> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pin an AWS Parameter Store secret version

> Create a new reference fixed to one existing remote secret version.

How-to guideApplies to: Unified engine deployments

Create a new reference fixed to one existing remote secret version.

## Before you start

Configure recipe\_ssm using [the provider setup recipe](https://docs.e6data.com/transformation/recipes/secrets/aws-parameter-store.md).
Store raw bearer-token text for an existing Iceberg REST catalog in the selected
secret. Use a valid existing version number supplied by Parameter Store. The
engine and workers need access to the catalog and its table files. The catalog
must supply temporary storage credentials or the table location must already be
configured.

## Values to collect

* Remote secret name, exact version, catalog API URI, warehouse, namespace, and
  table.

## Run the SQL

Replace every `<placeholder>` before running. Use unused names for the resources
below. Run the statements in order in Workbench.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_aws_parameter_store_pinned_secret
USING 'recipe_ssm:///laminar/recipes/catalog-token?version=7';
DESCRIBE SECRET recipe_aws_parameter_store_pinned_secret;

CREATE CREDENTIAL recipe_aws_parameter_store_pinned_auth USING bearer
OPTIONS (
  'authentication' = 'saved'
)
SECRETS ('token' = 'recipe_aws_parameter_store_pinned_secret');

CREATE CATALOG recipe_aws_parameter_store_pinned USING `iceberg-rest`
OPTIONS ('uri' = '<catalog-api-uri>', 'warehouse' = '<warehouse>', 'auth.type' = 'bearer', 'header.x-iceberg-access-delegation' = 'vended-credentials')
CREDENTIALS ('auth' = 'recipe_aws_parameter_store_pinned_auth');

SELECT *
FROM recipe_aws_parameter_store_pinned.`<namespace>`.`<table>`
LIMIT 5;
```

## Check the result

The SELECT should return up to five rows from the chosen table. Use a nonempty
table for this check. This verifies both metadata and table-file access;
creating the registration alone does not verify either. DESCRIBE should show the
pinned reference without returning token text.

## Clean up

This removes only the Unified registrations. It leaves the remote catalog and
its tables in place.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_aws_parameter_store_pinned;
DROP CREDENTIAL recipe_aws_parameter_store_pinned_auth;
DROP SECRET recipe_aws_parameter_store_pinned_secret;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.