Connection String Reference

The BEEM ODBC Driver accepts the following parameters in the connection string or DSN configuration. Most parameters are configured at install time — you typically only need to provide your credentials.

General parameters

Direct mode parameters

Tunnel parameters

These parameters configure the secure tunnel. They are typically configured at install time and do not need to be set manually. Only used in Direct mode.

Verifying the bastion host key

The driver must be able to tell the real bastion from anything else answering on
that address. This matters more than it might appear: the driver relaxes the
inner Redshift TLS check to require when tunnelling, so an interceptor would
see your database credentials and query results, not just the tunnel.

There are three modes, in order of preference.

Pinned (best). Set SSH_HOST_KEY_FP to the fingerprint listed in your BEEM
warehouse configuration. It is authoritative: the driver checks every connection
against it and never learns anything. Use this wherever the fingerprint is known
in advance.

First-use pinning (default). With no SSH_HOST_KEY_FP, the driver records
the host key the first time it connects and checks every later connection
against it. If the key ever changes, the connection is refused with the
recorded and observed fingerprints in the log.

Keys are recorded per host:port in an OpenSSH-format file, separate from your
own known_hosts:

• Windows: %APPDATA%\BEEM\known_hosts
• Other: ~/.config/BEEM/known_hosts

This is the same trust model as ssh connecting to a new host. It is weaker
than pinning — whatever answers the first connection is what gets trusted —
so on an untrusted network, pin instead.

Unverified (avoid). SSH_HOST_KEY_INSECURE=1 accepts any key, records
nothing, and logs the fingerprint it saw at ERROR level. Use it only to read a
fingerprint off a trusted network, then pin it and remove the flag.

"SSH HOST KEY CHANGED"

The recorded key for that bastion no longer matches. Either the bastion was
rebuilt, or the connection is being intercepted.

Do not delete the file to make it go away. Confirm the new fingerprint against
your BEEM warehouse configuration first; if it is legitimate, remove the line
named in the error and reconnect to record the new key.

Data API mode parameters

These parameters are for environments without bastion or SSH network permissions (e.g. due to org policies). Data API mode connects via HTTPS instead of a secure tunnel.

*Either CLUSTER_ID or WORKGROUP_NAME is required.

Examples

Direct mode (typical)

DRIVER={BEEM ODBC Driver};
MODE=Direct;
SERVER=your-beem-warehouse-endpoint;
PORT=5439;
DATABASE=analytics;
UID=admin;
PWD=secret

Server, database, and tunnel settings are typically configured at install time. You only need to provide credentials.

Direct mode without tunnel

DRIVER={BEEM ODBC Driver};
MODE=Direct;
SERVER=your-beem-warehouse-endpoint;
PORT=5439;
DATABASE=analytics;
UID=admin;
PWD=secret

Data API mode

DRIVER={BEEM ODBC Driver};
MODE=DataAPI;
DATABASE=analytics;
CLUSTER_ID=my-cluster;
REGION=us-east-1;
AWS_PROFILE=production

Data API mode with Serverless

DRIVER={BEEM ODBC Driver};
MODE=DataAPI;
DATABASE=analytics;
WORKGROUP_NAME=default;
REGION=us-east-1

Environment variables