> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pin an external secret version

> Keep a credential on a chosen external value instead of following the current

How-to guideApplies to: Unified engine deployments

Keep a credential on a chosen external value instead of following the current
version. This example uses an SSM parameter containing an AWS credential bundle.

## Prepare two usable versions

Configure `recipe_ssm` as described in
[Use AWS Parameter Store](https://docs.e6data.com/transformation/recipes/secrets/aws-parameter-store.md#prepare-the-external-source).
Have an administrator create versions `2` and `3` of
`/laminar/recipes/aws-reader`. Each value must be a JSON credential bundle with
`aws_access_key_id` and `aws_secret_access_key`, plus `aws_session_token` when
needed. Use real version numbers from your parameter. Each selected version
must contain valid, unexpired credentials.

Use an existing S3 bucket containing Parquet files for the TPC-DS SF1 `item`
table. The examples use `s3://recipe-data/tpcds-sf1/item/` in `us-east-2`.
Replace the bucket, path, and Region with your real values. The identity needs
`s3:ListBucket` on the bucket and `s3:GetObject` on that prefix. Add `kms:Decrypt`
when its objects use a customer-managed KMS key. Keep the view and query in the
same SQL session.

## Use a fixed version

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_pinned_keys
USING 'recipe_ssm:///laminar/recipes/aws-reader?version=2';

CREATE CREDENTIAL recipe_pinned_reader USING aws
OPTIONS ('authentication' = 'saved')
SECRETS ('credential' = 'recipe_pinned_keys');

DESCRIBE SECRET recipe_pinned_keys;
```

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE OR REPLACE TEMPORARY VIEW recipe_pinned_items
USING parquet
OPTIONS (
  path 's3://recipe-data/tpcds-sf1/item/',
  credential_reference 'recipe_pinned_reader',
  region 'us-east-2',
  endpoint 'https://s3.us-east-2.amazonaws.com',
  allow_http 'false'
);

SELECT i_item_sk, i_item_id
FROM recipe_pinned_items
ORDER BY i_item_sk
LIMIT 5;
```

The parameter reference stays on version 2 even if AWS has a newer version.
Use DESCRIBE to inspect that reference and SELECT to check its usable access.

## Move to another version

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
ALTER SECRET recipe_pinned_keys
USING 'recipe_ssm:///laminar/recipes/aws-reader?version=3';

DESCRIBE SECRET recipe_pinned_keys;
SELECT i_item_sk, i_item_id FROM recipe_pinned_items ORDER BY i_item_sk LIMIT 5;
```

The credential and view names stay unchanged. To follow SSM's current version,
remove the version selector from the local reference:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
ALTER SECRET recipe_pinned_keys USING 'recipe_ssm:///laminar/recipes/aws-reader';
```

Secrets Manager uses the same reference pattern with `recipe_sm`, but its
version is the AWS VersionId string, not an SSM integer. Its provider setup is
shown in [Use AWS Secrets Manager](https://docs.e6data.com/transformation/recipes/secrets/aws-secrets-manager.md).

When finished:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP VIEW recipe_pinned_items;
DROP CREDENTIAL recipe_pinned_reader;
DROP SECRET recipe_pinned_keys;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.