Remove access resources after use

How-to guideApplies to: Unified engine deployments

Remove a connection before removing the credential and secret that it uses. Dropping a local object does not revoke an AWS key, token, or role permission.

Clean up the first secret recipe

Complete Store a secret and use it, leaving its resources in place. Ensure no other queries or saved resources still need them. SQL does not provide a complete dependency listing for secret consumers.

SHOW CATALOGS;
SHOW CREDENTIALS;
SHOW SECRETS;

DROP CATALOG IF EXISTS recipe_retail;
DROP CREDENTIAL IF EXISTS recipe_catalog_auth;
DROP SECRET IF EXISTS recipe_catalog_token;

SHOW CATALOGS;
SHOW CREDENTIALS;
SHOW SECRETS;

The three names should be absent from the final lists. These commands remove only the engine registration, credential definition, and local secret. They do not delete remote tables or revoke the token.

Remove a credential source chain

After Assume an AWS role, remove the view and derived role credential before the source credential:

DROP VIEW IF EXISTS recipe_role_items;
DROP CREDENTIAL IF EXISTS recipe_warehouse_role;
DROP CREDENTIAL IF EXISTS recipe_role_source;

For credentials backed by local key secrets, drop those secrets after their credential. For external aliases, DROP SECRET removes the alias only. Deleting remote test secrets, changing IAM permissions, or removing identity associations is separate AWS setup work. IF EXISTS allows repeated cleanup after a partial run. Use only the names created by your recipe; it is not an ownership check.

Last modified on November 4, 2026

Transformation Engine

Learn Laminar

Workloads

SQL reference

HTTP API

Recipes

Operations

Remove access resources after use

Clean up the first secret recipe

Remove a credential source chain

​Clean up the first secret recipe

​Remove a credential source chain

Clean up the first secret recipe

Remove a credential source chain