> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use multiple AWS identities

> Read two S3 prefixes in one SQL session, using a different named AWS role for

How-to guideApplies to: Unified engine deployments

Read two S3 prefixes in one SQL session, using a different named AWS role for
each view. A query does not have to switch a global AWS credential.

## Prepare separate permissions

Use an existing EKS Pod Identity as described in
[Assume an AWS role](https://docs.e6data.com/transformation/recipes/credentials/assume-role.md#prepare-the-source-and-target). Provide two
target roles that this source can assume. Role A needs read access to
`s3://recipe-data-a/tpcds-sf1/item/`; role B needs read access to the matching
prefix in `recipe-data-b`. Use existing SF1 item Parquet data in each bucket.
Replace the bucket names, role ARNs, and Regions with your values. Give each role
its intended S3 and KMS permissions. For a clear isolation check, use roles that
do not also have access to the other bucket.

## Create both role credentials

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CREDENTIAL recipe_multi_source USING aws
OPTIONS ('authentication' = 'pod_identity', 'region' = 'us-east-2');

CREATE CREDENTIAL recipe_reader_a USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'source' = 'recipe_multi_source',
  'region' = 'us-east-2',
  'role_arn' = 'arn:aws:iam::123456789012:role/RecipeReaderA',
  'session_name' = 'laminar-recipe-a'
);

CREATE CREDENTIAL recipe_reader_b USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'source' = 'recipe_multi_source',
  'region' = 'us-east-2',
  'role_arn' = 'arn:aws:iam::123456789012:role/RecipeReaderB',
  'session_name' = 'laminar-recipe-b'
);
```

## Bind the identity to each source

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE OR REPLACE TEMPORARY VIEW recipe_items_a
USING parquet
OPTIONS (
  path 's3://recipe-data-a/tpcds-sf1/item/',
  credential_reference 'recipe_reader_a',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_items_a
ORDER BY i_item_sk
LIMIT 5;
```

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE OR REPLACE TEMPORARY VIEW recipe_items_b
USING parquet
OPTIONS (
  path 's3://recipe-data-b/tpcds-sf1/item/',
  credential_reference 'recipe_reader_b',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_items_b
ORDER BY i_item_sk
LIMIT 5;
```

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
SELECT 'a' AS source, COUNT(*) AS item_count FROM recipe_items_a
UNION ALL
SELECT 'b' AS source, COUNT(*) AS item_count FROM recipe_items_b;
```

The final result has one count per source. Each view keeps its own credential
reference. With the restricted fixture roles above, a read using the other
role should fail with an access error; successful row counts alone do not
establish permission isolation.

When finished:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP VIEW recipe_items_a;
DROP VIEW recipe_items_b;
DROP CREDENTIAL recipe_reader_a;
DROP CREDENTIAL recipe_reader_b;
DROP CREDENTIAL recipe_multi_source;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.