Updates an existing storage credential's options, owner, or comment. Replaces options atomically with the new set.
ALTER STORAGE CREDENTIAL <name> SET (<key> = '<value>', ...)
[OWNER TO <new_owner>]
[COMMENT '<description>']## Overview ALTER STORAGE CREDENTIAL updates the configuration of an existing credential in place. Use it to rotate authentication material, change ownership, or refresh metadata without recreating the credential and rebinding every dependent external location. ## Behavior - The credential must already exist; otherwise the ALTER raises an error. - Options updates are processed by the executor's storage credential layer. The in-memory standalone store updates options in place; production deployments persist via the Control Plane. - The credential's `updated_at` timestamp advances on every successful ALTER. - External locations bound to the credential by name continue to resolve to the altered credential. Locations do not need to be re-created when the underlying credential changes. - ALTER does not version the previous credential state. There is no rollback to prior options short of an explicit replacement. ## Access Control Requires the admin role. ## Compatibility DeltaForge extension.
| Name | Type | Description |
|---|---|---|
name | Specifies the credential to alter. Must already exist. | |
set_options | Specifies the new option set. The supplied keys overwrite previous values for those keys; behavior for unsupplied keys depends on the executor implementation (the in-memory store replaces options atomically). | |
new_owner | Specifies a new owner principal. | |
new_comment | Specifies a new description. |
-- Rotate an AWS role to a new ARN
ALTER STORAGE CREDENTIAL prod_aws_role SET (role_arn = 'arn:aws:iam::123456789012:role/DataAccessV2');-- Update the comment
ALTER STORAGE CREDENTIAL prod_aws_role COMMENT 'Production data-lake read role (v2)';