# MSSQLSvc/sqlserver.example.com:1433 
```

### Check the credential cache

Kerberos uses a cache to store tickets for authentication. This cache is relied upon by other tools, such as `kinit` and `sqlcmd`.

#### Inspect tickets

Use `klist` to inspect the Kerberos ticket cache and default principal.

```
klist
```

```text title="Example output"
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: custom_user@EXAMPLE.COM
```

#### Clear the cache

Use `kdestroy` to clear the cache.

```
kdestroy
```

#### Set the cache location

You can specify a different location by updating the `KRB5CCNAMME` environment variable.

```
export KRB5CCNAME=/tmp/custom_kerberos_cache
```

### Enable trace logging

You can enable detailed trace logs to help troubleshoot Kerberos authentication issues with the `KRB5_TRACE` environment variable.

```
export KRB5_TRACE=/tmp/kerberos_trace.log
```

Trace logs are available using `kinit` and with other tools that use Kerberos.

To add these to the container, update the `Dockerfile` to include additional environment variables.

```
ENV KRB5CCNAME=/tmp/krb5cc_cache
ENV KRB5_TRACE=/dev/stdout
```

Once set, all trace logs output to container logs. Retool recommends this approach if you need to troubleshoot Kerberos issues.

---

## Import resources from AWS

You can import AWS resources into Retool to autogenerate their configurations. This includes:

- Amazon S3
- PostgreSQL
- MySQL
- Microsoft SQL

After importing, you complete the configuration form and create the resource in Retool.

## Requirements

To import resources from AWS, you need:

- IAM credentials (an AWS IAM access key and secret) that support listing S3 buckets and Amazon Relational Database Service (RDS) resources.
- An IAM policy that's attached to a user or group within AWS with proper access.

See [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) and [Add or remove identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#add-policies-console) for details on obtaining this information.

When you create the IAM policy, make sure it includes the `rds:DescribeDBInstances` and `s3:ListAllMyBuckets` actions.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": ["rds:DescribeDBInstances", "s3:ListAllMyBuckets"],
      "Resource": "*"
    }
  ]
}
```

## 1. Add IAM credentials

The first time you import an AWS resource, you're prompted for AWS credentials. After adding your credentials, you don't need to enter them again to import other resources.

1. Navigate to the [Resources page](https://login.retool.com/auth/login?source=docs&redirectOnLogin=resources).
2. Click **Create new** > **From AWS**.
3. Enter your AWS IAM access key and your AWS IAM secret.
4. Click **Set up**.

## 2. Select the resource to import

After adding your AWS credentials, select the resource to import.

1. Select the resource type.
2. Select the **AWS Region** and the **S3 Bucket** or **Database** to import.
3. Click **Import**.

## 3. Create the resource

After importing the settings, Retool opens the resource configuration page with values populated by the import. Retool has resource-specific [connection guides](../index.mdx) if you need guidance on completing the configuration. After verifying the settings are correct, click **Create resource**. You can now query this resource from your apps.

## Use autofill to update resources

There is an **Autofill using** > **AWS** feature on resource configuration pages you can use to update the **AWS Region**, **S3 Bucket**, and **Database** fields. You can also use this option when creating a resource if you know the resource type you want to use ahead of time.

## Manage IAM credentials

You can manage IAM credentials on the [Settings](https://login.retool.com/auth/login?source=docs&redirectOnLogin=settings) page. Select **IAM credentials** in the sidebar, and then update or delete credentials as needed.

---

## Configure resource connections



---

## Configure Retool outbound regions for Retool Cloud

By default, traffic routes through the `us-west-2` region, based in Oregon, US. Retool’s European infrastructure is hosted in Frankfurt (AWS’s `eu-central-1` region), while our Asia-Pacific infrastructure is hosted in Singapore (AWS's `ap-southeast-1` region). You can select an outbound region that is closest to your resource and reduce query latency.

:::info

Outbound regions do not affect where Retool stores your applications or data. Queries run through Retool's primary region in `us-west-2` regardless of the outbound region you have set.

:::

## Update inbound firewall rules

import Ips from '../../../_partials/_retool-ips.mdx'

## Set a default outbound region

Use the following steps to set a default region from which Retool accesses your data sources.

1. Go to your organization's [Advanced](https://login.retool.com/auth/login?source=docs&redirectOnLogin=settings/advanced) settings.
2. In **Other Options** > **Default Retool outbound region**, select **Set Region**.
3. Choose your preferred default region. Confirm you've added the necessary IP addresses to your allowlist if your organization enforces inbound firewall rules.
4. Save the region.

## Override default outbound regions

Use the following steps to set the outbound region for an individual resource. This overrides the organization default.

1. Go to the resource's configuration page.
2. In **Advanced options**, select **Override default outbound Retool region**. If you don't see this setting, [reach out](https://docs.retool.com/page/contact-support) to the Retool team.
3. Select your region in the **Outbound Retool Region** setting.
4. If it's available on your resource, select **Test Connection** to confirm your resource still works.
5. Save your changes. Your resource now automatically uses the selected region.

---

## Configure SSH tunneling for resources

Retool supports SSH tunneling for the following data sources if they are hosted on a private network:

- [PostgreSQL](../integrations/database/postgresql.mdx)
- [MySQL](../integrations/database/mysql.mdx)
- [Microsoft SQL Server](../integrations/database/microsoft-sql-server.mdx)
- [MongoDB](../integrations/database/mongodb.mdx)
- [Cassandra](../integrations/database/cassandra.mdx)
- [Redis](../integrations/database/redis.mdx)
- [Vertica](../integrations/database/vertica.mdx)
- [RethinkDB](../integrations/database/rethinkdb.mdx)

:::info Connect without tunneling

Retool is building support for querying firewalled resources without SSH tunnels and firewalled resources that do not support SSH. To learn more or be considered for early access, contact cloud-connect@retool.com.
:::

## Configure SSH tunneling

You can configure SSH tunneling when creating a new resource or update the configuration of an existing resource. To update an existing resource, navigate to the **Resources** tab in your Retool organization settings, then select the resource to update.

1. On your resource's configuration page, select the **Enable SSH tunnel** checkbox in the **Advanced Options** section.

2. Enter the **Bastion host** and **Bastion port** with which Retool connects, then download Retool's public key. If you have multiple Retool organizations, download the public key for each organization you want SSH access for. Retool will attempt to connect to your bastion host with the corresponding private keys and the username `retool`.

3. Configure your bastion host to allow connections from Retool.

4. Create a user account for Retool. Below is a sample script run for different environments.

```shell title="Ubuntu"
ec2-user@bastion:~$ sudo adduser retool --disabled-password
Adding user `retool' ...
Adding new group `retool' (1003) ...
Adding new user `retool' (1003) with group `retool' ...
Creating home directory `/home/retool3' ...
Copying files from `/etc/skel' ...
Changing the user information for retool3
Enter the new value, or press ENTER for the default
Full Name []:
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [Y/n] y
```

```shell title="Amazon Linux"