> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pin a Google Secret Manager secret version

> Create a named reference and use its value through a matching credential.

How-to guideApplies to: Unified engine deployments

Create a named reference and use its value through a matching credential.

## Before you start

Have an administrator configure the engine provider alias recipe\_gsm before
running SQL. Configure type gcp-secret-manager with the project containing the
secret. Supply Application Default Credentials to the secret-service process.
Grant the identity permission to access the secret version. See
[provider configuration](https://docs.e6data.com/transformation/operations/configuration/secrets.md#google-secret-manager).

The selected value must be raw bearer-token text accepted by an existing Iceberg
REST catalog. Have its API URI, warehouse, namespace, and nonempty table ready.
The service must provide usable temporary storage credentials or already
configured storage access. Use a real existing version. The version must hold
valid access material; pinning does not extend its lifetime.

## Values to collect

* A configured provider alias, secret identifier, existing version, and the data
  connection values shown below.

## Run the SQL

Replace every `<placeholder>` before running. Use unused names for the resources
below. Run the statements in order in Workbench.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_google_secret_manager_pinned_secret USING 'recipe_gsm://catalog-token?version=7';
DESCRIBE SECRET recipe_google_secret_manager_pinned_secret;

CREATE CREDENTIAL recipe_google_secret_manager_pinned_reader USING bearer
OPTIONS (
  'authentication' = 'saved'
)
SECRETS ('token' = 'recipe_google_secret_manager_pinned_secret');

CREATE CATALOG recipe_google_secret_manager_pinned USING `iceberg-rest`
OPTIONS (
  'uri' = '<catalog-api-uri>',
  'warehouse' = '<warehouse>',
  'auth.type' = 'bearer',
  'header.x-iceberg-access-delegation' = 'vended-credentials'
)
CREDENTIALS ('auth' = 'recipe_google_secret_manager_pinned_reader');

SELECT *
FROM recipe_google_secret_manager_pinned.`<namespace>`.`<table>`
LIMIT 5;
```

## Check the result

DESCRIBE shows the provider reference and selected version, not its plaintext
value. The SELECT should return actual table or file rows and proves that the
consumer can resolve and use the selected secret.

## Clean up

This removes only the Unified registrations. It leaves the remote catalog and
its tables in place.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_google_secret_manager_pinned;
DROP CREDENTIAL recipe_google_secret_manager_pinned_reader;
DROP SECRET recipe_google_secret_manager_pinned_secret;
```

The external secret value and its provider mapping are left in place.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.