test duckdb aws sso profile access

output.md

./test_all.sh

ENV = AWS_PROFILE env var set
P   = PROFILE param in secret

        |    ENV only (no PROFILE param)         |  PROFILE param only (no ENV)  |   ENV + PROFILE param
Version | default | sso | config | env | sso;cfg | default | sso | config | sso;cfg | default | sso | config
--------|---------|-----|--------|-----|---------|---------|-----|--------|---------|---------|-----|-------
1.3.0   | ✅      | ✅  | ❌     | ❌  | ✅      | ❌      | ✅  | ❌     | ✅      | ❌      | ✅  | ❌
1.3.1   | ❌      | ❌  | ❌     | ❌  | ❌      | ❌      | ❌  | ❌     | ❌      | ❌      | ❌  | ❌
1.3.2   | ❌      | ❌  | ❌     | ❌  | ❌      | ❌      | ❌  | ❌     | ❌      | ❌      | ❌  | ❌
1.4.0   | ❌      | ❌  | ❌     | ❌  | ❌      | ❌      | ❌  | ❌     | ❌      | ❌      | ❌  | ❌
1.4.1   | ❌      | ❌  | ❌     | ❌  | ❌      | ❌      | ❌  | ❌     | ❌      | ❌      | ❌  | ❌
1.4.2   | ❌      | ❌  | ❌     | ❌  | ❌      | ❌      | ❌  | ❌     | ❌      | ❌      | ❌  | ❌
1.4.3   | ❌      | ❌  | ❌     | ❌  | ❌      | ❌      | ❌  | ❌     | ❌      | ❌      | ❌  | ❌

test_all.sh

#!/bin/bash
# Test DuckDB AWS SSO across versions
#
# Usage:
#   ./test_all.sh
#   ./test_all.sh 1.3.0 1.4.3

# --- CONFIG (edit these) ---
PROFILE="my-profile"
S3_FILE="s3://my-bucket/my_file.parquet"
REGION="us-west-2"
# ---------------------------

VERSIONS="${@:-1.3.0 1.3.1 1.3.2 1.4.0 1.4.1 1.4.2 1.4.3}"

test_query() {
    local version=$1
    local secret_sql=$2
    local use_env=$3

    local sql="INSTALL aws; LOAD aws; INSTALL httpfs; LOAD httpfs; ${secret_sql} SELECT COUNT(*) FROM parquet_scan('${S3_FILE}');"

    if [[ "$use_env" == "yes" ]]; then
        AWS_PROFILE=$PROFILE mise exec duckdb@$version -- duckdb -c "$sql" &>/dev/null && echo "✅" || echo "❌"
    else
        mise exec duckdb@$version -- duckdb -c "$sql" &>/dev/null && echo "✅" || echo "❌"
    fi
}

# Install all versions first
for v in $VERSIONS; do
    mise install duckdb@$v -q 2>/dev/null
done

echo ""
echo "ENV = AWS_PROFILE env var set"
echo "P   = PROFILE param in secret"
echo ""
echo "        |    ENV only (no PROFILE param)         |  PROFILE param only (no ENV)  |   ENV + PROFILE param"
echo "Version | default | sso | config | env | sso;cfg | default | sso | config | sso;cfg | default | sso | config"
echo "--------|---------|-----|--------|-----|---------|---------|-----|--------|---------|---------|-----|-------"

for v in $VERSIONS; do
    # ENV only (no PROFILE param)
    e1=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, REGION '$REGION');" yes)
    e2=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, CHAIN 'sso', REGION '$REGION');" yes)
    e3=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, CHAIN 'config', REGION '$REGION');" yes)
    e4=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, CHAIN 'env', REGION '$REGION');" yes)
    e5=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, CHAIN 'sso;config', REGION '$REGION');" yes)

    # PROFILE param only (no ENV)
    p1=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, PROFILE '$PROFILE', REGION '$REGION');" no)
    p2=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, CHAIN 'sso', PROFILE '$PROFILE', REGION '$REGION');" no)
    p3=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, CHAIN 'config', PROFILE '$PROFILE', REGION '$REGION');" no)
    p4=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, CHAIN 'sso;config', PROFILE '$PROFILE', REGION '$REGION');" no)

    # Both ENV + PROFILE param
    b1=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, PROFILE '$PROFILE', REGION '$REGION');" yes)
    b2=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, CHAIN 'sso', PROFILE '$PROFILE', REGION '$REGION');" yes)
    b3=$(test_query $v "CREATE SECRET (TYPE S3, PROVIDER credential_chain, CHAIN 'config', PROFILE '$PROFILE', REGION '$REGION');" yes)

    echo "$v   | $e1      | $e2  | $e3     | $e4  | $e5      | $p1      | $p2  | $p3     | $p4      | $b1      | $b2  | $b3"
done