s3_allow_server_credentials_for_system_table_disks
Allows a dynamicdisk(type = s3, ...) of a table in the system database to use the server’s own (ambient)
S3 credentials, exempting it from the s3_allow_server_credentials_in_user_queries restriction. This is for
server-internal infrastructure that ships system tables to S3 with the server’s identity (attached by the
cloud operator into the system database). Unlike the session setting, it is a server-level setting, so the
exemption also applies when the table is reloaded from metadata on restart. It is scoped to the system
database, which ordinary users cannot create tables in, so it does not relax the restriction for user queries.
s3_credentials_provider_max_cache_size
The maximum number of S3 credentials providers that can be cacheds3_load_table_anonymously_if_credentials_restricted
Controls what happens when a persistentS3 or S3Queue table, a dynamic disk(type = s3, ...), or a
DataLakeCatalog (Glue, BigLake) database is loaded from existing metadata (server startup or RESTORE) and
its definition would resolve the server’s own (ambient) S3/cloud credentials that are blocked for user
queries by s3_allow_server_credentials_in_user_queries.
When enabled (the default), the object is loaded without those credentials instead of aborting startup: an
S3/S3Queue table or a dynamic S3 disk is built with an anonymous S3 client, and a DataLakeCatalog
database is left with an unavailable catalog. The server starts, but the object is inaccessible (its requests
to a private bucket are denied, or the catalog reports a clear error) until its credentials resolve to a
permitted source again. It never silently regains the server’s identity. This keeps a single such object —
for example one created in an older version before the restriction existed, or one whose named collection was
later re-bound to use_environment_credentials = 1 — from aborting server startup.
When disabled, loading such an object instead fails, which can prevent the server from starting. Use this only
if you prefer a hard failure over a silently inaccessible table, disk, or catalog database.