Create a connection to a cloud storage provider (S3, GCS, Azure, etc.) using GDAL virtual filesystem.
| | Name | Type | Identifier | Description | Constraints |
|---|
| Options | Connection Name | text | NAME | A descriptive name for this connection. This name must be unique | Default: connection |
| Provider | choice | PROVIDER | Cloud storage provider. | Available Choices:
[0] Amazon S3
[1] Google Cloud Storage
[2] Microsoft Azure Blob
[3] Microsoft Azure Data Lake Storage Gen2
Default: 0 |
| Path | text | BUCKET | - | - |
| Authentication Method | choice | S3_AUTHENTICATION | - | Available Choices:
[0] Public Access (No Sign Request)
[1] Credential File
[2] Access Key ID/Secret
[3] Web Identity, Session Tokens, etc.
[4] Environment / External
Default: 2 |
| Authentication Method | choice | GS_AUTHENTICATION | - | Available Choices:
[0] Public Access (No Sign Request)
[1] Access Key ID/Secret
[2] OAuth2 Refresh Token
[3] OAuth2 Private Key (Inline)
[4] OAuth2 Private Key (File)
[5] Application Credentials
[6] Credentials File
[7] Environment / External
Default: 1 |
| Authentication Method | choice | AZ_AUTHENTICATION | - | Available Choices:
[0] Credential String
[1] Account Name/Secret
[2] Account Name/Token
[3] Account Name/SAS Token
[4] Account Name/Public Access (No Singn Request)
[5] Azure Instance Metadata Service (IMDS)
[6] Environment / External
Default: 1 |
| More Settings | text | SETTINGS | - | - |
| Validation Settings | text | VAL_SETTINGS | - | - |
| No Sing Request | boolean | AWS_NO_SIGN_REQUEST | Sets AWS_NO_SIGN_REQUEST. Determines whether to disable request signing. | Default: 0 |
| AWS Credentials File | file path | CPL_AWS_CREDENTIALS_FILE | Sets CPL_AWS_CREDENTIALS_FILE. Location of an AWS credentials file. If not specified, the standard location of ~/.aws/credentials will be checked. | Default: C:\Users\oconrad\.aws\credentials |
| Access Key ID | text | AWS_ACCESS_KEY_ID | Sets AWS_ACCESS_KEY_ID. Access key ID used for authentication. If using temporary credentials, AWS_SESSION_TOKEN must be set. | - |
| Secret Access Key | text | AWS_SECRET_ACCESS_KEY | Sets AWS_SECRET_ACCESS_KEY. Secret access key associated with AWS_ACCESS_KEY_ID. | - |
| Session Token | text | AWS_SESSION_TOKEN | Sets AWS_SESSION_TOKEN. Session token used for validation of temporary credentials (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) | - |
| S3 Expres Session Token | text | AWS_S3SESSION_TOKEN | Sets AWS_S3SESSION_TOKEN. S3 Express session token (for directory buckets). Can be used by applications handling themselves the CreateSession S3 Express request, in which case they must supply the temporary credentials with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY | - |
| Amazon Resource Name | text | AWS_ROLE_ARN | Sets AWS_ROLE_ARN. Amazon Resource Name (ARN) specifying the role to use for authentication via the AssumeRoleWithWebIdentity API. | - |
| Web Identity Token File | file path | AWS_WEB_IDENTITY_TOKEN_FILE | Sets AWS_WEB_IDENTITY_TOKEN_FILE. Duplicate explicit target name: "assumerolewithwebidentity api". Path to file with identity token for use for authentication via the AssumeRoleWithWebIdentity API. | - |
| AWS Profile | text | AWS_PROFILE | Sets AWS_PROFILE. Name of AWS profile. | Default: default |
| AWS Config File | file path | AWS_CONFIG_FILE | Sets AWS_CONFIG_FILE. Location of a config file that may provide credentials and the AWS region. if not specified the standard location of ~/.aws/config will be checked. | Default: C:\Users\oconrad\.aws\config |
| Region | text | AWS_REGION | Sets AWS_REGION. Defaults to us-east-1. Set the AWS region to which requests should be sent. Overridden by AWS_DEFAULT_REGION. | Default: us-east-1 |
| S3 Endpoint | text | AWS_S3_ENDPOINT | Sets AWS_S3_ENDPOINT. Defaults to s3.amazonaws.com. Allows the use of /vsis3/ with non-AWS remote object stores that use the AWS S3 protocol. Starting with GDAL 3.11, this can be a URL starting with http:// or https://. | Default: s3.amazonaws.com |
| Request Payer | choice | AWS_REQUEST_PAYER | Sets AWS_REQUEST_PAYER. Set to requester to access a Requester Pays bucket and acknowledge associated charges. | Available Choices:
[0] Bucket Owner
[1] Requester
Default: 0 |
| Virtual Hosting | boolean | AWS_VIRTUAL_HOSTING | Sets AWS_VIRTUAL_HOSTING. Defaults to TRUE. Select the method of accessing a bucket. If TRUE, identifies the bucket via a virtual bucket host name, e.g.: mybucket.cname.domain.com. If FALSE, identifies the bucket as the top-level directory in the URI, e.g.: cname.domain.com/mybucket | Default: 1 |
| Recursive Deletion | boolean | CPL_VSIS3_USE_BASE_RMDIR_RECURSIVE | Sets CPL_VSIS3_USE_BASE_RMDIR_RECURSIVE. Defaults to NO. If YES, recursively delete objects to avoid using batch deletion. | Default: 0 |
| Allow Directory Creation | boolean | CPL_VSIS3_CREATE_DIR_OBJECT | Sets CPL_VSIS3_CREATE_DIR_OBJECT. Defaults to YES. Determines whether to allow VSIMkdir() to create an empty object to model an empty directory. | Default: 1 |
| S3 on HTTPS | boolean | AWS_HTTPS | Sets AWS_HTTPS. Defaults to YES. If YES, AWS resources will be accessed using HTTPS. If NO, HTTP will be used. No longer needed starting with GDAL 3.11, because AWS_S3_ENDPOINT can include the protocol, and when doing so, this option is ignored. | Default: 1 |
| Chunk Size | integer number | VSIS3_CHUNK_SIZE | Sets VSIS3_CHUNK_SIZE. Defaults to 50. Set the chunk size for multipart uploads. | Default: 50 |
| Ignore Glacier | boolean | CPL_VSIL_CURL_IGNORE_GLACIER_STORAGE | Sets CPL_VSIL_CURL_IGNORE_GLACIER_STORAGE. Defaults to YES. When listing a directory, ignore files with GLACIER storage class. Superseded by CPL_VSIL_CURL_IGNORE_STORAGE_CLASSES. | Default: 1 |
| Ignore Classes | text | CPL_VSIL_CURL_IGNORE_STORAGE_CLASSES | Sets CPL_VSIL_CURL_IGNORE_STORAGE_CLASSES. Defaults to GLACIER,DEEP_ARCHIVE. Comma-separated list of storage class names that should be ignored when listing a directory. If set to empty, objects of all storage classes are retrieved). | Default: GLACIER,DEEP_ARCHIVE |
| No Sign Request | boolean | GS_NO_SIGN_REQUEST | Sets GS_NO_SIGN_REQUEST. If YES, request signing is disabled. | Default: 0 |
| Access Key ID | text | GS_ACCESS_KEY_ID | Sets GS_ACCESS_KEY_ID. Access ID for AWS-style authentication (HMAC keys). | - |
| Secret Access Key | text | GS_SECRET_ACCESS_KEY | Sets GS_SECRET_ACCESS_KEY. Secret for AWS-style authentication (HMAC keys). | - |
| Refresh Token | text | GS_OAUTH2_REFRESH_TOKEN | Sets GS_OAUTH2_REFRESH_TOKEN. OAuth2 refresh token. This refresh token can be obtained with the gdal_auth.py script (gdal_auth.py -s storage or gdal_auth.py -s storage-rw). | - |
| Client ID | text | GS_OAUTH2_CLIENT_ID | Sets GS_OAUTH2_CLIENT_ID. Client ID to be used when requesting GS_OAUTH2_REFRESH_TOKEN. | - |
| Client Secret | text | GS_OAUTH2_CLIENT_SECRET | Sets GS_OAUTH2_CLIENT_SECRET. Client secret to be used when requesting GS_OAUTH2_REFRESH_TOKEN. | - |
| Client Email | text | GS_OAUTH2_CLIENT_EMAIL | Sets GS_OAUTH2_CLIENT_EMAIL Client email for OAuth2 authentication, to be used with GS_OAUTH2_PRIVATE_KEY or GS_OAUTH2_PRIVATE_KEY_FILE. | - |
| Private Key | text | GS_OAUTH2_PRIVATE_KEY | Sets GS_OAUTH2_PRIVATE_KEY. Private key for OAuth2 authentication. Alternatively, the key may be saved in a file and referenced with GS_OAUTH2_PRIVATE_KEY_FILE. | - |
| Privat Key File | file path | GS_OAUTH2_PRIVATE_KEY_FILE | Sets GS_OAUTH2_PRIVATE_KEY_FILE. Location of private key file for OAuth2 authentication. | - |
| OAuth2 Scope | text | GS_OAUTH2_SCOPE | Sets GS_OAUTH2_SCOPE. Permission scope associated with OAuth2 authentication using GOOGLE_APPLICATION_CREDENTIALS. | - |
| Application Credential | file path | GOOGLE_APPLICATION_CREDENTIALS | Sets GOOGLE_APPLICATION_CREDENTIALS. The GOOGLE_APPLICATION_CREDENTIALS configuration option can be set to point to a JSON file containing OAuth2 service account credentials (type: service_account), in particular a private key and a client email. | - |
| Credentials File | file path | CPL_GS_CREDENTIALS_FILE | Sets CPL_GS_CREDENTIALS_FILE. Defaults to ~/.boto. Location of configuration file providing gs_secret_access_key and gs_access_key_id. | Default: C:\Users\oconrad\.boto |
| Google Project ID | text | GS_USER_PROJECT | Sets GS_USER_PROJECT. Google Project id (see https://cloud.google.com/storage/docs/xml-api/reference-headers#xgooguserproject) to charge for requests against Requester Pays buckets. | - |
| Google Compute Engine | boolean | CPL_MACHINE_IS_GCE | Sets CPL_MACHINE_IS_GCE. Check if the current machine is a Google Compute Engine instance, and if so will use the permissions associated to it (using the default service account associated with the VM). To force a machine to be detected as a GCE instance (for example for code running in a container with no access to the boot logs) you can set CPL_MACHINE_IS_GCE to YES. | Default: 0 |
| Azure Credential String | text | AZURE_STORAGE_CONNECTION_STRING | Sets AZURE_STORAGE_CONNECTION_STRING. Credential string provided in the Access Key section of the administrative interface, containing both the account name and a secret key. | - |
| Storage Account Name | text | AZURE_STORAGE_ACCOUNT | Sets AZURE_STORAGE_ACCOUNT Specifies storage account name. | - |
| Access Token | text | AZURE_STORAGE_ACCESS_TOKEN | Sets AZURE_STORAGE_ACCESS_TOKEN. Access token typically obtained using Microsoft Authentication Library (MSAL). | - |
| Secret Access Key | text | AZURE_STORAGE_ACCESS_KEY | Sets AZURE_STORAGE_ACCESS_KEY. Specifies secret key associated with AZURE_STORAGE_ACCOUNT. | - |
| Shared Access Signature | text | AZURE_STORAGE_SAS_TOKEN | Sets AZURE_STORAGE_SAS_TOKEN. Shared Access Signature. | - |
| No Sign Request | boolean | AZURE_NO_SIGN_REQUEST | Sets AZURE_NO_SIGN_REQUEST. Controls whether requests are signed. | Default: 0 |
| IMDS Object ID | text | AZURE_IMDS_OBJECT_ID | Sets AZURE_IMDS_OBJECT_ID. object_id of the managed identity you would like the token for, when using Azure Instance Metadata Service (IMDS) authentication in a Azure Virtual Machine. Required if your VM has multiple user-assigned managed identities. | - |
| IMDS Client ID | text | AZURE_IMDS_CLIENT_ID | Sets AZURE_IMDS_CLIENT_ID. client_id of the managed identity you would like the token for, when using Azure Instance Metadata Service (IMDS) authentication in a Azure Virtual Machine. Required if your VM has multiple user-assigned managed identities. | - |
| IMDS Resource ID | text | AZURE_IMDS_MSI_RES_ID | Sets AZURE_IMDS_MSI_RES_ID. msi_res_id (Azure Resource ID) of the managed identity you would like the token for, when using Azure Instance Metadata Service (IMDS) authentication in a Azure Virtual Machine. Required if your VM has multiple user-assigned managed identities. | - |
| Use Temp File | boolean | CPL_VSIL_USE_TEMP_FILE_FOR_RANDOM_WRITE | Sets CPL_VSIL_USE_TEMP_FILE_FOR_RANDOM_WRITE. Use a local temporary file to support random writes in certain virtual file systems. The temporary file will be located in CPL_TMPDIR | Default: 1 |
| Temp Directory | file path | CPL_TMPDIR | Sets, CPL_TMPDIR. By default, temporary files are written into current working directory. Sometimes this is not optimal and it would be better to write temporary files on bigger or faster drives (SSD). | Default: C:\_tmp\user |