> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use HashiCorp Vault KV v2 for a saved credential

> Create a named reference and use its value through a matching credential.

How-to guideApplies to: Unified engine deployments

Create a named reference and use its value through a matching credential.

## Before you start

Have an administrator configure the engine provider alias recipe\_vault before
running SQL. Configure type vault with the KV v2 `mount`, API `address`, and
optional `namespace`. Set an authorized API token in `VAULT_TOKEN` or the variable
named by `token_env`. The returned data object must be a supported document for
its consumer. See
[provider configuration](https://docs.e6data.com/transformation/operations/configuration/secrets.md#hashicorp-vault).

Store an AWS JSON credential bundle as the KV v2 data object, with
aws\_access\_key\_id and aws\_secret\_access\_key, plus aws\_session\_token when needed.
The provider returns the complete data object as JSON, so use the saved AWS
bundle field. Use an existing nonempty Parquet dataset and a configured S3
file-source root covering its prefix. A credential does not authorize an
arbitrary storage root. The identity needs list/read access to the bucket and
actual files, plus KMS decrypt permission when needed. Use the region and HTTPS
endpoint for that bucket. Keep the temporary view and its SELECT in the same
Workbench workspace.

## Values to collect

* A configured provider alias, secret identifier, and the data connection values
  shown below.

## Run the SQL

Replace every `<placeholder>` before running. Use unused names for the resources
below. Run the statements in order in Workbench.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_vault_secret USING 'recipe_vault://catalog/token';
DESCRIBE SECRET recipe_vault_secret;

CREATE CREDENTIAL recipe_vault_reader USING aws
OPTIONS (
  'authentication' = 'saved'
)
SECRETS ('credential' = 'recipe_vault_secret');

CREATE OR REPLACE TEMPORARY VIEW recipe_vault
USING parquet
OPTIONS (
  path 's3://<bucket>/<parquet-prefix>/',
  credential_reference 'recipe_vault_reader',
  region '<aws-region>',
  endpoint '<s3-endpoint>',
  allow_http 'false'
);

SELECT * FROM recipe_vault LIMIT 5;
```

## Check the result

DESCRIBE shows the provider reference, not its plaintext value. The SELECT
should return actual table or file rows and proves that the consumer can resolve
and use the selected secret.

## Clean up

This removes the local references and view, without deleting the remote Vault
secret.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP VIEW recipe_vault;
DROP CREDENTIAL recipe_vault_reader;
DROP SECRET recipe_vault_secret;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.