Register a Cloudflare R2 secret on a connection

Source: R/secret_fns.R

Creates (or replaces) a DuckDB/MotherDuck secret of ⁠TYPE R2⁠ so subsequent reads from ⁠r2://⁠ paths authenticate against your Cloudflare R2 bucket. R2 is S3-compatible; this is a convenience wrapper over the generic create_s3_secret() that derives the endpoint from your account id.

Usage

create_r2_secret(
  .con,
  account_id,
  key_id,
  secret,
  name = "r2",
  persistent = FALSE
)

Arguments

.con

A valid DBI connection (DuckDB / MotherDuck).

account_id

Cloudflare R2 account id (the 32-character hex id).

key_id

R2 S3 access key id.

secret

R2 S3 secret access key.

name

Secret name. Defaults to “r2”.

persistent

Logical; persist the secret to the local store. Defaults to FALSE (session-scoped).

Value

Invisibly, the secret name.

Details

Requires the httpfs extension (load it first with load_extensions(.con, “httpfs”)). The secret is session-scoped by default; pass persistent = TRUE to persist it to the local secret store. On MotherDuck the secret lives in the active session and is used by the cloud engine to fetch the objects.

See Also

create_s3_secret(), load_extensions()

Other db-manage: alter_table_schema(), copy_tables_to_new_location(), create_database(), create_if_not_exists_share(), create_or_replace_share(), create_s3_secret(), create_schema(), create_table(), delete_and_create_schema(), delete_database(), delete_schema(), delete_table(), describe_share(), drop_share(), list_owned_shares(), list_shared_with_me_shares(), upload_database_to_md()

Examples

con <- connect_to_motherduck()
load_extensions(con, "httpfs")
create_r2_secret(
  con,
  account_id = Sys.getenv("R2_ACCOUNT_ID"),
  key_id     = Sys.getenv("AWS_ACCESS_KEY_ID"),
  secret     = Sys.getenv("AWS_SECRET_ACCESS_KEY")
)
DBI::dbGetQuery(con, "SELECT * FROM read_csv_auto('r2://my-bucket/data.csv')")