Results of 1 - 10 of about 80 for access (0.002 sec.)
- Legacy Authentication Scheme for S3 API 14834
- Prior to version 0.10.0, DuckDB did not have a Secrets manager . Hence, the configuration of and authentication to S3 endpoints was handled via variables. This page documents the legacy authentication scheme for the S3 API. Warning This pag
...endpoint and region, public files can be read. To also read private files, authentication credentials can be added: SET s3_access_key_id = '⟨aws_access_key_id⟩'; SET s3_secret_access_key = '⟨aws_secret_access_key⟩'; Alternatively, temporary S3 credenti...configuration values listed above can be set as query parameters. For instance: SELECT * FROM 's3://bucket/file.parquet?s3_access_key_id=accessKey&s3_secret_access_key=secretKey'; Multiple configurations per query are also allowed: SELECT * FROM 's3://...bucket/file.parquet?s3_access_key_id=accessKey1&s3_secret_access_key=secretKey1' t1 INNER JOIN 's3://bucket/file.csv?s3_access_key_id=accessKey2&s3_secr... - https://man.mtool.work/duckdb/2.0/core_extensions/httpfs/s3api_legacy_authentica...
- Securing DuckDB 12547
- DuckDB is a powerful analytical database engine. It can read and write files, access the network, load extensions, and use system resources. Like any powerful tool, these capabilities require appropriate configuration when working with sens
...nd filter expressions. While they don't execute raw SQL strings, they still trigger DuckDB operations that can read files, access the network, and use system resources. Example considerations for non-SQL APIs: File paths: Functions like duckdb.read_csv...uckdb.read_parquet(path) accept file paths. An attacker-controlled path could read sensitive files (e.g., /etc/passwd ) or access remote URLs. Table and column names: While these are typically identifiers rather than executable code, unsanitized input...kDB has a flexible extension mechanism that adds functionality such as new file formats, functions, and remote file system access. Extensions run with the same privileges as the DuckDB process itself, so they warrant careful consideration in security-s... - https://man.mtool.work/duckdb/2.0/operations_manual/securing_duckdb/overview.htm...
- AWS Extension 9109
- The aws extension adds functionality, e.g., authentication, on top of the httpfs extension's S3 capabilities , using the AWS SDK. Installing and Loading The aws extension will be transparently autoloaded on first use from the official exten
...icate to AWS S3 endpoints is to use secrets . There are two S3 secret providers: The config provider, where you supply the access key and secret manually. It is part of the httpfs extension and is documented in the S3 API page . Use it when you already...' validates only the presence of a credential, not its operational readiness . Thus, no attempt is made to convert into an access token, or perform a read, write, etc. Auto-Refresh Some AWS endpoints require periodic refreshing of the credentials. This...entials Provider Chain Load AWS Credentials (Legacy) To load the AWS credentials, run: CALL load_aws_credentials(); loaded_access_key_id loaded_secret_access_key loaded_session_token loaded_region AKIAIOSFODNN7EXAMPLE <redacted> NULL us-east-2 The func... - https://man.mtool.work/duckdb/2.0/core_extensions/aws.html
- Deploy 8807
- Overview Deploying DuckDB-Wasm means serving its components so that the browser can fetch and instantiate them. This page describes each component a deployment needs to serve, how the worker and WebAssembly variants relate, how extensions a
...re served and mirrored, and the security considerations involved. A DuckDB-Wasm deployment needs to access the following components: Main Library Component. Distributed as TypeScript and compiled to JavaScript code. For further d...web.dev Enabling SharedArrayBuffer on the Chrome developer blog Security Considerations Warning Deploying DuckDB-Wasm with access to your own data means whoever has access to SQL can access the data that DuckDB-Wasm can access. Also, DuckDB-Wasm in the...default setting can access remote endpoints, so it can have a visible effect on the external world even from within the sandbox. Further Reading Inst... - https://man.mtool.work/duckdb/2.0/clients/wasm/deploying_duckdb_wasm.html
- Catalogs 8807
- The iceberg extension supports attaching Iceberg REST Catalogs. Attaching a catalog is required for writing to Iceberg . Before attaching an Iceberg REST Catalog, you must install the iceberg extension by following the instructions located
...CRET '⟨password⟩' ); ATTACH 'quickstart_catalog' AS polaris_catalog ( TYPE iceberg, URI '⟨polaris_rest_catalog_endpoint⟩', ACCESS_DELEGATION_MODE 'vended_credentials' ); Lakekeeper To attach to a Lakekeeper catalog the following commands will work. CRE...ret so DuckDB can read the Parquet files from the same gateway: CREATE SECRET seaweedfs_secret ( TYPE iceberg, CLIENT_ID '⟨access_key⟩', CLIENT_SECRET '⟨secret_key⟩', OAUTH2_SERVER_URI 'http://⟨seaweedfs_host⟩:8181/v1/oauth/tokens' ); CREATE SECRET sea...weedfs_storage ( TYPE s3, KEY_ID '⟨access_key⟩', SECRET '⟨secret_key⟩', ENDPOINT '⟨seaweedfs_host⟩:8333', URL_STYLE 'path', USE_SSL false ); ATTACH '⟨table_bucket_n... - https://man.mtool.work/duckdb/2.0/core_extensions/iceberg/catalogs.html
- SeaweedFS Import 8725
- Prerequisites For SeaweedFS , the S3-compatible gateway allows you to use DuckDB's S3 support to read and write from SeaweedFS buckets. This requires the httpfs extension , which can be installed using the INSTALL SQL command. This only nee
...S locally, create a file s3config.json with the S3 credentials: { "identities": [ { "name": "analyst", "credentials": [ { "accessKey": "your_access_key_id", "secretKey": "your_secret_access_key" } ], "actions": ["Admin", "Read", "Write", "List", "Taggi...te an S3 secret with the credentials from the SeaweedFS S3 configuration: CREATE SECRET my_secret ( TYPE s3, KEY_ID '⟨your_access_key_id⟩', SECRET '⟨your_secret_access_key⟩', ENDPOINT '⟨seaweedfs-host⟩:8333', URL_STYLE 'path', USE_SSL false ); SeaweedF... - https://man.mtool.work/duckdb/2.0/guides/network_cloud_storage/seaweedfs_import....
- S3 API Support 8506
- The httpfs extension supports reading/writing/ globbing files on object storage servers using the S3 API. S3 offers a standard API to read and write to remote files (while regular http servers, predating S3, do not offer a common write API)
...ret with a profile. See Selecting a Profile . config Provider The default provider, config (i.e., user-configured), allows access to the S3 bucket by manually providing a key. For example: CREATE OR REPLACE SECRET secret ( TYPE s3, PROVIDER config, KEY...riables, credential files, etc.). Therefore, your R2 credentials must be made available as AWS environment variables ( AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY ) for the credential chain to work properly. Finally, R2 secrets are only available when...: SELECT * FROM read_parquet('r2://⟨some-file-that-uses-an-r2-secret⟩.parquet'); GCS Secrets While Google Cloud Storage is accessed by DuckDB using the S3 API, DuckDB has a special Secret type, GCS , to make configuring it a bit simpler: CREATE OR REPL... - https://man.mtool.work/duckdb/2.0/core_extensions/httpfs/s3api.html
- Azure Extension 8424
- The azure extension lets DuckDB read and write files in Azure Blob Storage and Azure Data Lake Storage (ADLS) Gen2. Installing and Loading The azure extension will be transparently autoloaded on first use from the official extension reposit
...ype to curl has the following effects: On Linux, it may fix certificate errors such as Problem with the SSL CA cert (path? access rights?) : the extension then looks for the CA bundle in the usual paths, which curl does not do by default and which stat....core.windows.net for abfss:// and abfs:// ). CONFIG Provider The default provider, CONFIG (i.e., user-configured), allows access to the storage account using a connection string or anonymously. For example: CREATE SECRET secret1 ( TYPE azure, CONNECTI...ON_STRING '⟨connection_string⟩' ); For anonymous access, give the storage account name: CREATE SECRET secret2 ( TYPE azure, PROVIDER config, ACCOUNT_NAME '⟨storage_account_name⟩'... - https://man.mtool.work/duckdb/2.0/core_extensions/azure.html
- DBeaver SQL IDE 8424
- DBeaver is a powerful and popular desktop SQL editor and integrated development environment (IDE). It has both an open source and enterprise version. DBeaver is useful for visually inspecting the available tables in DuckDB and for quickly b
...x queries. DuckDB's JDBC connector allows DBeaver to query DuckDB files, and by extension, any other files that DuckDB can access (like Parquet files ). Installing DBeaver Install DBeaver using the download links and instructions found at their downloa...ing your connection, return to the “Connect to a database” dialog and click “Edit Driver Settings”. Alternatively, you can access the driver settings menu by returning to the main DBeaver window and clicking Database > Driver Manager in the menu bar. T...settings. Manual Driver Installation If DBeaver cannot download the driver itself, for example when it runs without write access to its own directories or without internet access, you can download the JDBC driver manually and point DBeaver at the loca... - https://man.mtool.work/duckdb/2.0/guides/sql_editors/dbeaver.html
- Configuration 8355
- DuckDB has a number of configuration options that can be used to change the behavior of the system. The configuration options can be set using either the SET statement or the PRAGMA statement . They can be reset to their original values usi
...ndar The current calendar VARCHAR System (locale) calendar TimeZone The current time zone VARCHAR System (locale) timezone access_mode Access mode of the database ( AUTOMATIC , READ_ONLY or READ_WRITE ). VARCHAR automatic allocator_background_threads W..._directories List of directories, and directory prefixes, that are ALWAYS allowed to be queried, even when enable_external_access is false. VARCHAR[] [] allowed_paths List of files that are ALWAYS allowed to be queried, even when enable_external_access...separated set of compression methods. VARCHAR disabled_filesystems Disable specific file systems, thereby preventing their access, e.g., LocalFileSystem. VARCHAR disabled_log_types Sets the list of disabled log types. VARCHAR disabled_optimizers Disabl... - https://man.mtool.work/duckdb/2.0/configuration/overview.html
DuckDB 2.0 Documentation / man.mtool.work