> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Separate catalog and storage credentials

> Log in to Polaris with OAuth, then read its S3 table files using an assumed AWS

How-to guideApplies to: Unified engine deployments

Log in to Polaris with OAuth, then read its S3 table files using an assumed AWS
role. The catalog selects separate named credentials for `auth` and `storage`.

## Prepare both access paths

Use an existing Polaris catalog with a `retail` warehouse and the SF1 `item`
table in namespace `tpcds_sf1`. Replace the example URLs, client ID, warehouse,
namespace, and Region with your values. The Polaris client needs access to the
warehouse and table. These examples request `PRINCIPAL_ROLE:ALL`; use the scope
granted to your client.

The table's data must be in S3. Configure an EKS Pod Identity for the
credential-service host and an existing target role as described in
[Assume an AWS role](https://docs.e6data.com/transformation/recipes/credentials/assume-role.md#prepare-the-source-and-target). The target
role needs list/read access to the table's actual metadata, data, and delete-file
prefixes, plus KMS access when needed. Replace the sample role ARN and client
secret. No catalog-vended S3 credentials are required for this recipe.

## Define the two identities

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_split_secret AS '<client-secret>';

CREATE CREDENTIAL recipe_split_oauth USING oauth2
OPTIONS (
  'authentication' = 'client_credentials',
  'client_id' = '<client-id>',
  'token_endpoint' = 'https://polaris.example.com/api/catalog/v1/oauth/tokens'
)
SECRETS ('client_secret' = 'recipe_split_secret');

CREATE CREDENTIAL recipe_split_source USING aws
OPTIONS (
  'authentication' = 'pod_identity',
  'region' = 'us-east-2'
);

CREATE CREDENTIAL recipe_split_storage USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'source' = 'recipe_split_source',
  'region' = 'us-east-2',
  'role_arn' = 'arn:aws:iam::123456789012:role/RecipeWarehouseReader',
  'session_name' = 'laminar-recipes'
);
```

## Attach each credential to its role

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CATALOG recipe_split_retail USING `iceberg-rest`
OPTIONS (
  'catalog.type' = 'polaris',
  'uri' = 'https://polaris.example.com/api/catalog',
  'warehouse' = 'retail',
  'auth.type' = 'oauth2',
  'oauth2-server-uri' = 'https://polaris.example.com/api/catalog/v1/oauth/tokens',
  'scope' = 'PRINCIPAL_ROLE:ALL',
  's3.region' = 'us-east-2',
  's3.endpoint' = 'https://s3.us-east-2.amazonaws.com',
  's3.allow-http' = 'false'
)
CREDENTIALS (
  'auth' = 'recipe_split_oauth',
  'storage' = 'recipe_split_storage'
);

SELECT i_item_sk, i_item_id
FROM recipe_split_retail.tpcds_sf1.item
ORDER BY i_item_sk
LIMIT 5;
```

`s3.region` is a catalog option used to open the table's S3 files. The role ARN
and session name are credential options used to acquire AWS credentials.
`auth` selects OAuth for metadata requests; `storage` selects the AWS role for
file reads. An explicit storage reference takes priority over vended credentials.

When finished:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_split_retail;
DROP CREDENTIAL recipe_split_storage;
DROP CREDENTIAL recipe_split_source;
DROP CREDENTIAL recipe_split_oauth;
DROP SECRET recipe_split_secret;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.