Pin an AWS Secrets Manager secret version

How-to guideApplies to: Unified engine deployments

Create a new reference fixed to one existing remote secret version.

Before you start

Configure recipe_sm using the provider setup recipe. Store raw bearer-token text for an existing Iceberg REST catalog in the selected secret. Use a valid existing version ID supplied by Secrets Manager. The engine and workers need access to the catalog and its table files. The catalog must supply temporary storage credentials or the table location must already be configured.

Values to collect

Remote secret name, exact version, catalog API URI, warehouse, namespace, and table.

Run the SQL

Replace every <placeholder> before running. Use unused names for the resources below. Run the statements in order in Workbench.

CREATE SECRET recipe_aws_secrets_manager_pinned_secret
USING 'recipe_sm:///laminar/recipes/catalog-token?version=<version-id>';
DESCRIBE SECRET recipe_aws_secrets_manager_pinned_secret;

CREATE CREDENTIAL recipe_aws_secrets_manager_pinned_auth USING bearer
OPTIONS (
  'authentication' = 'saved'
)
SECRETS ('token' = 'recipe_aws_secrets_manager_pinned_secret');

CREATE CATALOG recipe_aws_secrets_manager_pinned USING `iceberg-rest`
OPTIONS ('uri' = '<catalog-api-uri>', 'warehouse' = '<warehouse>', 'auth.type' = 'bearer', 'header.x-iceberg-access-delegation' = 'vended-credentials')
CREDENTIALS ('auth' = 'recipe_aws_secrets_manager_pinned_auth');

SELECT *
FROM recipe_aws_secrets_manager_pinned.`<namespace>`.`<table>`
LIMIT 5;

Check the result

The SELECT should return up to five rows from the chosen table. Use a nonempty table for this check. This verifies both metadata and table-file access; creating the registration alone does not verify either. DESCRIBE should show the pinned reference without returning token text.

Clean up

This removes only the Unified registrations. It leaves the remote catalog and its tables in place.

DROP CATALOG recipe_aws_secrets_manager_pinned;
DROP CREDENTIAL recipe_aws_secrets_manager_pinned_auth;
DROP SECRET recipe_aws_secrets_manager_pinned_secret;

Last modified on November 4, 2026

Transformation Engine

Learn Laminar

Workloads

SQL reference

HTTP API

Recipes

Operations

Pin an AWS Secrets Manager secret version

Before you start

Values to collect

Run the SQL

Check the result

Clean up

​Before you start

​Values to collect

​Run the SQL

​Check the result

​Clean up

Before you start

Values to collect

Run the SQL

Check the result

Clean up