Remote Data

Locations

Prefixes nest as in GDAL: /vsizip//vsicurl/https://example.com/data.zip/roads.shp.

Reading in place

GeoTIFFs and COGs are opened lazily: terrio info fetches the header only, and window or overview reads fetch only the tiles they touch, merging adjacent ranges into one request. Other formats are downloaded to a temporary directory first; a remote shapefile's .shx, .dbf, .prj and .cpg come with it.

terrio info https://prd-tnm.s3.amazonaws.com/StagedProducts/Elevation/1/TIFF/current/n40w106/USGS_1_n40w106.tif
terrio convert https://.../B04.tif window.tif --srcwin 4096 4096 512 512
terrio convert https://.../B04.tif preview.tif --overview 2

From Python, terrio.open_raster(url, lazy=True).read(1, window=(x, y, w, h), overview=0).

Amazon S3

Requests are signed (AWS Signature Version 4) when credentials are found, and unsigned otherwise:

• AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN;
• or a profile in ~/.aws/credentials and ~/.aws/config (AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE, AWS_CONFIG_FILE);
• AWS_NO_SIGN_REQUEST=YES forces unsigned requests for public buckets;
• AWS_REGION sets the region; requests are retried in the bucket's region when S3 reports another;
• AWS_S3_ENDPOINT, AWS_HTTPS and AWS_VIRTUAL_HOSTING target S3-compatible services.

Azure

AZURE_STORAGE_ACCOUNT names the account; AZURE_STORAGE_SAS_TOKEN authorizes private containers.

HTTP settings

The GDAL variable is read when the terrio one is not set.

Transient errors (connection failures, HTTP 429, 500, 502, 503, 504) are retried with backoff. Signatures and SAS tokens are hidden in logs and error messages.