipe_aws_access_key;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.