Hey @MPizzotti ,

You're right that READ_ONLY on the connection doesn't apply to Azure secrets — that flag only governs the local DuckDB database file, not remote storage.

The cleanest solution right now is to scope your Azure secret to read-only permissions at the Azure IAM level rather than at DuckDB's level. Assign the secret's service principal/managed identity only the Storage Blob Data Reader role on that container — then even if DuckDB tries to write, Azure will reject it with a 403. This is actually the more secure approach regardless.

If you need it purely at the DuckDB config level without touching Azure IAM, the current workaround is:

CREATE SECRET azure_readonly (
TYPE AZURE,
CONNECTION_STRING '...',
-- use a SAS token scoped to read-only permissions
);

Generate a SAS token in Azure Portal with only Read and List permissions checked — no Write, Create, or Delete. That SAS token is then structurally incapable of writing regardless of what DuckDB attempts.
A native READ_ONLY flag for remote storage secrets is a reasonable feature request — worth opening on the DuckDB GitHub if you want it tracked.

If this helped you, please mark it as the answer — it helps others in the community who run into the same issue find the solution faster!