Results of 1 - 10 of about 41 for Secret (0.002 sec.)
- Secrets Manager 12123
- The Secrets manager provides a unified user interface for secrets across all backends that use them. Secrets can be scoped, so different storage prefixes can have different secrets, allowing for example to join data across organizations in
...a single query. Secrets can also be persisted, so that they do not need to be specified every time DuckDB is launched. Note Persistent secrets ar...e stored in unencrypted binary format in the ~/.duckdb/stored_secrets directory. They are protected by file system permissions (mode 600 ), similar to how SSH private keys are stored: only th...e user running the DuckDB process can read and write them. Types of Secrets Secrets are typed, their type identifies which service they are for. Most secrets are not included in DuckDB by default;... - https://man.mtool.work/duckdb/2.0/configuration/secrets_manager.html
- AWS Extension 11004
- The aws extension adds functionality, e.g., authentication, on top of the httpfs extension's S3 capabilities , using the AWS SDK. Installing and Loading The aws extension will be transparently autoloaded on first use from the official exten
...use, see the S3 and AWS Authentication page. The preferred way to configure and authenticate to AWS S3 endpoints is to use secrets . There are two S3 secret providers: The config provider, where you supply the access key and secret manually. It is part...aws extension and supports profiles, SSO, assumed roles, web identities (IRSA), and instance metadata. The full list of S3 secret parameters that apply to both providers ( ENDPOINT , REGION , URL_STYLE , USE_SSL , KMS_KEY_ID , REQUESTER_PAYS , …) is do...credentials using mechanisms provided by the AWS SDK. For example, to use the AWS SDK default provider: CREATE OR REPLACE SECRET secret ( TYPE s3, PROVIDER credential_chain ); To query a file using the above secret, simply query any s3:// prefixed fil... - https://man.mtool.work/duckdb/2.0/core_extensions/aws.html
- Catalogs 10942
- The iceberg extension supports attaching Iceberg REST Catalogs. Attaching a catalog is required for writing to Iceberg . Before attaching an Iceberg REST Catalog, you must install the iceberg extension by following the instructions located
...ke . Attaching an Iceberg REST Catalog Most Iceberg REST Catalogs authenticate via OAuth2. You can use the existing DuckDB secret workflow to store login credentials for the OAuth2 service. CREATE SECRET iceberg_secret ( TYPE iceberg, CLIENT_ID '⟨admin...⟩', CLIENT_SECRET '⟨password⟩', OAUTH2_SERVER_URI '⟨http://iceberg_rest_catalog_url.com/v1/oauth/tokens⟩' ); If you already have a Bearer to...ken, you can pass it directly to your CREATE SECRET statement CREATE SECRET iceberg_secret ( TYPE iceberg, TOKEN '⟨bearer_token⟩' ); You can attach the Iceberg catalog with t... - https://man.mtool.work/duckdb/2.0/core_extensions/iceberg/catalogs.html
- PostgreSQL Extension and the Secret Manager 10739
- User credentials and other PostgreSQL database connection details can be stored using the DuckDB Secrets Manager . The following syntax can be used to create a secret: CREATE SECRET ( TYPE postgres, HOST '127.0.0.1', PORT 5432, DATABASE pos
...tgres, USER 'postgres', PASSWORD '' ); The information from the secret will be used when ATTACH is called. We can leave the PostgreSQL connection string empty to use all of the information stor...ed in the secret. ATTACH '' AS postgres_db (TYPE postgres); We can use the PostgreSQL connection string to override individual options. For...the database name in the following manner. ATTACH 'dbname=my_other_db' AS postgres_db (TYPE postgres); By default, created secrets are temporary. Secrets can be persisted using the CREATE PERSISTENT SECRET command . Persistent secrets can be used acros... - https://man.mtool.work/duckdb/2.0/core_extensions/postgres/secrets.html
- S3 API Support 10335
- The httpfs extension supports reading/writing/ globbing files on object storage servers using the S3 API. S3 offers a standard API to read and write to remote files (while regular http servers, predating S3, do not offer a common write API)
...equired for each httpfs feature. Feature Required S3 API features Public file reads HTTP Range requests Private file reads Secret key or session token authentication File glob ListObjectsV2 File writes Multipart upload Configuration and Authentication...to use, see the S3 and AWS Authentication page. The preferred way to configure and authenticate to S3 endpoints is to use secrets . Multiple secret providers are available. To migrate from the deprecated S3 API , use a defined secret with a profile. S...config (i.e., user-configured), allows access to the S3 bucket by manually providing a key. For example: CREATE OR REPLACE SECRET secret ( TYPE s3, PROVIDER config, KEY_ID '⟨AKIAIOSFODNN7EXAMPLE⟩', SECRET '⟨wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY⟩', R... - https://man.mtool.work/duckdb/2.0/core_extensions/httpfs/s3api.html
- Amazon RDS with IAM Authentication 10242
- Managed PostgreSQL databases on Amazon RDS and Aurora can authenticate with short-lived IAM tokens instead of a static password. DuckDB supports this through the postgres and aws extensions: the aws extension generates the token from an AWS
...refreshing it automatically. Installation and Loading INSTALL postgres; INSTALL aws; LOAD postgres; LOAD aws; Creating the Secrets First, create a secret of type rds . It uses the AWS credential chain to mint the IAM token: CREATE SECRET aws_rds_secret...⟩', RDS_USER '⟨postgres⟩', RDS_HOST '⟨instance⟩.⟨identifier⟩.⟨region⟩.rds.amazonaws.com', RDS_PORT '5432' ); Then create a secret of type postgres that references it via AWS_RDS_SECRET . Because no password is set, the token generated by the rds secret...is used (and refreshed) automatically: CREATE SECRET pg_rds_secret ( TYPE postgres, HOST '⟨instance⟩.⟨identifier⟩.⟨region⟩.rds.amazonaws.com', PORT '5432', USER '⟨postgres⟩',... - https://man.mtool.work/duckdb/2.0/guides/database_integration/rds_iam.html
- S3 and AWS Authentication 9776
- This page is the entry point for authenticating to S3 and other AWS services from DuckDB. Authentication is configured using secrets , and the detailed reference material lives on the S3 API Support and AWS Extension pages. The sections bel
...ow explain which method to use and link to the relevant reference. Choosing an Authentication Method There are two S3 secret providers. Use the config provider when you have static credentials, and the credential_chain provider when you want DuckD...B to fetch credentials automatically through the AWS SDK. Situation Method Reference You have a static access key and secret config provider config provider Credentials come from ~/.aws/credentials or ~/.aws/config profiles credential_chain with a...al_chain with the instance chain credential_chain provider You connect to Amazon RDS or Aurora with IAM authentication rds secret Amazon RDS (IAM Authentication) The config provider is part of the httpfs extension and works with any S3-compatible stora... - https://man.mtool.work/duckdb/2.0/core_extensions/httpfs/authentication.html
- CREATE SECRET Statement 8921
- The CREATE SECRET statement creates a new secret in the Secrets Manager . Syntax for CREATE SECRET Warning When using the command line client , the CREATE SECRET statements are stored in your DuckDB history as plain text. Syntax for DROP SECRET
... - https://man.mtool.work/duckdb/2.0/sql/statements/create_secret.html
- Azure Extension 8657
- The azure extension lets DuckDB read and write files in Azure Blob Storage and Azure Data Lake Storage (ADLS) Gen2. Installing and Loading The azure extension will be transparently autoloaded on first use from the official extension reposit
...ory. If you would like to install and load it manually, run: INSTALL AND LOAD azure; Usage Queries need a secret ; for a public container, a secret with the storage account name is enough (see the CONFIG provider ). Then you can query...SET azure_read_transfer_chunk_size = 8_388_608; SET azure_read_buffer_size = 8_388_608; Authentication Authenticate with a secret . The SET variables in Authentication with Variables still work but are deprecated. Authentication with Secret Several Sec...ret Providers are available, described below. These rules apply to every provider: If you need to define different secrets for different storage accounts, use the SCOPE configuration . Note that the SCOPE requires a trailing slash ( SCOPE 'az:/... - https://man.mtool.work/duckdb/2.0/core_extensions/azure.html
- Command Line Arguments 8190
- The table below summarizes DuckDB's command line options. To list all command line options, use the command: duckdb -help For a list of dot commands available in the CLI shell, see the Dot Commands page . Argument Description -agent Render
...box Set output mode to box -column Set output mode to column -cmd COMMAND Run COMMAND before reading stdin -connect [TYPE[:SECRET]] Connect to a remote database. The default type is quack . A named secret can be provided after the type -c COMMAND Run C...Run COMMAND and exit -safe Enable safe mode -separator SEP Set output column separator to SEP . Default: | -serve [quack[:SECRET]] Serve the opened database with Quack . A named secret can be provided after the type -storage-version VER Database stora...starts the DuckDB UI . If the UI is not yet installed, it installs the ui extension -unredacted Allow printing unredacted secrets . Sets the allow_unredacted_secrets option to true -unsigned Allow loading of unsigned extensions . This option is intend... - https://man.mtool.work/duckdb/2.0/clients/cli/arguments.html
DuckDB 2.0 Documentation / man.mtool.work