How-to guideApplies to: Unified engine deployments
Create a named reference and use its value through a matching credential.
Before you start
Have an administrator configure the engine provider alias recipe_kv before
running SQL. Configure type azure-key-vault with the complete vault_url and
select authentication: workload-identity, managed-identity, or client-secret.
Supply the identity settings in the secret-service process environment and grant
permission to read the selected secret. See
provider configuration.
The selected value must be raw bearer-token text accepted by an existing Iceberg
REST catalog. Have its API URI, warehouse, namespace, and nonempty table ready.
The service must provide usable temporary storage credentials or already
configured storage access. Use a real existing version. The version must hold
valid access material; pinning does not extend its lifetime.
Values to collect
- A configured provider alias, secret identifier, existing version, and the data
connection values shown below.
Run the SQL
Replace every <placeholder> before running. Use unused names for the resources
below. Run the statements in order in Workbench.
Check the result
DESCRIBE shows the provider reference and selected version, not its plaintext
value. The SELECT should return actual table or file rows and proves that the
consumer can resolve and use the selected secret.
Clean up
This removes only the Unified registrations. It leaves the remote catalog and
its tables in place.
The external secret value and its provider mapping are left in place.Last modified on November 4, 2026
