# UPDATE STORE
## Syntax
```sql
UPDATE STORE
store_name
WITH (store_parameter = value [, ...]);
```
## Description
Updates a [store](/overview/core-concepts/store.md) with new store parameters.
### Arguments
#### store\_name
Name of the store to update. If the name is case-sensitive, you must wrap it in double quotes; otherwise, the system uses the lower case name.
#### WITH (store\_parameter = value \[, … ])
This clause specifies store parameters; see [store parameters](#store_parameters) below for more information.
### Store Parameters
| Parameter Name | Description |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `type` | Specifies the store type.
Required: No
Type: STORE\_TYPE
Valid values: KAFKA, KINESIS, POSTGRESQL, or ORACLE.
|
| `uris` | List of comma-separated host:port URIs to connect to the store.
Required: No
Type: String
|
| `tls.disabled` | Specifies if the store should be accessed over TLS.
Required: No
Default value: FALSE
Type: Boolean
Valid values: TRUE or FALSE
|
| `tls.verify_server_hostname` | Specifies if the server CNAME should be validated against the certificate.
Required: No
Default value: TRUE
Type: Boolean
Valid values: TRUE or FALSE
|
| `tls.ca_cert_file` | Path to a CA certificate file in PEM format.
Required: No
Default value: Public CA chains.
Type: String
|
| `tls.cipher_suites` | Comma-separated list of cipher suites to use when establishing a TLS connection.
Required: No
Default value: \[]
Type: List
|
| `tls.protocols` | Comma-separated list TLS protocol versions to use while establishing a TLS connection.
Required: No
Default value: TLSv1.2,TLSv1.1,TLSv1
Type: List
Valid values: TLS protocols with version
|
| `schema_registry.name` | Name of a schema registry to associate with the store. A schema registry must first be created using the CREATE SCHEMA\_REGISTRY DDL statement. Only one schema registry can be associated with a store.
Required: No
Default value: None
Type: String
Valid values: See LIST SCHEMA\_REGISTRIES
|
| `properties.file` | The file path to a .yaml file containing other store parameters.
Required: No
Default value: None
Type: String
Valid values: File path in current user's filesystem
|
### **ClickHouse-Specific Parameters**
Parameters to be used if `type` is `CLICKHOUSE`:
| Parameter Name | Description |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `clickhouse.username` | Username to connect to the database instance specified with the store's uris parameter.
Required: Yes
Default value: None
Type: String
|
| `clickhouse.password` | Password to connect to the database instance using the store's username parameter.
Required: Yes
Default value: None
Type: String
|
### Databricks-Specific Parameters
Parameters to be used if `type` is `DATABRICKS`:
| Parameter Name | Description |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `databricks.app_token` | Databricks personal access token used when authenticating with a Databricks workspace.
Required: No
Default value: None
Type: String
|
| `aws.access_key_id` | AWS access key ID used for writing data to S3.
Required: Yes
Default value: None
Type: String
|
| `aws.secret_access_key` | AWS secret access key used for writing data to S3.
Required: Yes
Default value: None
Type: String
|
### Iceberg AWS Glue Catalog-Specific Parameters
| ParameterName | Description |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `aws.iam_role_arn` | AWS IAM role ARN to use when authenticating with S3
Required: No. If updating aws.access\_key\_id or aws.secret\_access\_key, both must be specified.
Default value: NONE
Type: STRING
|
| `aws.iam_external_id` | IAM External ID
Required: No. If updating aws.access\_key\_id or aws.secret\_access\_key, both must be specified.
Default value: NONE
Type: STRING
|
| `aws.access_key_id` | AWS IAM role ARN to use when authenticating with S3.
Required: No. If updating aws.access\_key\_id or aws.secret\_access\_key, both must be specified.
Default value: NONE
Type: STRING
|
| `aws.secret_access_key` | IAM External ID
Required: No. If updating aws.access\_key\_id or aws.secret\_access\_key, both must be specified.
Default value: NONE
Type: STRING
|
| `aws.region` | AWS region in which the glue catalog resides.
Required: No
Default value: NONE
Type: STRING
|
| `iceberg.warehouse.default_path` | Iceberg default warehouse path.
Required: No
Default value: NONE
Type: STRING
|
| `iceberg.catalog.id` | Iceberg catalog ID
Required: No
Default value: NONE
Type: STRING
|
### **Kafka-Specific Parameters**
Parameters to be used if `type` is `KAFKA`:
| Parameter Name | Description |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `kafka.sasl.hash_function` | SASL hash function to use when authenticating with Apache Kafka brokers.
Required: No
Default value: NONE.
Type: HASH\_FUNCTION
Valid values: NONE, PLAIN, SHA256, and SHA512
|
| `kafka.sasl.username` | Username to use when authenticating with Apache Kafka brokers.
Required: No
Default value: None
Type: String
|
| `kafka.sasl.password` | Password to use when authenticating with Apache Kafka brokers.
Required: No
Default value: None
Type: String
|
| `kafka.msk.aws_region` | AWS region to use when authenticating with MSK.
Required: Yes, if kafka.sasl.hash\_function is AWS\_MSK\_IAM
Default value: None
Type: String
Example: us-east-1
|
| `kafka.msk.iam_role_arn` | AWS IAM role ARN to use when authenticating with MSK.
Required: Yes, if kafka.sasl.hash\_function is AWS\_MSK\_IAM
Default value: None
Type: String
Example: arn:aws:iam::123456789012:role/example-IAM-role
|
| `tls.client.cert_file` | Path to a client certificate file in PEM format.
Required: No
Default value: None
Type: String
|
| `tls.client.key_file` | Path to the client key file in PEM format.
Required: No
Default value: None
Type: String
|
### **Kinesis-Specific Parameters**
Parameters to be used if `type` is `KINESIS`:
| Parameter Name | Description |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `kinesis.iam_role_arn` | AWS IAM role ARN to use when authenticating with an Amazon Kinesis service.
Required: Yes, unless authenticating with the Amazon Kinesis Service using static AWS credentials.
Default value: None
Type: String
Example: arn:aws:iam::123456789012:role/example-IAM-role
|
| `kinesis.access_key_id` | AWS IAM access key to use when authenticating with an Amazon Kinesis service.
Required: No
Default value: None
Type: String
|
| `kinesis.secret_access_key` | AWS IAM secret access key to use when authenticating with an Amazon Kinesis service.
Required: No
Default value: None
Type: String
|
### S3-Specific Parameters
Parameters to be used if `type` is `S3`:
| Parameter Name | Description |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `aws.iam_role_arn` | AWS IAM role ARN to use when authenticating with S3.
Required: No. If updating aws.access\_key\_id or aws.secret\_access\_key, both must be specified.
Default value: None
Type: String
|
| `aws.iam_external_id` | IAM External ID.
Required: Yes, if aws.iam\_role\_arn is specified.
Default value: None
Type: String
|
| `aws.access_key_id` | AWS IAM role ARN to use when authenticating with S3.
Required: No. If updating aws.access\_key\_id or aws.secret\_access\_key, both must be specified.
Default value: None
Type: String
|
| `aws.secret_access_key` | IAM External ID.
Required: No. If updating aws.access\_key\_id or aws.secret\_access\_key, both must be specified.
Default value: None
Type: String
|
### Oracle-Specific Parameters
Parameters to be used if `type` is `ORACLE`:
| Parameter Name | Description |
| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `oracle.username` | Username to connect to the Oracle instance specified with the store's uris parameter.
Required: No
Default value: Existing value
Type: String
|
| `oracle.password` | Password to connect to the Oracle instance using the store's oracle.username parameter.
Required: No
Default value: Existing value
Type: String
|
| `oracle.service_name` | Oracle service name for the target database.
Required: No
Default value: Existing value
Type: String
|
{% hint style="info" %}
When rotating Oracle credentials, specify `oracle.username` and `oracle.password` together in the same `UPDATE STORE` statement.
{% endhint %}
### Snowflake-Specific Parameters
Snowflake stores don't support this command.
## Examples
#### Attach a schema registry to a store
The following example updates the store named "demostore" to attach a schema registry named "ConfluentCloudSR".
```sh
demodb.public/demostore# UPDATE STORE
demostore
WITH (
'schema_registry.name' = "ConfluentCloudSR"
);
+------------+------------+------------+------------------------------------------+
| Type | Name | Command | Summary |
+============+============+============+==========================================+
| store | demostore | UPDATE | store "demostore" was successfully |
| | | | updated |
+------------+------------+------------+------------------------------------------+
```
#### Update Oracle service name
The following example updates the Oracle service name for store `oracle_store`.
```sql
UPDATE STORE
oracle_store
WITH (
'oracle.service_name' = 'FREEPDB2'
);
```
#### Rotate Oracle username and password
The following example updates the Oracle credentials for store `oracle_store`.
```sql
UPDATE STORE
oracle_store
WITH (
'oracle.username' = 'app_user_v2',
'oracle.password' = 'new_password'
);
```
#### Update Oracle service name and credentials together
The following example updates the service name and rotates credentials in one statement.
```sql
UPDATE STORE
oracle_store
WITH (
'oracle.service_name' = 'FREEPDB2',
'oracle.username' = 'app_user_v2',
'oracle.password' = 'new_password'
);
```
#### Disable TLS for an Oracle store
The following example disables TLS for store `oracle_store`.
```sql
UPDATE STORE
oracle_store
WITH (
'tls.disabled' = TRUE
);
```
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.deltastream.io/reference/sql-syntax/ddl/update-store.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.