> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Read S3 Parquet using an assumed role with an external ID

> Create the selected AWS credential, bind it to a file view, and read Parquet

How-to guideApplies to: Unified engine deployments

Create the selected AWS credential, bind it to a file view, and read Parquet
rows.

## Before you start

Use an existing nonempty Parquet dataset and a configured S3 file-source root
covering its prefix. A credential does not authorize an arbitrary storage root.
The identity needs list/read access to the bucket and actual files, plus KMS
decrypt permission when needed. Use the region and HTTPS endpoint for that
bucket. Keep the temporary view and its SELECT in the same Workbench workspace.

The target role trust policy must require the supplied external ID and trust the
source identity. The source must be allowed to assume the target role.

## Values to collect

* Bucket, Parquet prefix, AWS region, HTTPS S3 endpoint, and the
  identity-specific values shown below.

## Run the SQL

Replace every `<placeholder>` before running. Use unused names for the resources
below. Run the statements in order in Workbench.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CREDENTIAL recipe_assume_role_external_id_source USING aws
OPTIONS (
  'authentication' = 'default_chain',
  'region' = '<aws-region>'
);

CREATE CREDENTIAL recipe_assume_role_external_id_reader USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'region' = '<aws-region>',
  'source' = 'recipe_assume_role_external_id_source',
  'role_arn' = '<role-arn>',
  'external_id' = '<external-id>'
);

CREATE OR REPLACE TEMPORARY VIEW recipe_assume_role_external_id
USING parquet
OPTIONS (
  path 's3://<bucket>/<parquet-prefix>/',
  credential_reference 'recipe_assume_role_external_id_reader',
  region '<aws-region>',
  endpoint '<s3-endpoint>',
  allow_http 'false'
);

SELECT * FROM recipe_assume_role_external_id LIMIT 5;
```

## Check the result

Expect up to five rows from the Parquet files. Creating or describing the
credential alone does not verify S3 access.

## Clean up

Remove the temporary view and credentials. The input files stay in place.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP VIEW recipe_assume_role_external_id;
DROP CREDENTIAL recipe_assume_role_external_id_reader;
DROP CREDENTIAL recipe_assume_role_external_id_source;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.