> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use AWS Parameter Store

> Use a local secret name for a client secret held in AWS. The local resource

How-to guideApplies to: Unified engine deployments

Use a local secret name for a client secret held in AWS. The local resource
contains a reference; the value stays managed by the external provider.

## Prepare the external source

Have an administrator create SecureString parameter
`/laminar/recipes/polaris-client-secret` containing the raw Polaris client secret.
The engine's secret-service identity needs `ssm:GetParameter` and any required
`kms:Decrypt` permission.

Configure engine provider alias `recipe_ssm` with type `aws-ssm`. Set its
`region` to the parameter's Region; set `profile` only when using an AWS profile
available on the secret-service host. This provider uses the AWS SDK and its
runtime identity. It does not need AWS CLI. Load the configuration before
running the SQL. See [Secrets configuration](https://docs.e6data.com/transformation/operations/configuration/secrets.md#aws-parameter-store).

Use an existing Polaris catalog with a `retail` warehouse and the SF1 `item`
table in namespace `tpcds_sf1`. Replace the example URLs, client ID, warehouse,
namespace, and Region with your values. The Polaris client needs access to the
warehouse and table. These examples request `PRINCIPAL_ROLE:ALL`; use the scope
granted to your client.

For the final SELECT, Polaris must supply usable temporary S3 credentials for
the table. Otherwise attach a separate storage credential as shown in
[Separate catalog and storage credentials](https://docs.e6data.com/transformation/recipes/credentials/separate-catalog-storage.md).
A successful login or table listing alone does not prove S3 access.

See AWS guidance on [SecureString encryption and decryption](https://docs.aws.amazon.com/systems-manager/latest/userguide/secure-string-parameter-kms-encryption.html).

## Create the reference and query data

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_remote_client_secret
USING 'recipe_ssm:///laminar/recipes/polaris-client-secret';

DESCRIBE SECRET recipe_remote_client_secret;

CREATE CREDENTIAL recipe_remote_oauth USING oauth2
OPTIONS (
  'authentication' = 'client_credentials',
  'client_id' = '<client-id>',
  'token_endpoint' = 'https://polaris.example.com/api/catalog/v1/oauth/tokens'
)
SECRETS ('client_secret' = 'recipe_remote_client_secret');

CREATE CATALOG recipe_remote_retail USING `iceberg-rest`
OPTIONS (
  'catalog.type' = 'polaris',
  'uri' = 'https://polaris.example.com/api/catalog',
  'warehouse' = 'retail',
  'auth.type' = 'oauth2',
  'oauth2-server-uri' = 'https://polaris.example.com/api/catalog/v1/oauth/tokens',
  'scope' = 'PRINCIPAL_ROLE:ALL',
  's3.region' = 'us-east-2',
  's3.endpoint' = 'https://s3.us-east-2.amazonaws.com',
  's3.allow-http' = 'false'
)
CREDENTIALS (
  'auth' = 'recipe_remote_oauth'
);

SELECT i_item_sk, i_item_id
FROM recipe_remote_retail.tpcds_sf1.item
ORDER BY i_item_sk
LIMIT 5;
```

The reference uses the configured alias, not an automatically registered AWS
provider name. A successful SELECT confirms the reference can resolve, OAuth
can obtain a token, and the table files can be read.

## Remove the local resources

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_remote_retail;
DROP CREDENTIAL recipe_remote_oauth;
DROP SECRET recipe_remote_client_secret;
```

This does not delete the AWS secret or parameter.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.