How to specify a postgres and/or S3 secret?

[joebowbeer]

If I try to use a non-default postgres secret, duckdb tells me that the SECRET option is not supported:

ATTACH 'ducklake:postgres:dbname=postgres' AS my_ducklake (SECRET 'my_postgres');

Checking the code confirms that it isn't supported:

https://github.com/duckdb/ducklake/blob/main/src/storage/ducklake_storage.cpp

By the way, I've noticed that I need specify dbname in the attach string even if it is provided in the postgres secret, or duckdb may use some cached connection (or something from memory, I'm not sure which).

If attaching both postgres and S3, how to specify both secrets?

CREATE OR REPLACE SECRET my_postgres (
    TYPE postgres,
    HOST 'aws-0-us-west-1.pooler.supabase.com',
    PORT 6543,
    DATABASE 'postgres',
    USER 'postgres.my_project_slug',
    PASSWORD '***'
);

CREATE OR REPLACE SECRET my_s3 (
    TYPE s3,
    PROVIDER config,
    ENDPOINT 'my_project_slug.supabase.co/storage/v1/s3',
    URL_STYLE 'path',
    KEY_ID '***',
    SECRET '***',
    REGION 'us-west-1'
);

ATTACH 'ducklake:postgres:dbname=postgres'
    AS my_ducklake (DATA_PATH 's3://files');

[joebowbeer]

From @Mytherin

The Postgres secret can be passed in using META_SECRET. The S3 secret is automatically selected based on the scope - it does not need to be passed in to the ATTACH.

[joebowbeer]

Like this.

CREATE OR REPLACE SECRET my_postgres (
    TYPE postgres,
    HOST 'aws-0-us-west-1.pooler.supabase.com',
    PORT 6543,
    DATABASE 'postgres',
    USER 'postgres.my_project_slug',
    PASSWORD '***'
);

CREATE OR REPLACE SECRET my_s3 (
    TYPE s3,
    PROVIDER config,
    ENDPOINT 'my_project_slug.supabase.co/storage/v1/s3',
    URL_STYLE 'path',
    KEY_ID '***',
    SECRET '***',
    REGION 'us-west-1',
    SCOPE 's3://files'
);

ATTACH 'ducklake:postgres:dbname=postgres'
    AS my_ducklake (META_SECRET 'my_postgres', DATA_PATH 's3://files');