CREATE CREDENTIAL
Valid in: SQL, ESQL, OpenAPI, ODBC, JDBC, .NET
The CREATE CREDENTIAL command creates a new credential for cloud storage access or other external services, for example, AWS S3, Google Cloud Storage, Azure Blob Storage, and similar, which uses these credentials for authentication.
This statement has the following format:
CREATE CREDENTIAL credential_name
WITH TYPE = 'credential_type',
SECRET = 'secret_key'
[,EXPIRE_DATE = 'timestamp']
[,ENDPOINT = 'endpoint_url']
[,REGION = 'region_name']
[,ACCESS = 'access_type']
credential_name
(Required) Specifies the name of the credential, to be owned by the current user. If a schema is specified in the credential name, it must match the current user.
WITH TYPE = 'credential_type'
(Required) Specifies the type of credential. Valid values are:
• AWS_SIMPLE - AWS basic authentication with access key and secret
• AWS_SESSION - AWS session-based authentication
• AWS_TOKEN - AWS token-based authentication
• GCS_SERVICE_1 - Google Cloud Storage service account
• GCS_TOKEN - Google Cloud Storage token-based authentication
• AZURE_OAUTH2_CLIENT - Azure OAuth2 authentication
• AZURE_SHARED_KEY - Azure Shared Key authentication
• AZURE_TOKEN - Azure token-based authentication
• BASIC - Username/password authentication
• TOKEN - Generic token-based authentication
• OAUTH - OAuth authentication
WITH SECRET = 'secret_key'
(Required) Specifies the secret key or token associated with the credential. The secret must be a JSON document with a structure specific to the credential type. Each credential type requires different JSON fields in the secret document.
Note: JSON field names are case-sensitive, and the key name should be in upper case. For example, AWS_ACCESS_KEY_ID.
Note: There are a few limitations to the JSON document, such as full Unicode character set not being currently available. To avoid any error, ensure to limit the inputs to printable ASCII or ISOx characters.
EXPIRE_DATE = 'timestamp'
(Optional) Sets the expiration date for the credential as an annotation in the ANSI SQL YYYY-MM-DD HH:MM:SS[.F] [[+|-]HH:MM]] format. Additional formats for the timestamp input as mentioned in the
Timestamp Data Types topic are also supported, but it is recommended to use the ANSI SQL format. If no timezone is specified, the server's local timezone is used.
Note: This option is used for informational and tracking purposes only to manage credential life cycles. The credential provider, for example, AWS, GCS, Azure, and similar, controls the credential validity and expiration.
Note: While a fractional second part can be entered, it will be truncated and the expiration timestamp is stored with a granularity of seconds only.
ENDPOINT = 'endpoint_url'
(Optional) Specifies the service endpoint URL for the credential.
REGION = 'region_name'
(Optional) Specifies cloud region for services like AWS, Azure, GCS, or similar.
ACCESS = 'access_type'
(Optional) Sets the access level for the credential. Valid values are:
• READ - Read-only access
• WRITE - Write-only access
• READ_WRITE - Full read and write access
Note: This option is used for informational purposes only.
Related Statements