21.9. Secrets Management Functions #

For more information about secrets, refer to Section 14.5.

duckdb.create_simple_secret(type TEXT, key_id TEXT, secret TEXT, region TEXT, optional_parameters) returns void #

Creates a simple secret for accessing cloud storage services, such as S3, GCS, or R2.

Example 21.38. 

-- Create an S3 secret
SELECT duckdb.create_simple_secret(
    type := 'S3',
    key_id := 'your_access_key',
    secret := 'your_secret_key',
    region := 'us-east-1'
);

-- Create an S3 secret with session token
SELECT duckdb.create_simple_secret(
    type := 'S3',
    key_id := 'your_access_key',
    secret := 'your_secret_key',
    region := 'us-east-1',
    session_token := 'your_session_token'
);

Required parameters:

Name

Type

Description

type

text

The type of secret (e.g., 'S3', 'GCS', 'R2')

key_id

text

The access key ID or equivalent

secret

text

The secret key or equivalent

Optional parameters:

Name

Type

Description

session_token

text

Session token for temporary credentials

endpoint

text

Custom endpoint URL

url_style

text

URL style.

Possible values:

  • 'vhost'

  • 'path'

use_ssltext

Specifies whether to use SSL.

Possible values:

  • true

  • false

Default value: true.

scope

text

Scope for the secret.

Default value: ''

region

text

The region for the service