These are copy-paste examples. For the syntax of each form,
the full list of credential types, & the provider-specific
options each one accepts, see
CREATE CREDENTIAL in the
SQL documentation.
Azure
CREATE CREDENTIAL azure_cred
TYPE = 'azure_storage_key',
IDENTITY = 'sampleacc',
SECRET = 'foobaz123'
CREATE CREDENTIAL azure_cred
TYPE = 'azure_sas',
IDENTITY = 'sampleacc',
SECRET = 'sv=2015-07-08&sr=b&sig=39Up0JzHkxhUlhFEjEH9673DJxe7w6...'
CREATE CREDENTIAL azure_cred
TYPE = 'azure_ad',
IDENTITY = 'jdoe',
SECRET = 'foobaz123'
WITH OPTIONS
(
STORAGE ACCOUNT NAME = 'sampleacc',
TENANT ID = 'x0xxx10-00x0-0x01-0xxx-x0x0x01xx100'
)
CREATE CREDENTIAL azure_cred
TYPE = 'azure_oauth',
IDENTITY = 'sampleacc',
SECRET = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ii1LSTNROW5OUjdiUm9meG1lWm9YcWJIWkdldyJ9...'
Data Lake Catalog
CREATE CREDENTIAL catalog_cred
TYPE = 'rest',
SECRET = 'dapi00000000000examplekey00000000000'
CREATE CREDENTIAL catalog_cred
TYPE = 'rest',
IDENTITY = 'a1b2c3d4-5678-90ab-cdef-1234567890ab',
SECRET = 'wJalrXUtnFEMI-K7MDENG-bPxRfiCYEXAMPLEKEY'
Google Cloud Storage
CREATE CREDENTIAL gcs_cred
TYPE = 'gcs_service_account_id',
IDENTITY = 'auser@auser.iam.gserviceaccount.com',
SECRET = '-----BEGIN PRIVATE KEY-----\nABCDEFG=\n-----END PRIVATE KEY-----\n'
CREATE CREDENTIAL gcs_cred
TYPE = 'gcs_service_account_keys'
WITH OPTIONS
(
GCS_SERVICE_ACCOUNT_KEYS = '
{
"type": "service_account",
"project_id": "auser",
"private_key_id": "abcdef1234567890",
"private_key": "-----BEGIN PRIVATE KEY-----\nABCDEFG=\n-----END PRIVATE KEY-----\n",
"client_email": "auser@auser.iam.gserviceaccount.com",
"client_id": "1234567890",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/auser%40auser.iam.gserviceaccount.com"
}'
)
HDFS
CREATE CREDENTIAL hdfs_cred
TYPE = 'hdfs',
IDENTITY = 'jdoe',
SECRET = 'foobaz123'
CREATE CREDENTIAL hdfs_cred
TYPE = 'hdfs',
IDENTITY = 'jdoe'
WITH OPTIONS
(
KERBEROS KEYTAB = 'kifs://<keytab file path>'
)
CREATE CREDENTIAL hdfs_cred
TYPE = 'hdfs',
IDENTITY = 'jdoe'
WITH OPTIONS
(
USE KERBEROS = 'true'
)
JDBC
CREATE CREDENTIAL jdbc_cred
TYPE = 'jdbc',
IDENTITY = 'auser',
SECRET = 'Passw0rd!'
Kafka (Apache)
CREATE CREDENTIAL kafka_cred
TYPE = 'kafka'
WITH OPTIONS
(
'security.protocol' = 'SSL',
'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt'
)
CREATE CREDENTIAL kafka_cred
TYPE = 'kafka'
WITH OPTIONS
(
'security.protocol' = 'SSL',
'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt',
'ssl.certificate.location' = 'kifs://ssl/client.pem'
)
CREATE CREDENTIAL kafka_cred
TYPE = 'kafka'
WITH OPTIONS
(
'security.protocol' = 'SSL',
'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt',
'ssl.certificate.location' = 'kifs://ssl/client.pem',
'ssl.key.location' = 'kifs://ssl/client.key',
'ssl.key.password' = 'foobaz123'
)
CREATE CREDENTIAL kafka_cred
TYPE = 'kafka'
WITH OPTIONS
(
'security.protocol' = 'SASL_SSL',
'sasl.mechanism' = 'PLAIN',
'sasl.username' = 'jdoe',
'sasl.password' = 'foobaz123'
)
CREATE CREDENTIAL kafka_cred
TYPE = 'kafka'
WITH OPTIONS
(
'security.protocol' = 'SASL_PLAINTEXT',
'sasl.mechanism' = 'GSSAPI',
'sasl.kerberos.service.name' = 'kafka',
'sasl.kerberos.keytab' = 'kifs://security/jdoe.keytab',
'sasl.kerberos.principal' = 'jdoe@example.com'
)
CREATE CREDENTIAL kafka_cred
TYPE = 'kafka'
WITH OPTIONS
(
'security.protocol' = 'SASL_SSL',
'sasl.mechanism' = 'GSSAPI',
'sasl.kerberos.service.name' = 'kafka',
'sasl.kerberos.keytab' = 'kifs://security/jdoe.keytab',
'sasl.kerberos.principal' = 'jdoe@example.com',
'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt',
'ssl.certificate.location' = 'kifs://ssl/client.pem',
'ssl.key.location' = 'kifs://ssl/client.key',
'ssl.key.password' = 'foobaz123'
)
Kafka (Confluent)
CREATE CREDENTIAL confluent_cred
TYPE = 'confluent'
WITH OPTIONS
(
'security.protocol' = 'SSL',
'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt'
)
CREATE CREDENTIAL confluent_cred
TYPE = 'confluent'
WITH OPTIONS
(
'security.protocol' = 'SSL',
'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt',
'ssl.certificate.location' = 'kifs://ssl/client.pem'
)
CREATE CREDENTIAL confluent_cred
TYPE = 'confluent'
WITH OPTIONS
(
'security.protocol' = 'SSL',
'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt',
'ssl.certificate.location' = 'kifs://ssl/client.pem',
'ssl.key.location' = 'kifs://ssl/client.key',
'ssl.key.password' = 'foobaz123'
)
CREATE CREDENTIAL confluent_cred
TYPE = 'confluent'
WITH OPTIONS
(
'security.protocol' = 'SASL_SSL',
'sasl.mechanism' = 'PLAIN',
'sasl.username' = 'jdoe',
'sasl.password' = 'foobaz123'
)
CREATE CREDENTIAL confluent_cred
TYPE = 'confluent'
WITH OPTIONS
(
'security.protocol' = 'SASL_PLAINTEXT',
'sasl.mechanism' = 'GSSAPI',
'sasl.kerberos.service.name' = 'kafka',
'sasl.kerberos.keytab' = 'kifs://security/jdoe.keytab',
'sasl.kerberos.principal' = 'jdoe@example.com'
)
CREATE CREDENTIAL confluent_cred
TYPE = 'confluent'
WITH OPTIONS
(
'security.protocol' = 'SASL_SSL',
'sasl.mechanism' = 'GSSAPI',
'sasl.kerberos.service.name' = 'kafka',
'sasl.kerberos.keytab' = 'kifs://security/jdoe.keytab',
'sasl.kerberos.principal' = 'jdoe@example.com',
'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt',
'ssl.certificate.location' = 'kifs://ssl/client.pem',
'ssl.key.location' = 'kifs://ssl/client.key',
'ssl.key.password' = 'foobaz123'
)
Remote Repository
CREATE CREDENTIAL docker_cred
TYPE = 'docker',
IDENTITY = 'auser',
SECRET = 'Passw0rd!'
CREATE CREDENTIAL nvidia_api_cred
TYPE = 'nvidia_api_key',
SECRET = 'nvapi-abcdefghijklmnopqrstuvwxyz0123456789'
CREATE CREDENTIAL openai_api_cred
TYPE = 'openai_api_key',
SECRET = 'sp-abcdefghijklmnopqrstuvwxyz0123456789'
S3 (Amazon)
CREATE CREDENTIAL s3_cred
TYPE = 'aws_access_key',
IDENTITY = 'AKIAIOSFODNN7EXAMPLE',
SECRET = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
CREATE CREDENTIAL s3_cred
TYPE = 'aws_iam_role',
IDENTITY = 'AKIAIOSFODNN7EXAMPLE',
SECRET = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
WITH OPTIONS
(
S3_AWS_ROLE_ARN = 'arn:aws:iam::123456789012:user/JohnDoe'
)