# External Data Sources

Add connections to databases, warehouses, and object stores for your org, link them to projects, and see how Spice resolves TLS modes.

Access and query external data sources in addition to community datasets including the ability to execute SQL joins across both by [creating custom datasets](https://spice.ai/docs/cloud/portal/datasets-and-views).

Connect databases, warehouses, object stores, and other data sources to an org, then use them across its projects. The **Connections** page lists the data sources the portal supports, such as PostgreSQL, MySQL, Snowflake, Amazon S3, SFTP, and SMB.

## Adding a connection

Org members add and manage connections at the [org](https://spice.ai/docs/cloud/portal/organizations) level. Org viewers cannot open the **Connections** page. A connection stays private to its org. A project in that org can use a connection only after the connection is linked to the project.

1. Open the org and select **Connections**.
2. Click **Add Connection**.
3. Select the data source and complete the required connection details.
4. Enter a **Name** for the connection. The portal shows this name wherever the connection is listed.

To edit or delete a connection, click the vertical ellipses menu next to it.

To use a connection in a project, an org admin links it in the project's **Settings** > **Connections**.

## TLS and certificate verification

Connections to PostgreSQL and MySQL data sources are encrypted with TLS by default. When the connection details name an SSL mode, that mode is used. When they do not, Spice.ai resolves one instead of falling back to a mode that permits an unencrypted connection.

**PostgreSQL**

| Connection string | Resolved `sslmode` |
| - | - |
| No `sslmode` | `verify-full`: the certificate chain and the hostname are both checked |
| No `sslmode`, Amazon RDS or Aurora host | `require`: TLS is required, the certificate is not verified |
| Any explicit `sslmode` | Used verbatim, including `disable` |

Amazon RDS and Aurora endpoints resolve to `require` rather than `verify-full` because their certificates are issued by Amazon's private per-region certificate authorities, which the system trust store does not carry. Encryption stays mandatory for these hosts.

Amazon's RDS root certificate authorities _are_ trusted when Spice.ai tests a connection, so testing an RDS or Aurora source that asks for `sslmode=require` or stronger succeeds without any additional certificate configuration.

> **Warning**
>
> Configuring a PostgreSQL source for [database replication](https://spice.ai/docs/features/database-replication-and-cdc) requires TLS with a verified certificate. A connection string is refused when it turns TLS off (`sslmode=disable`, `ssl=0`), accepts whatever certificate the server presents (`sslmode=no-verify`), or checks the certificate chain without checking that the certificate was issued for the host (`uselibpqcompat=true` with `require` or `verify-ca`). Use `sslmode=verify-full`.

Testing a saved connection honors the mode the connection stores rather than refusing it, so a data source that names a weaker mode explicitly keeps that mode.

**MySQL**

| Connection string | Resolved `mysql_sslmode` |
| - | - |
| No SSL parameter | `required` |
| No SSL parameter, Amazon RDS or Aurora host | `preferred` |
| `sslmode=disabled`, `tls=false` | `disabled` |
| `sslmode=preferred`, `tls=skip-verify`, `sslaccept=accept_invalid_certs` | `preferred` |