> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Read S3 using an AWS web identity token file

> Exchange a runtime token file for an AWS role and read a Parquet dataset.

How-to guideApplies to: Unified engine deployments

Exchange a runtime token file for an AWS role and read a Parquet dataset.

## Before you start

Use an existing nonempty Parquet dataset and a configured S3 file-source root
covering its prefix. A credential does not authorize an arbitrary storage root.
The identity needs list/read access to the bucket and actual files, plus KMS
decrypt permission when needed. Use the region and HTTPS endpoint for that
bucket. Keep the temporary view and its SELECT in the same Workbench workspace.

Configure the role web-identity trust for the token issuer and audience. Mount a
valid subject-token file in the credential-service runtime. The target role
needs access to the S3 data.

## Values to collect

* Role ARN, token-file path, AWS region, bucket, prefix, and S3 endpoint.

## Run the SQL

Replace every `<placeholder>` before running. Use unused names for the resources
below. Run the statements in order in Workbench.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CREDENTIAL recipe_aws_web_identity_reader USING aws
OPTIONS (
  'authentication' = 'web_identity',
  'region' = '<aws-region>',
  'role_arn' = '<role-arn>',
  'token_file' = '<subject-token-file>'
);

CREATE OR REPLACE TEMPORARY VIEW recipe_aws_web_identity
USING parquet
OPTIONS (
  path 's3://<bucket>/<parquet-prefix>/',
  credential_reference 'recipe_aws_web_identity_reader',
  region '<aws-region>',
  endpoint '<s3-endpoint>',
  allow_http 'false'
);

SELECT * FROM recipe_aws_web_identity LIMIT 5;
```

## Check the result

The SELECT should return dataset rows. This checks the token exchange, role
trust, and S3 access together.

## Clean up

Remove the view and credential; leave the external role and token source in
place.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP VIEW recipe_aws_web_identity;
DROP CREDENTIAL recipe_aws_web_identity_reader;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.