External Data Sources
Add connections to databases, warehouses, and object stores for your org, link them to projects, and see how Spice resolves TLS modes.
Access and query external data sources in addition to community datasets including the ability to execute SQL joins across both by creating custom datasets.
Connect databases, warehouses, object stores, and other data sources to an org, then use them across its projects. The Connections page lists the data sources the portal supports, such as PostgreSQL, MySQL, Snowflake, Amazon S3, SFTP, and SMB.
Adding a connection
Org members add and manage connections at the org level. Org viewers cannot open the Connections page. A connection stays private to its org. A project in that org can use a connection only after the connection is linked to the project.
- Open the org and select Connections.
- Click Add Connection.
- Select the data source and complete the required connection details.
- Enter a Name for the connection. The portal shows this name wherever the connection is listed.
To edit or delete a connection, click the vertical ellipses menu next to it.
To use a connection in a project, an org admin links it in the project's Settings > Connections.
TLS and certificate verification
Connections to PostgreSQL and MySQL data sources are encrypted with TLS by default. When the connection details name an SSL mode, that mode is used. When they do not, Spice.ai resolves one instead of falling back to a mode that permits an unencrypted connection.
PostgreSQL
| Connection string | Resolved sslmode |
|---|---|
No sslmode | verify-full: the certificate chain and the hostname are both checked |
No sslmode, Amazon RDS or Aurora host | require: TLS is required, the certificate is not verified |
Any explicit sslmode | Used verbatim, including disable |
Amazon RDS and Aurora endpoints resolve to require rather than verify-full because their certificates are issued by Amazon's private per-region certificate authorities, which the system trust store does not carry. Encryption stays mandatory for these hosts.
Amazon's RDS root certificate authorities are trusted when Spice.ai tests a connection, so testing an RDS or Aurora source that asks for sslmode=require or stronger succeeds without any additional certificate configuration.
Testing a saved connection honors the mode the connection stores rather than refusing it, so a data source that names a weaker mode explicitly keeps that mode.
MySQL
| Connection string | Resolved mysql_sslmode |
|---|---|
| No SSL parameter | required |
| No SSL parameter, Amazon RDS or Aurora host | preferred |
sslmode=disabled, tls=false | disabled |
sslmode=preferred, tls=skip-verify, sslaccept=accept_invalid_certs | preferred |