Pin an external secret version

How-to guideApplies to: Unified engine deployments

Keep a credential on a chosen external value instead of following the current version. This example uses an SSM parameter containing an AWS credential bundle.

Prepare two usable versions

Configure recipe_ssm as described in Use AWS Parameter Store. Have an administrator create versions 2 and 3 of /laminar/recipes/aws-reader. Each value must be a JSON credential bundle with aws_access_key_id and aws_secret_access_key, plus aws_session_token when needed. Use real version numbers from your parameter. Each selected version must contain valid, unexpired credentials. Use an existing S3 bucket containing Parquet files for the TPC-DS SF1 item table. The examples use s3://recipe-data/tpcds-sf1/item/ in us-east-2. Replace the bucket, path, and Region with your real values. The identity needs s3:ListBucket on the bucket and s3:GetObject on that prefix. Add kms:Decrypt when its objects use a customer-managed KMS key. Keep the view and query in the same SQL session.

Use a fixed version

CREATE SECRET recipe_pinned_keys
USING 'recipe_ssm:///laminar/recipes/aws-reader?version=2';

CREATE CREDENTIAL recipe_pinned_reader USING aws
OPTIONS ('authentication' = 'saved')
SECRETS ('credential' = 'recipe_pinned_keys');

DESCRIBE SECRET recipe_pinned_keys;

CREATE OR REPLACE TEMPORARY VIEW recipe_pinned_items
USING parquet
OPTIONS (
  path 's3://recipe-data/tpcds-sf1/item/',
  credential_reference 'recipe_pinned_reader',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_pinned_items
ORDER BY i_item_sk
LIMIT 5;

The parameter reference stays on version 2 even if AWS has a newer version. Use DESCRIBE to inspect that reference and SELECT to check its usable access.

Move to another version

ALTER SECRET recipe_pinned_keys
USING 'recipe_ssm:///laminar/recipes/aws-reader?version=3';

DESCRIBE SECRET recipe_pinned_keys;
SELECT i_item_sk, i_item_id FROM recipe_pinned_items ORDER BY i_item_sk LIMIT 5;

The credential and view names stay unchanged. To follow SSM’s current version, remove the version selector from the local reference:

ALTER SECRET recipe_pinned_keys USING 'recipe_ssm:///laminar/recipes/aws-reader';

Secrets Manager uses the same reference pattern with recipe_sm, but its version is the AWS VersionId string, not an SSM integer. Its provider setup is shown in Use AWS Secrets Manager. When finished:

DROP VIEW recipe_pinned_items;
DROP CREDENTIAL recipe_pinned_reader;
DROP SECRET recipe_pinned_keys;

Transformation Engine

Learn Laminar

Workloads

SQL reference

HTTP API

Recipes

Operations

Pin an external secret version

Prepare two usable versions

Use a fixed version

Move to another version

​Prepare two usable versions

​Use a fixed version

​Move to another version

Prepare two usable versions

Use a fixed version

Move to another version