Use multiple AWS identities

How-to guideApplies to: Unified engine deployments

Read two S3 prefixes in one SQL session, using a different named AWS role for each view. A query does not have to switch a global AWS credential.

Prepare separate permissions

Use an existing EKS Pod Identity as described in Assume an AWS role. Provide two target roles that this source can assume. Role A needs read access to s3://recipe-data-a/tpcds-sf1/item/; role B needs read access to the matching prefix in recipe-data-b. Use existing SF1 item Parquet data in each bucket. Replace the bucket names, role ARNs, and Regions with your values. Give each role its intended S3 and KMS permissions. For a clear isolation check, use roles that do not also have access to the other bucket.

Create both role credentials

CREATE CREDENTIAL recipe_multi_source USING aws
OPTIONS ('authentication' = 'pod_identity', 'region' = 'us-east-2');

CREATE CREDENTIAL recipe_reader_a USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'source' = 'recipe_multi_source',
  'region' = 'us-east-2',
  'role_arn' = 'arn:aws:iam::123456789012:role/RecipeReaderA',
  'session_name' = 'laminar-recipe-a'
);

CREATE CREDENTIAL recipe_reader_b USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'source' = 'recipe_multi_source',
  'region' = 'us-east-2',
  'role_arn' = 'arn:aws:iam::123456789012:role/RecipeReaderB',
  'session_name' = 'laminar-recipe-b'
);

Bind the identity to each source

CREATE OR REPLACE TEMPORARY VIEW recipe_items_a
USING parquet
OPTIONS (
  path 's3://recipe-data-a/tpcds-sf1/item/',
  credential_reference 'recipe_reader_a',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_items_a
ORDER BY i_item_sk
LIMIT 5;

CREATE OR REPLACE TEMPORARY VIEW recipe_items_b
USING parquet
OPTIONS (
  path 's3://recipe-data-b/tpcds-sf1/item/',
  credential_reference 'recipe_reader_b',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_items_b
ORDER BY i_item_sk
LIMIT 5;

SELECT 'a' AS source, COUNT(*) AS item_count FROM recipe_items_a
UNION ALL
SELECT 'b' AS source, COUNT(*) AS item_count FROM recipe_items_b;

The final result has one count per source. Each view keeps its own credential reference. With the restricted fixture roles above, a read using the other role should fail with an access error; successful row counts alone do not establish permission isolation. When finished:

DROP VIEW recipe_items_a;
DROP VIEW recipe_items_b;
DROP CREDENTIAL recipe_reader_a;
DROP CREDENTIAL recipe_reader_b;
DROP CREDENTIAL recipe_multi_source;

Transformation Engine

Learn Laminar

Workloads

SQL reference

HTTP API

Recipes

Operations

Use multiple AWS identities

Prepare separate permissions

Create both role credentials

Bind the identity to each source

​Prepare separate permissions

​Create both role credentials

​Bind the identity to each source

Prepare separate permissions

Create both role credentials

Bind the identity to each source