Results of 1 - 10 of about 40 for access key (0.003 sec.)
access (80), key (121)
- Legacy Authentication Scheme for S3 API 24288
- Prior to version 0.10.0, DuckDB did not have a Secrets manager . Hence, the configuration of and authentication to S3 endpoints was handled via variables. This page documents the legacy authentication scheme for the S3 API. Warning This pag
...endpoint and region, public files can be read. To also read private files, authentication credentials can be added: SET s3_access_key_id = '⟨aws_access_key_id⟩'; SET s3_secret_access_key = '⟨aws_secret_access_key⟩'; Alternatively, temporary S3 credenti...ers is deprecated and disabled by default in DuckDB 2.0: the ? and the text following it are treated as part of the object key. To restore the legacy behavior, run SET s3_enable_deprecated_url_parameters = true; (URL compatibility mode must also be...configuration values listed above can be set as query parameters. For instance: SELECT * FROM 's3://bucket/file.parquet?s3_access_key_id=accessKey&s3_secret_access_key=secretKey'; Multiple configurations per query are also allowed: SELECT * FROM 's3://... - https://man.mtool.work/duckdb/2.0/core_extensions/httpfs/s3api_legacy_authentica...
- Securing DuckDB 17850
- DuckDB is a powerful analytical database engine. It can read and write files, access the network, load extensions, and use system resources. Like any powerful tool, these capabilities require appropriate configuration when working with sens
...nd filter expressions. While they don't execute raw SQL strings, they still trigger DuckDB operations that can read files, access the network, and use system resources. Example considerations for non-SQL APIs: File paths: Functions like duckdb.read_csv...uckdb.read_parquet(path) accept file paths. An attacker-controlled path could read sensitive files (e.g., /etc/passwd ) or access remote URLs. Table and column names: While these are typically identifiers rather than executable code, unsanitized input...w a list of secrets using the duckdb_secrets() table function. This will redact any sensitive information such as security keys by default. The allow_unredacted_secrets option can be set to show all information contained within a security key. It is... - https://man.mtool.work/duckdb/2.0/operations_manual/securing_duckdb/overview.htm...
- S3 API Support 17589
- The httpfs extension supports reading/writing/ globbing files on object storage servers using the S3 API. S3 offers a standard API to read and write to remote files (while regular http servers, predating S3, do not offer a common write API)
...for each httpfs feature. Feature Required S3 API features Public file reads HTTP Range requests Private file reads Secret key or session token authentication File glob ListObjectsV2 File writes Multipart upload Configuration and Authentication Tip...ret with a profile. See Selecting a Profile . config Provider The default provider, config (i.e., user-configured), allows access to the S3 bucket by manually providing a key. For example: CREATE OR REPLACE SECRET secret ( TYPE s3, PROVIDER config, KEY..._ID '⟨AKIAIOSFODNN7EXAMPLE⟩', SECRET '⟨wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY⟩', REGION '⟨us-east-1⟩' ); Tip If you get an IO Error ( Connection error for HTTP HEAD ), configure the endpoint explicitl... - https://man.mtool.work/duckdb/2.0/core_extensions/httpfs/s3api.html
- CREATE TABLE Statement 15769
- The CREATE TABLE statement creates a table in the catalog. Examples Create a table with two integer columns ( i and j ): CREATE TABLE t1 (i INTEGER, j INTEGER); Create a table with a primary key: CREATE TABLE t1 (id INTEGER PRIMARY KEY, j V
...ARCHAR); Create a table with a composite primary key: CREATE TABLE t1 (id INTEGER, j VARCHAR, PRIMARY KEY (id, j)); Create a table with various different types, constraints an...ied. Temporary Tables Temporary tables are session scoped, meaning that only the specific connection that created them can access them and once the connection to DuckDB is closed they will be automatically dropped (similar to PostgreSQL, for example)....r: CREATE TABLE t1 AS FROM t2 LIMIT 0; It is not possible to create tables using CTAS statements with constraints (primary keys, check constraints, etc.). Check Constraints A CHECK constraint is an expression that must be satisfied by the values of... - https://man.mtool.work/duckdb/2.0/sql/statements/create_table.html
- AWS Extension 15763
- The aws extension adds functionality, e.g., authentication, on top of the httpfs extension's S3 capabilities , using the AWS SDK. Installing and Loading The aws extension will be transparently autoloaded on first use from the official exten
...icate to AWS S3 endpoints is to use secrets . There are two S3 secret providers: The config provider, where you supply the access key and secret manually. It is part of the httpfs extension and is documented in the S3 API page . Use it when you already...tadata. The full list of S3 secret parameters that apply to both providers ( ENDPOINT , REGION , URL_STYLE , USE_SSL , KMS_KEY_ID , REQUESTER_PAYS , …) is documented in the S3 API page . credential_chain Provider The credential_chain provider allows...ing the above secret, simply query any s3:// prefixed file. DuckDB also allows specifying a specific chain using the CHAIN keyword. This takes a semicolon-separated list ( a;b;c ) of providers that will be tried in order. For example: CREATE OR REPL... - https://man.mtool.work/duckdb/2.0/core_extensions/aws.html
- SeaweedFS Import 15540
- Prerequisites For SeaweedFS , the S3-compatible gateway allows you to use DuckDB's S3 support to read and write from SeaweedFS buckets. This requires the httpfs extension , which can be installed using the INSTALL SQL command. This only nee
...S locally, create a file s3config.json with the S3 credentials: { "identities": [ { "name": "analyst", "credentials": [ { "accessKey": "your_access_key_id", "secretKey": "your_secret_access_key" } ], "actions": ["Admin", "Read", "Write", "List", "Taggi...iguration Create an S3 secret with the credentials from the SeaweedFS S3 configuration: CREATE SECRET my_secret ( TYPE s3, KEY_ID '⟨your_access_key_id⟩', SECRET '⟨your_secret_access_key⟩', ENDPOINT '⟨seaweedfs-host⟩:8333', URL_STYLE 'path', USE_SSL... - https://man.mtool.work/duckdb/2.0/guides/network_cloud_storage/seaweedfs_import....
- WITH Clause 15392
- The WITH clause allows you to specify common table expressions (CTEs). Regular (non-recursive) common-table-expressions are essentially views that are limited in scope to a particular query. CTEs can reference each other and can be nested.
...omplex_query⟩) AS t2(x), (⟨complex_query⟩) AS t3(x); If complex_query is expensive, materializing it with the MATERIALIZED keyword can improve performance. In this case, complex_query is evaluated only once. WITH t(x) AS MATERIALIZED (⟨complex_query...endNode, path FROM paths WHERE endNode = 8 ORDER BY length(path), path; startNode endNode path 1 8 [1, 3, 8] 1 8 [1, 5, 8] Accessing the Union Table with recurring Within the recursive term of a WITH RECURSIVE CTE, the CTE name (e.g., counter ) refers...to the rows produced by the last iteration . To access all rows accumulated so far (the union table), use the recurring schema prefix: WITH RECURSIVE counter(i) AS ( SELECT 1 UN... - https://man.mtool.work/duckdb/2.0/sql/query_syntax/with.html
- Catalogs 15151
- The iceberg extension supports attaching Iceberg REST Catalogs. Attaching a catalog is required for writing to Iceberg . Before attaching an Iceberg REST Catalog, you must install the iceberg extension by following the instructions located
...TE SECRET ( TYPE s3, PROVIDER credential_chain ); Alternatively, you can set the values manually: CREATE SECRET ( TYPE s3, KEY_ID '⟨key_id⟩', SECRET '⟨secret⟩', REGION '⟨region⟩' ); For the full range of credential options (assumed roles, SSO, web i...CRET '⟨password⟩' ); ATTACH 'quickstart_catalog' AS polaris_catalog ( TYPE iceberg, URI '⟨polaris_rest_catalog_endpoint⟩', ACCESS_DELEGATION_MODE 'vended_credentials' ); Lakekeeper To attach to a Lakekeeper catalog the following commands will work. CRE...ret so DuckDB can read the Parquet files from the same gateway: CREATE SECRET seaweedfs_secret ( TYPE iceberg, CLIENT_ID '⟨access_key⟩', CLIENT_SECRET '⟨secret_key⟩', OAUTH2_SERVER_URI 'http://⟨seaweedfs_host⟩:8181/v1/oauth/tokens' ); CREATE SECRET sea... - https://man.mtool.work/duckdb/2.0/core_extensions/iceberg/catalogs.html
- Deploy 14135
- Overview Deploying DuckDB-Wasm means serving its components so that the browser can fetch and instantiate them. This page describes each component a deployment needs to serve, how the worker and WebAssembly variants relate, how extensions a
...re served and mirrored, and the security considerations involved. A DuckDB-Wasm deployment needs to access the following components: Main Library Component. Distributed as TypeScript and compiled to JavaScript code. For further d...sitory . Community extensions are served at https://community-extensions.duckdb.org , and they are signed with a different key, so they can be disabled with a one way SQL statement such as: SET allow_community_extensions = false; This will allow loa...web.dev Enabling SharedArrayBuffer on the Chrome developer blog Security Considerations Warning Deploying DuckDB-Wasm with access to your own data means whoever has access to SQL can access the data that DuckDB-Wasm can access. Also, DuckDB-Wasm in the... - https://man.mtool.work/duckdb/2.0/clients/wasm/deploying_duckdb_wasm.html
- Configuration 14129
- DuckDB has a number of configuration options that can be used to change the behavior of the system. The configuration options can be set using either the SET statement or the PRAGMA statement . They can be reset to their original values usi
...ndar The current calendar VARCHAR System (locale) calendar TimeZone The current time zone VARCHAR System (locale) timezone access_mode Access mode of the database ( AUTOMATIC , READ_ONLY or READ_WRITE ). VARCHAR automatic allocator_background_threads W..._directories List of directories, and directory prefixes, that are ALWAYS allowed to be queried, even when enable_external_access is false. VARCHAR[] [] allowed_paths List of files that are ALWAYS allowed to be queried, even when enable_external_access...LOBAL profiling_mode Deprecated setting. Use enable_profiling and profiling_coverage instead. VARCHAR NULL LOCAL s3_access_key_id S3 Access Key ID VARCHAR NULL GLOBAL s3_endpoint S3 Endpoint VARCHAR NULL GLOBAL s3_kms_key_id S3 KMS Key ID VARCHAR NU... - https://man.mtool.work/duckdb/2.0/configuration/overview.html
DuckDB 2.0 Documentation / man.mtool.work