Separate catalog and storage credentials

CREATE SECRET recipe_split_secret AS '<client-secret>';

CREATE CREDENTIAL recipe_split_oauth USING oauth2
OPTIONS (
  'authentication' = 'client_credentials',
  'client_id' = '<client-id>',
  'token_endpoint' = 'https://polaris.example.com/api/catalog/v1/oauth/tokens'
)
SECRETS ('client_secret' = 'recipe_split_secret');

CREATE CREDENTIAL recipe_split_source USING aws
OPTIONS (
  'authentication' = 'pod_identity',
  'region' = 'us-east-2'
);

CREATE CREDENTIAL recipe_split_storage USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'source' = 'recipe_split_source',
  'region' = 'us-east-2',
  'role_arn' = 'arn:aws:iam::123456789012:role/RecipeWarehouseReader',
  'session_name' = 'laminar-recipes'
);

CREATE CATALOG recipe_split_retail USING `iceberg-rest`
OPTIONS (
  'catalog.type' = 'polaris',
  'uri' = 'https://polaris.example.com/api/catalog',
  'warehouse' = 'retail',
  'auth.type' = 'oauth2',
  'oauth2-server-uri' = 'https://polaris.example.com/api/catalog/v1/oauth/tokens',
  'scope' = 'PRINCIPAL_ROLE:ALL',
  's3.region' = 'us-east-2',
  's3.endpoint' = 'https://s3.us-east-2.amazonaws.com',
  's3.allow-http' = 'false'
)
CREDENTIALS (
  'auth' = 'recipe_split_oauth',
  'storage' = 'recipe_split_storage'
);

SELECT i_item_sk, i_item_id
FROM recipe_split_retail.tpcds_sf1.item
ORDER BY i_item_sk
LIMIT 5;

DROP CATALOG recipe_split_retail;
DROP CREDENTIAL recipe_split_storage;
DROP CREDENTIAL recipe_split_source;
DROP CREDENTIAL recipe_split_oauth;
DROP SECRET recipe_split_secret;